@wairon/cli 5.1.1-dev.25 → 5.1.1-dev.27

package/dist/index.js

@@ -1113,7 +1113,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.25";
+    WAIRON_VERSION = "5.1.1-dev.27";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     ARCHITECT_AGENT_ID = "agent-architect";
     ARCHITECT_TEMPLATE_ID = "architect";
@@ -2253,8 +2253,8 @@ function extractTypeIdentifiers(typeStr) {
   cleaned = cleaned.replace(/(?<=\S)\s*\([^)]*\)\s*$/, "");
   cleaned = cleaned.replace(/(?<=\S)\s+[-—:]\s+[a-z\s_-]+$/, "");
   cleaned = cleaned.replace(/(["'`])(?:\\.|[^\\])*?\1/g, " ");
-  const matches2 = cleaned.match(/[a-zA-Z0-9_-]+(?:::[a-zA-Z0-9_-]+|\.[a-zA-Z0-9_-]+)*/g) || [];
-  return matches2.filter((t) => {
+  const matches = cleaned.match(/[a-zA-Z0-9_-]+(?:::[a-zA-Z0-9_-]+|\.[a-zA-Z0-9_-]+)*/g) || [];
+  return matches.filter((t) => {
     if (!/[a-zA-Z0-9]/.test(t)) return false;
     if (/^\d+$/.test(t)) return false;
     return true;
@@ -8694,6 +8694,240 @@ var init_types = __esm({
   }
 });
 
+// src/core/rules/read-model.ts
+function appendUnique(map, key, value, same) {
+  const list = map.get(key);
+  if (!list) {
+    map.set(key, [value]);
+    return;
+  }
+  if (same ? list.some((v) => same(v, value)) : list.includes(value)) return;
+  list.push(value);
+}
+function buildCodeIndex(model) {
+  const facts = /* @__PURE__ */ new Map();
+  const paths = /* @__PURE__ */ new Set();
+  const exactPaths = /* @__PURE__ */ new Set();
+  for (const f of model.files) {
+    const key = pathKey(f.path);
+    facts.set(key, f);
+    paths.add(key);
+    if (f.status === "analyzed" && f.analysisGrade === "exact") exactPaths.add(key);
+  }
+  const declarations = /* @__PURE__ */ new Map();
+  const anchors = /* @__PURE__ */ new Map();
+  const findingAnchors = /* @__PURE__ */ new Map();
+  const namesAt = (cache, path27, make) => {
+    const cached = cache.get(path27);
+    if (cached) return cached;
+    const f = facts.get(path27);
+    if (!f) return NO_NAMES;
+    const built = make(f);
+    cache.set(path27, built);
+    return built;
+  };
+  return {
+    paths,
+    exactPaths,
+    factsAt: (path27) => facts.get(pathKey(path27)),
+    declarationsAt: (path27) => namesAt(declarations, pathKey(path27), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames])),
+    anchorsAt: (path27) => namesAt(anchors, pathKey(path27), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames, ...f.anchoredNames])),
+    findingAnchorsAt: (path27) => namesAt(findingAnchors, pathKey(path27), (f) => new Set(f.anchoredNames))
+  };
+}
+function buildRealizationIndex(ctx) {
+  const implsByComponent = /* @__PURE__ */ new Map();
+  const implsByPath = /* @__PURE__ */ new Map();
+  const filesByComponent = /* @__PURE__ */ new Map();
+  const filesBySubsystem = /* @__PURE__ */ new Map();
+  const componentsByPath = /* @__PURE__ */ new Map();
+  const paths = [];
+  const seenPaths = /* @__PURE__ */ new Set();
+  for (const impl of ctx.implementations) {
+    const contract = ctx.interfaceMap.get(impl.contract);
+    if (!contract) continue;
+    const component = ctx.componentMap.get(contract.component);
+    if (!component) continue;
+    if (ctx.isInChainedSubproject(component.subsystem)) continue;
+    appendUnique(implsByComponent, component.id, impl);
+    for (const file of implementationSourceFiles(impl)) {
+      const p = pathKey(file);
+      if (!seenPaths.has(p)) {
+        seenPaths.add(p);
+        paths.push(p);
+      }
+      appendUnique(implsByPath, p, impl);
+      appendUnique(filesByComponent, component.id, p);
+      appendUnique(filesBySubsystem, component.subsystem, p);
+      appendUnique(componentsByPath, p, component, (a, b) => a.id === b.id);
+    }
+  }
+  const NONE_IMPL = [];
+  const NONE_COMP = [];
+  const NONE_PATH = [];
+  return {
+    paths,
+    implementationsOf: (compId) => implsByComponent.get(compId) ?? NONE_IMPL,
+    implementationsAt: (path27) => implsByPath.get(pathKey(path27)) ?? NONE_IMPL,
+    filesOf: (compId) => filesByComponent.get(compId) ?? NONE_PATH,
+    filesIn: (subsystemId) => filesBySubsystem.get(subsystemId) ?? NONE_PATH,
+    componentsAt: (path27) => componentsByPath.get(pathKey(path27)) ?? NONE_COMP
+  };
+}
+function buildImportGraph(index, universe) {
+  const imports = /* @__PURE__ */ new Map();
+  const traces = /* @__PURE__ */ new Map();
+  const resolveAll = (from, specifiers, into) => {
+    for (const specifier of specifiers) {
+      const to = resolveImport(from, specifier, universe);
+      if (to && to !== from) into.add(to);
+    }
+  };
+  const importsOf = (path27) => {
+    const cached = imports.get(path27);
+    if (cached) return cached;
+    const facts = index.factsAt(path27);
+    const out = /* @__PURE__ */ new Set();
+    if (facts?.status === "analyzed") resolveAll(path27, facts.imports, out);
+    imports.set(path27, out);
+    return out;
+  };
+  const tracesOf = (path27) => {
+    const cached = traces.get(path27);
+    if (cached) return cached;
+    const facts = index.factsAt(path27);
+    const out = new Set(importsOf(path27));
+    if (facts?.status === "analyzed") resolveAll(path27, facts.reexports, out);
+    traces.set(path27, out);
+    return out;
+  };
+  return {
+    paths: [...universe],
+    importsOf,
+    tracesOf,
+    connects: (from, to, allowReverse) => {
+      for (const f of from) {
+        const forward = tracesOf(f);
+        for (const t of to) if (forward.has(t)) return true;
+      }
+      if (allowReverse) {
+        for (const t of to) {
+          const reverse = tracesOf(t);
+          for (const f of from) if (reverse.has(f)) return true;
+        }
+      }
+      return false;
+    },
+    reachFrom: (start) => {
+      const seen = /* @__PURE__ */ new Set([start]);
+      const stack = [start];
+      while (stack.length) {
+        const from = stack.pop();
+        for (const to of tracesOf(from)) {
+          if (seen.has(to)) continue;
+          seen.add(to);
+          stack.push(to);
+        }
+      }
+      return seen;
+    }
+  };
+}
+function buildOwnershipIndex(ctx) {
+  const ownedBy = /* @__PURE__ */ new Map();
+  for (const comp of ctx.components) {
+    if (isRetired(comp) || !isPattern(comp)) continue;
+    for (const memberId of comp.owns) {
+      const member = ctx.componentMap.get(memberId);
+      if (!member || isPattern(member)) continue;
+      if (!ownedBy.has(memberId)) ownedBy.set(memberId, comp.id);
+    }
+  }
+  return {
+    ownedMembers: new Set(ownedBy.keys()),
+    ownerOf: (memberId) => ownedBy.get(memberId)
+  };
+}
+function buildDependencyEdges(ctx) {
+  const all = [];
+  const matrix = [];
+  for (const from of ctx.components) {
+    const fromDraft = ctx.isComponentDraft(from.id);
+    const profile = ctx.ext.profiles[ctx.getComponentProfile(from.id)];
+    for (const ref of from.dependsOn) {
+      const to = ctx.componentMap.get(ref);
+      if (!to) {
+        all.push(offTreeEdge(ctx, from, ref, fromDraft));
+        continue;
+      }
+      const edge = {
+        from,
+        ref,
+        to,
+        reach: to.subsystem === from.subsystem ? "internal" : "cross-subsystem",
+        retired: isRetired(from) || isRetired(to),
+        draftContext: fromDraft || ctx.isComponentDraft(to.id),
+        licensed: profile?.allowedEdges?.some(
+          (e) => e.from.includes(from.componentType) && e.to.includes(to.componentType)
+        ) ?? false
+      };
+      all.push(edge);
+      if (edge.reach === "internal" && !edge.retired && !edge.licensed) matrix.push(edge);
+    }
+  }
+  return { all, matrix };
+}
+function buildSpecIds(ctx) {
+  const out = [];
+  for (const s of ctx.subsystems) out.push({ id: s.id, kind: "Subsystem" });
+  for (const c of ctx.components) out.push({ id: c.id, kind: "Component" });
+  for (const i of ctx.interfaces) out.push({ id: i.id, kind: "Interface" });
+  for (const im of ctx.implementations) out.push({ id: im.id, kind: "Implementation" });
+  for (const t of ctx.types) out.push({ id: t.id, kind: "Type" });
+  return out;
+}
+function buildImplementationMethods(ctx) {
+  const out = [];
+  for (const impl of ctx.implementations) {
+    const contract = ctx.interfaceMap.get(impl.contract);
+    if (!contract) continue;
+    const component = ctx.componentMap.get(contract.component);
+    if (!component) continue;
+    if (ctx.isInChainedSubproject(component.subsystem)) continue;
+    const draftContext = ctx.isImplementationDraft(impl);
+    for (const method of impl.methods) {
+      const sourceFile = methodSourceFile(method, impl.sourcePath);
+      out.push({
+        implementation: impl,
+        method,
+        component,
+        ...sourceFile !== void 0 ? { sourceFile } : {},
+        draftContext
+      });
+    }
+  }
+  return out;
+}
+function offTreeEdge(ctx, from, ref, fromDraft) {
+  const base = { from, ref, retired: false, draftContext: fromDraft, licensed: false };
+  const external = ctx.isExternalNamespaceRef(ref);
+  if (external || ctx.isCollapsedCrossTreeRef(ref, from.subsystem)) {
+    const surface = ctx.resolveSurfaceRef(ref, from.subsystem);
+    if (surface.kind === "ambiguous") return { ...base, reach: "ambiguous", surface };
+    if (surface.kind === "resolved") return { ...base, reach: "surface", surface };
+    if (external) return { ...base, reach: "unpinned" };
+  }
+  return { ...base, reach: "missing" };
+}
+var NO_NAMES;
+var init_read_model = __esm({
+  "src/core/rules/read-model.ts"() {
+    "use strict";
+    init_models();
+    NO_NAMES = /* @__PURE__ */ new Set();
+  }
+});
+
 // src/core/rules/integrity/hierarchy-integrity.ts
 var hierarchyRule;
 var init_hierarchy_integrity = __esm({
@@ -8774,48 +9008,58 @@ var init_hierarchy_integrity = __esm({
   }
 });
 
-// src/core/rules/integrity/namespace-hygiene.ts
-var namespaceHygieneRule;
-var init_namespace_hygiene = __esm({
-  "src/core/rules/integrity/namespace-hygiene.ts"() {
+// src/core/rules/integrity/reserved-id-segments.ts
+var reservedIdSegmentsRule;
+var init_reserved_id_segments = __esm({
+  "src/core/rules/integrity/reserved-id-segments.ts"() {
+    "use strict";
+    reservedIdSegmentsRule = {
+      name: "reserved-id-segments",
+      description: 'No segment of a spec id may be the reserved namespace keyword "super" \u2014 the :: grammar consumes it as a namespace hop, so a stored reference to such an id resolves to a different spec.',
+      codes: [
+        { code: "RESERVED_ID_SEGMENT", defaultSeverity: "error", summary: 'Id uses the reserved namespace keyword "super"' }
+      ],
+      check(ctx) {
+        for (const spec of ctx.specIds()) {
+          if (!ctx.isSpecInScope(spec.id)) continue;
+          if (!spec.id.split("::").includes("super")) continue;
+          ctx.addIssue(
+            "error",
+            "RESERVED_ID_SEGMENT",
+            `${spec.kind} id "${spec.id}" uses the reserved namespace keyword "super" \u2014 stored references to it would be consumed as a namespace hop and resolve to a different spec.`,
+            spec.id
+          );
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/integrity/namespace-shadowing.ts
+var namespaceShadowingRule;
+var init_namespace_shadowing = __esm({
+  "src/core/rules/integrity/namespace-shadowing.ts"() {
     "use strict";
-    namespaceHygieneRule = {
-      name: "namespace-hygiene",
-      description: 'Ids must stay resolvable in the :: namespace grammar: no id segment may be the reserved keyword "super", and a subproject-local name must not shadow a root-level subsystem id \u2014 a bare reference to a shadowed name silently anchors to the ROOT subsystem, so the local spec becomes unaddressable.',
+    namespaceShadowingRule = {
+      name: "namespace-shadowing",
+      description: "A subproject-local name must not shadow a root-level subsystem id \u2014 inside its subproject a bare reference to the shadowed name anchors to the ROOT subsystem, so the local spec cannot be addressed reliably.",
       codes: [
-        { code: "RESERVED_ID_SEGMENT", defaultSeverity: "error", summary: 'Id uses the reserved namespace keyword "super"' },
         { code: "NAMESPACE_SHADOWING", defaultSeverity: "error", summary: "Subproject-local id shadows a root subsystem id (bare references anchor to the root)" }
       ],
       check(ctx) {
         const rootSubs = new Set(ctx.subsystems.filter((s) => !s.id.includes("::")).map((s) => s.id));
-        const checkId = (id, kindLabel) => {
-          if (!ctx.isSpecInScope(id)) return;
-          const segments = id.split("::");
-          if (segments.includes("super")) {
-            ctx.addIssue(
-              "error",
-              "RESERVED_ID_SEGMENT",
-              `${kindLabel} id "${id}" uses the reserved namespace keyword "super" \u2014 stored references to it would be consumed as a namespace hop and resolve to a different spec.`,
-              id
-            );
-          }
-          if (segments.length > 1) {
-            const local = segments[segments.length - 1];
-            if (rootSubs.has(local)) {
-              ctx.addIssue(
-                "error",
-                "NAMESPACE_SHADOWING",
-                `${kindLabel} "${id}" shadows root subsystem "${local}" \u2014 inside its subproject a bare reference to "${local}" anchors to the ROOT subsystem, so this spec cannot be addressed reliably. Rename one of them.`,
-                id
-              );
-            }
-          }
-        };
-        for (const s of ctx.subsystems) checkId(s.id, "Subsystem");
-        for (const c of ctx.components) checkId(c.id, "Component");
-        for (const i of ctx.interfaces) checkId(i.id, "Interface");
-        for (const im of ctx.implementations) checkId(im.id, "Implementation");
-        for (const t of ctx.types) checkId(t.id, "Type");
+        for (const spec of ctx.specIds()) {
+          if (!ctx.isSpecInScope(spec.id)) continue;
+          const segments = spec.id.split("::");
+          const local = segments[segments.length - 1];
+          if (segments.length <= 1 || !rootSubs.has(local)) continue;
+          ctx.addIssue(
+            "error",
+            "NAMESPACE_SHADOWING",
+            `${spec.kind} "${spec.id}" shadows root subsystem "${local}" \u2014 inside its subproject a bare reference to "${local}" anchors to the ROOT subsystem, so this spec cannot be addressed reliably. Rename one of them.`,
+            spec.id
+          );
+        }
       }
     };
   }
@@ -8960,10 +9204,48 @@ var init_signature_type_references = __esm({
   }
 });
 
-// src/core/rules/integrity/public-surface.ts
-var pubTypeMatches, EVENT_VOCAB, expectedFor, publicSurfaceRule;
-var init_public_surface = __esm({
-  "src/core/rules/integrity/public-surface.ts"() {
+// src/core/rules/integrity/public-surface-binding.ts
+var publicSurfaceBindingRule;
+var init_public_surface_binding = __esm({
+  "src/core/rules/integrity/public-surface-binding.ts"() {
+    "use strict";
+    init_models();
+    publicSurfaceBindingRule = {
+      name: "public-surface-binding",
+      description: "Every declared publicInterface names a backing component, that component exists, and the subsystem owns it \u2014 a subsystem may only publish its own components.",
+      codes: [
+        { code: "PUBLIC_INTERFACE_UNBOUND", defaultSeverity: "error", summary: "Public interface with no backing component" },
+        { code: "PUBLIC_INTERFACE_INVALID_COMPONENT", defaultSeverity: "error", summary: "Public interface references a non-existent component" },
+        { code: "PUBLIC_INTERFACE_FOREIGN_COMPONENT", defaultSeverity: "error", summary: "Subsystem publishing a component it does not own" }
+      ],
+      check(ctx) {
+        for (const sub of ctx.subsystems) {
+          const isDraftCtx = isDraftSubsystem(sub);
+          for (const pi of sub.publicInterfaces) {
+            if (!pi.component) {
+              ctx.addIssue("error", "PUBLIC_INTERFACE_UNBOUND", `Subsystem "${sub.id}" declares a ${pi.type} public interface with no backing component. Bind it to the component that realizes it (publicInterfaces[].component).`, sub.id, isDraftCtx);
+              continue;
+            }
+            const backing = ctx.componentMap.get(pi.component);
+            if (!backing) {
+              ctx.addIssue("error", "PUBLIC_INTERFACE_INVALID_COMPONENT", `Subsystem "${sub.id}" public interface references component "${pi.component}" which does not exist.`, sub.id, isDraftCtx);
+              continue;
+            }
+            const isSubsystemOwner = backing.subsystem === sub.id || backing.subsystem.startsWith(sub.id + "::");
+            if (!isSubsystemOwner) {
+              ctx.addIssue("error", "PUBLIC_INTERFACE_FOREIGN_COMPONENT", `Subsystem "${sub.id}" publishes component "${pi.component}", but it belongs to subsystem "${backing.subsystem}". A subsystem may only publish its own components.`, sub.id, isDraftCtx);
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/integrity/public-surface-declared-type.ts
+var pubTypeMatches, EVENT_VOCAB, expectedFor, publicSurfaceDeclaredTypeRule;
+var init_public_surface_declared_type = __esm({
+  "src/core/rules/integrity/public-surface-declared-type.ts"() {
     "use strict";
     init_models();
     pubTypeMatches = (piType, ct, portalType) => {
@@ -8997,45 +9279,22 @@ var init_public_surface = __esm({
           return "a compatible component";
       }
     };
-    publicSurfaceRule = {
-      name: "public-surface",
-      description: "Every declared publicInterface is bound to an existing component of this subsystem whose stereotype can realize the declared interface type; Custom entries whose prose implies eventing must be backed by an event-capable component.",
+    publicSurfaceDeclaredTypeRule = {
+      name: "public-surface-declared-type",
+      description: "A publicInterface entry's declared type must be realizable by the stereotype of its backing component; Custom entries whose prose implies eventing must be backed by an event-capable component.",
       codes: [
-        { code: "PUBLIC_INTERFACE_UNBOUND", defaultSeverity: "error", summary: "Public interface with no backing component" },
-        { code: "PUBLIC_INTERFACE_INVALID_COMPONENT", defaultSeverity: "error", summary: "Public interface references a non-existent component" },
-        { code: "PUBLIC_INTERFACE_FOREIGN_COMPONENT", defaultSeverity: "error", summary: "Subsystem publishing a component it does not own" },
         { code: "PUBLIC_INTERFACE_TYPE_MISMATCH", defaultSeverity: "error", summary: "Backing component cannot realize the declared interface type" },
-        { code: "PUBLIC_INTERFACE_INVALID_INTERFACE", defaultSeverity: "error", summary: "Bound L3 interface missing or belonging to another component" },
         { code: "PUBLIC_INTERFACE_EVENT_MISTYPED", defaultSeverity: "warning", summary: "Custom interface describing eventing backed by a non-event component" }
       ],
       check(ctx) {
         for (const sub of ctx.subsystems) {
           const isDraftCtx = isDraftSubsystem(sub);
           for (const pi of sub.publicInterfaces) {
-            if (!pi.component) {
-              ctx.addIssue("error", "PUBLIC_INTERFACE_UNBOUND", `Subsystem "${sub.id}" declares a ${pi.type} public interface with no backing component. Bind it to the component that realizes it (publicInterfaces[].component).`, sub.id, isDraftCtx);
-              continue;
-            }
-            const backing = ctx.componentMap.get(pi.component);
-            if (!backing) {
-              ctx.addIssue("error", "PUBLIC_INTERFACE_INVALID_COMPONENT", `Subsystem "${sub.id}" public interface references component "${pi.component}" which does not exist.`, sub.id, isDraftCtx);
-              continue;
-            }
-            const isSubsystemOwner = backing.subsystem === sub.id || backing.subsystem.startsWith(sub.id + "::");
-            if (!isSubsystemOwner) {
-              ctx.addIssue("error", "PUBLIC_INTERFACE_FOREIGN_COMPONENT", `Subsystem "${sub.id}" publishes component "${pi.component}", but it belongs to subsystem "${backing.subsystem}". A subsystem may only publish its own components.`, sub.id, isDraftCtx);
-            }
+            const backing = pi.component ? ctx.componentMap.get(pi.component) : void 0;
+            if (!backing) continue;
             if (!pubTypeMatches(pi.type, backing.componentType, backing.portalType)) {
               ctx.addIssue("error", "PUBLIC_INTERFACE_TYPE_MISMATCH", `Subsystem "${sub.id}" declares a ${pi.type} public interface backed by "${pi.component}" (${backing.componentType}${backing.portalType ? `/${backing.portalType}` : ""}), which cannot realize ${pi.type}. Expected ${expectedFor(pi.type)}.`, sub.id, isDraftCtx);
             }
-            if (pi.interface) {
-              const intf = ctx.interfaceMap.get(pi.interface);
-              if (!intf) {
-                ctx.addIssue("error", "PUBLIC_INTERFACE_INVALID_INTERFACE", `Subsystem "${sub.id}" public interface references interface "${pi.interface}" which does not exist.`, sub.id, isDraftCtx);
-              } else if (intf.component !== pi.component) {
-                ctx.addIssue("error", "PUBLIC_INTERFACE_INVALID_INTERFACE", `Subsystem "${sub.id}" binds interface "${pi.interface}" to component "${pi.component}", but that interface belongs to component "${intf.component}".`, sub.id, isDraftCtx);
-              }
-            }
             if (pi.type === "Custom" && EVENT_VOCAB.test(pi.details)) {
               const eventCapable = backing.componentType === "Observer" || backing.componentType === "Portal" && backing.portalType === "MessageBus";
               if (!eventCapable) {
@@ -9049,6 +9308,37 @@ var init_public_surface = __esm({
   }
 });
 
+// src/core/rules/integrity/public-surface-bound-contract.ts
+var publicSurfaceBoundContractRule;
+var init_public_surface_bound_contract = __esm({
+  "src/core/rules/integrity/public-surface-bound-contract.ts"() {
+    "use strict";
+    init_models();
+    publicSurfaceBoundContractRule = {
+      name: "public-surface-bound-contract",
+      description: "A publicInterface entry that binds an L3 interface must bind one that exists and that belongs to the component the entry publishes.",
+      codes: [
+        { code: "PUBLIC_INTERFACE_INVALID_INTERFACE", defaultSeverity: "error", summary: "Bound L3 interface missing or belonging to another component" }
+      ],
+      check(ctx) {
+        for (const sub of ctx.subsystems) {
+          const isDraftCtx = isDraftSubsystem(sub);
+          for (const pi of sub.publicInterfaces) {
+            if (!pi.interface) continue;
+            if (!pi.component || !ctx.componentMap.has(pi.component)) continue;
+            const intf = ctx.interfaceMap.get(pi.interface);
+            if (!intf) {
+              ctx.addIssue("error", "PUBLIC_INTERFACE_INVALID_INTERFACE", `Subsystem "${sub.id}" public interface references interface "${pi.interface}" which does not exist.`, sub.id, isDraftCtx);
+            } else if (intf.component !== pi.component) {
+              ctx.addIssue("error", "PUBLIC_INTERFACE_INVALID_INTERFACE", `Subsystem "${sub.id}" binds interface "${pi.interface}" to component "${pi.component}", but that interface belongs to component "${intf.component}".`, sub.id, isDraftCtx);
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
 // src/core/rules/integrity/lint-allows.ts
 var lintAllowsRule;
 var init_lint_allows = __esm({
@@ -9654,7 +9944,7 @@ var init_narrative_jump_edges = __esm({
   }
 });
 
-// src/core/rules/narrative/narrative-antipatterns.ts
+// src/core/rules/narrative/completed-step-graph.ts
 function completedStepGraph(steps) {
   const numbers = steps.flatMap((s) => [
     s.stepNumber,
@@ -9684,6 +9974,14 @@ function isUnavoidable(steps, target) {
     if (s.type === "return" || s.type === "throw") return true;
     const arms = s.type === "parallel" ? (s.branches ?? []).map((b) => b.step).filter((e) => graph.stepAt(e) !== void 0) : [];
     if (arms.length) return arms.every((e) => completes.has(e));
+    const guaranteed = s.endStep !== void 0 && (s.type === "try" || s.type === "loop" && s.loopKind === "doWhile");
+    if (guaranteed) {
+      const bodyEntry = graph.nextOf(n);
+      if (bodyEntry !== void 0 && bodyEntry <= s.endStep) {
+        if (s.type === "loop") return completes.has(bodyEntry);
+        if (bodyEntry === target) return false;
+      }
+    }
     return graph.successorsOf(n).some((t) => completes.has(t));
   };
   const order = [...graph.stepNumbers].reverse();
@@ -9747,25 +10045,27 @@ function stronglyConnected(nums, successorsOf) {
   }
   return sccs;
 }
-var byCodeUnit, narrativeAntipatternsRule;
-var init_narrative_antipatterns = __esm({
-  "src/core/rules/narrative/narrative-antipatterns.ts"() {
+var init_completed_step_graph = __esm({
+  "src/core/rules/narrative/completed-step-graph.ts"() {
     "use strict";
     init_models();
-    byCodeUnit = (a, b) => a < b ? -1 : a > b ? 1 : 0;
-    narrativeAntipatternsRule = {
-      name: "narrative-antipatterns",
-      description: "Provable narrative bugs, caught at spec level before implementation: a step-graph cycle with no exit edge and no return/throw member never terminates by construction (INESCAPABLE_CYCLE); a branch or switch whose arms all target the same step decides nothing (MEANINGLESS_BRANCH); a method-level call cycle across components in which every call edge is unavoidable on every entry-to-exit path is unbounded recursion (UNCONDITIONAL_CALL_CYCLE \u2014 dispatch steps resolved through their portal tables; a cycle with even one guarded edge is NOT flagged, since prose conditions are never judged). Structure-only claims \u2014 warnings, lint.allow-suppressible.",
+  }
+});
+
+// src/core/rules/narrative/meaningless-branches.ts
+var meaninglessBranchesRule;
+var init_meaningless_branches = __esm({
+  "src/core/rules/narrative/meaningless-branches.ts"() {
+    "use strict";
+    init_completed_step_graph();
+    meaninglessBranchesRule = {
+      name: "meaningless-branches",
+      description: "A branch or switch whose arms all target the same step decides nothing: the condition is evaluated and flow continues at one place whatever it answers. A decision's targets are its explicit ones plus, where it leaves its fall-through field unset, the steps the step graph continues it at \u2014 so the classic authoring slip of pointing both arms at the next step is caught. Structure-only \u2014 a warning, lint.allow-suppressible.",
       codes: [
-        { code: "INESCAPABLE_CYCLE", defaultSeverity: "warning", summary: "Step cycle with no exit edge and no return/throw member \u2014 never terminates by construction" },
-        { code: "MEANINGLESS_BRANCH", defaultSeverity: "warning", summary: "Branch/switch whose arms all target the same step \u2014 the decision changes nothing" },
-        { code: "UNCONDITIONAL_CALL_CYCLE", defaultSeverity: "warning", summary: "Cross-component call cycle in which every call edge is unavoidable \u2014 unbounded recursion by construction" }
+        { code: "MEANINGLESS_BRANCH", defaultSeverity: "warning", summary: "Branch/switch whose arms all target the same step \u2014 the decision changes nothing" }
       ],
       check(ctx) {
-        const callEdges = [];
         for (const impl of ctx.implementations) {
-          const contract = ctx.interfaceMap.get(impl.contract);
-          const component = contract ? ctx.componentMap.get(contract.component) : void 0;
           const isDraftCtx = ctx.isImplementationDraft(impl);
           for (const implMethod of impl.methods) {
             const steps = implMethod.narrative;
@@ -9804,6 +10104,33 @@ var init_narrative_antipatterns = __esm({
                 }
               }
             }
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/narrative/inescapable-cycles.ts
+var inescapableCyclesRule;
+var init_inescapable_cycles = __esm({
+  "src/core/rules/narrative/inescapable-cycles.ts"() {
+    "use strict";
+    init_completed_step_graph();
+    inescapableCyclesRule = {
+      name: "inescapable-cycles",
+      description: "A cycle in a narrative's step graph with no exit edge and no return or throw member never terminates, by construction: every path that enters it stays inside it forever. Read over the step graph closed by a completion step, so falling off the end of the narrative counts as leaving. Structure-only \u2014 prose conditions are never judged \u2014 and reported as a warning, lint.allow-suppressible.",
+      codes: [
+        { code: "INESCAPABLE_CYCLE", defaultSeverity: "warning", summary: "Step cycle with no exit edge and no return/throw member \u2014 never terminates by construction" }
+      ],
+      check(ctx) {
+        for (const impl of ctx.implementations) {
+          const isDraftCtx = ctx.isImplementationDraft(impl);
+          for (const implMethod of impl.methods) {
+            const steps = implMethod.narrative;
+            if (!steps.length) continue;
+            const where = `Method "${implMethod.name}" in implementation "${impl.id}": `;
+            const graph = completedStepGraph(steps);
             for (const scc of stronglyConnected(graph.stepNumbers, graph.successorsOf)) {
               const inScc = new Set(scc);
               const isCycle = scc.length > 1 || graph.successorsOf(scc[0]).includes(scc[0]);
@@ -9824,7 +10151,35 @@ var init_narrative_antipatterns = __esm({
                 );
               }
             }
-            if (!component) continue;
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/narrative/unconditional-call-cycles.ts
+var byCodeUnit, unconditionalCallCyclesRule;
+var init_unconditional_call_cycles = __esm({
+  "src/core/rules/narrative/unconditional-call-cycles.ts"() {
+    "use strict";
+    init_completed_step_graph();
+    byCodeUnit = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+    unconditionalCallCyclesRule = {
+      name: "unconditional-call-cycles",
+      description: "A method-level call cycle across components in which every call edge is unavoidable on every entry-to-exit path of its narrative is unbounded recursion, by construction. Dispatch steps are resolved through their portal's table; register steps are never edges (a handoff defers the invocation to the runtime, so it cannot recurse). A cycle with even one guarded edge is NOT flagged, since prose conditions are never judged. Structure-only \u2014 a warning, lint.allow-suppressible, anchored on the member edge that sorts first so one allow covers the cycle.",
+      codes: [
+        { code: "UNCONDITIONAL_CALL_CYCLE", defaultSeverity: "warning", summary: "Cross-component call cycle in which every call edge is unavoidable \u2014 unbounded recursion by construction" }
+      ],
+      check(ctx) {
+        const callEdges = [];
+        for (const impl of ctx.implementations) {
+          const contract = ctx.interfaceMap.get(impl.contract);
+          const component = contract ? ctx.componentMap.get(contract.component) : void 0;
+          if (!component) continue;
+          for (const implMethod of impl.methods) {
+            const steps = implMethod.narrative;
+            if (!steps.length) continue;
             const fromKey = `${component.id}::${implMethod.name}`;
             for (const s of steps) {
               let toComponent;
@@ -9886,35 +10241,29 @@ var init_narrative_antipatterns = __esm({
 });
 
 // src/core/rules/narrative/narrative-detail.ts
-var DEFAULT_MAX_UNNARRATED_COMPLEXITY, narrativeDetailRule;
+var narrativeDetailRule;
 var init_narrative_detail = __esm({
   "src/core/rules/narrative/narrative-detail.ts"() {
     "use strict";
     init_models();
-    DEFAULT_MAX_UNNARRATED_COMPLEXITY = 8;
     narrativeDetailRule = {
       name: "narrative-detail",
-      description: "The narrative detail dial: each method resolves to full | calls-only | intent (method override \u2192 spec default \u2192 stereotype default). full requires a narrative; intent-level methods without a narrative must specify behavior as non-trivial prose (L4 intent or L3 description) \u2014 dialing detail down never means leaving behavior unspecified. Explicit declarations are held to their promise as errors; stereotype-defaulted gaps surface as warnings. Detail sufficiency rides along: a method whose realized function \u2014 in the method's own source file, else the implementation's \u2014 measures real branching (cyclomatic complexity above rules.complexity.maxUnnarratedComplexity, exact AST grade only) may not hide below detail: full without a narrative (UNNARRATED_COMPLEXITY), and an explicit dial below a full-floor logic stereotype without a narrative is a visible, lint.allow-justifiable choice (DETAIL_BELOW_STEREOTYPE). Both are honest lints over declarations \u2014 they never claim the narrative or prose is CORRECT.",
+      description: "The narrative detail dial: each method resolves to full | calls-only | intent (method override \u2192 spec default \u2192 stereotype default). full requires a narrative; intent-level methods without a narrative must specify behavior as non-trivial prose (L4 intent or L3 description) \u2014 dialing detail down never means leaving behavior unspecified. Explicit declarations are held to their promise as errors; stereotype-defaulted gaps surface as warnings. An honest lint over declarations \u2014 it never claims the narrative or the prose is CORRECT.",
       codes: [
         { code: "MISSING_NARRATIVE", defaultSeverity: "warning", summary: "Method resolved to detail: full but has no narrative (error when the level was declared explicitly)" },
-        { code: "INTENT_FLOOR", defaultSeverity: "warning", summary: "Intent-level method whose intent/description prose is missing or placeholder-thin (error when declared explicitly)" },
-        { code: "UNNARRATED_COMPLEXITY", defaultSeverity: "warning", summary: "Method below detail: full with no narrative whose realized function, in the method's source file, has real branching (cyclomatic complexity over the configured threshold, exact-grade analysis only)" },
-        { code: "DETAIL_BELOW_STEREOTYPE", defaultSeverity: "warning", summary: "Method explicitly dialed below the full narrative floor of its logic stereotype, with no narrative" }
+        { code: "INTENT_FLOOR", defaultSeverity: "warning", summary: "Intent-level method whose intent/description prose is missing or placeholder-thin (error when declared explicitly)" }
       ],
       check(ctx) {
-        const factsByPath = /* @__PURE__ */ new Map();
-        for (const f of ctx.codeModel.files) factsByPath.set(pathKey(f.path), f);
         for (const impl of ctx.implementations) {
           const contract = ctx.interfaceMap.get(impl.contract);
           if (!contract) continue;
           const component = ctx.componentMap.get(contract.component);
-          const isDraftCtx = impl.status === "draft" || impl.status === "design" || contract.status === "draft" || contract.status === "design" || ctx.isComponentDraft(contract.component);
+          const isDraftCtx = ctx.isImplementationDraft(impl);
           for (const implMethod of impl.methods) {
             const contractMethod = contract.methods.find((m) => m.name === implMethod.name);
             if (!contractMethod) continue;
+            if (implMethod.narrative.length > 0) continue;
             const eff = effectiveDetail(implMethod, impl, component);
-            const hasNarrative = implMethod.narrative.length > 0;
-            if (hasNarrative) continue;
             if (eff.level === "full") {
               ctx.addIssue(
                 eff.explicit ? "error" : "warning",
@@ -9925,34 +10274,6 @@ var init_narrative_detail = __esm({
               );
               continue;
             }
-            let complexityFired = false;
-            const tier = implMethod.conformance ?? impl.conformance ?? defaultConformanceTier(component);
-            const file = methodSourceFile(implMethod, impl.sourcePath);
-            if (file && tier !== "off" && !(component && ctx.isInChainedSubproject(component.subsystem))) {
-              const facts = factsByPath.get(pathKey(file));
-              const symbol = implMethod.symbol ?? implMethod.name;
-              const complexity = facts?.status === "analyzed" && facts.analysisGrade === "exact" && facts.functionComplexity && Object.prototype.hasOwnProperty.call(facts.functionComplexity, symbol) ? facts.functionComplexity[symbol] : void 0;
-              const limit = ctx.complexityConfigFor(component?.subsystem)?.maxUnnarratedComplexity ?? DEFAULT_MAX_UNNARRATED_COMPLEXITY;
-              if (complexity !== void 0 && complexity > limit) {
-                complexityFired = true;
-                ctx.addIssue(
-                  "warning",
-                  "UNNARRATED_COMPLEXITY",
-                  `Method "${implMethod.name}" in implementation "${impl.id}" sits at detail: ${eff.level} with no narrative, but its realized function "${symbol}" in "${file}" measures cyclomatic complexity ${complexity} (limit ${limit}) \u2014 real branching is hiding behind ${eff.level}. Write the narrative, or keep the dial with a lint.allow stating why the branching needs no choreography.`,
-                  impl.id,
-                  isDraftCtx
-                );
-              }
-            }
-            if (!complexityFired && eff.explicit && component && isLogic(component)) {
-              ctx.addIssue(
-                "warning",
-                "DETAIL_BELOW_STEREOTYPE",
-                `Method "${implMethod.name}" in implementation "${impl.id}" is explicitly dialed to detail: ${eff.level}, below the full narrative floor of its ${component.componentType} stereotype, and has no narrative. Logic behavior belongs in a narrative \u2014 write one, or keep the dial with a lint.allow stating why.`,
-                impl.id,
-                isDraftCtx
-              );
-            }
             const prose = implMethod.intent ?? contractMethod.description;
             if (!passesIntentFloor(prose, implMethod.name)) {
               ctx.addIssue(
@@ -9970,6 +10291,71 @@ var init_narrative_detail = __esm({
   }
 });
 
+// src/core/rules/narrative/detail-sufficiency.ts
+var DEFAULT_MAX_UNNARRATED_COMPLEXITY, detailSufficiencyRule;
+var init_detail_sufficiency = __esm({
+  "src/core/rules/narrative/detail-sufficiency.ts"() {
+    "use strict";
+    init_models();
+    DEFAULT_MAX_UNNARRATED_COMPLEXITY = 8;
+    detailSufficiencyRule = {
+      name: "detail-sufficiency",
+      description: "A method dialed below detail: full with no narrative may not be hiding behavior it owes a reader. A method whose realized function \u2014 in the method's own source file, else the implementation's \u2014 measures real branching (cyclomatic complexity above rules.complexity.maxUnnarratedComplexity, exact AST grade only) is reported (UNNARRATED_COMPLEXITY), and an explicit dial below a full-floor logic stereotype without a narrative is a visible, lint.allow-justifiable choice (DETAIL_BELOW_STEREOTYPE) \u2014 reported only where the measured finding did not already fire, since evidence outranks expectation. Both are honest lints over declarations: they never claim a narrative would be correct, only that the dial hides something.",
+      codes: [
+        { code: "UNNARRATED_COMPLEXITY", defaultSeverity: "warning", summary: "Method below detail: full with no narrative whose realized function, in the method's source file, has real branching (cyclomatic complexity over the configured threshold, exact-grade analysis only)" },
+        { code: "DETAIL_BELOW_STEREOTYPE", defaultSeverity: "warning", summary: "Method explicitly dialed below the full narrative floor of its logic stereotype, with no narrative" }
+      ],
+      check(ctx) {
+        const code = ctx.codeIndex();
+        const dialedDown = [];
+        for (const impl of ctx.implementations) {
+          const contract = ctx.interfaceMap.get(impl.contract);
+          if (!contract) continue;
+          const component = ctx.componentMap.get(contract.component);
+          const draftContext = ctx.isImplementationDraft(impl);
+          for (const method of impl.methods) {
+            const detail = effectiveDetail(method, impl, component);
+            if (contract.methods.some((m) => m.name === method.name) && method.narrative.length === 0 && detail.level !== "full") {
+              dialedDown.push({ implementation: impl, method, component, detail, draftContext });
+            }
+          }
+        }
+        for (const entry of dialedDown) {
+          const { implementation: impl, method, component, detail } = entry;
+          const tier = method.conformance ?? impl.conformance ?? defaultConformanceTier(component);
+          const file = methodSourceFile(method, impl.sourcePath);
+          const symbol = method.symbol ?? method.name;
+          const limit = ctx.complexityConfigFor(component?.subsystem)?.maxUnnarratedComplexity ?? DEFAULT_MAX_UNNARRATED_COMPLEXITY;
+          let complexity;
+          if (file && tier !== "off" && !(component && ctx.isInChainedSubproject(component.subsystem))) {
+            const facts = code.factsAt(file);
+            complexity = facts?.status === "analyzed" && facts.analysisGrade === "exact" && facts.functionComplexity && Object.prototype.hasOwnProperty.call(facts.functionComplexity, symbol) ? facts.functionComplexity[symbol] : void 0;
+          }
+          if (complexity !== void 0 && complexity > limit) {
+            ctx.addIssue(
+              "warning",
+              "UNNARRATED_COMPLEXITY",
+              `Method "${method.name}" in implementation "${impl.id}" sits at detail: ${detail.level} with no narrative, but its realized function "${symbol}" in "${file}" measures cyclomatic complexity ${complexity} (limit ${limit}) \u2014 real branching is hiding behind ${detail.level}. Write the narrative, or keep the dial with a lint.allow stating why the branching needs no choreography.`,
+              impl.id,
+              entry.draftContext
+            );
+            continue;
+          }
+          if (detail.explicit && component && isLogic(component)) {
+            ctx.addIssue(
+              "warning",
+              "DETAIL_BELOW_STEREOTYPE",
+              `Method "${method.name}" in implementation "${impl.id}" is explicitly dialed to detail: ${detail.level}, below the full narrative floor of its ${component.componentType} stereotype, and has no narrative. Logic behavior belongs in a narrative \u2014 write one, or keep the dial with a lint.allow stating why.`,
+              impl.id,
+              entry.draftContext
+            );
+          }
+        }
+      }
+    };
+  }
+});
+
 // src/core/rules/intrinsic/portal-fields.ts
 var portalFieldsRule;
 var init_portal_fields = __esm({
@@ -10075,7 +10461,7 @@ var init_logic_declaration = __esm({
     logicDeclarationRule = {
       name: "logic-declaration",
       scope: "spec",
-      description: "Only an Orchestrator may declare a dependencyClass (DEPENDENCY_CLASS_ON_NON_ORCHESTRATOR); what the class allows is judged by stereotype-dependencies. Intrinsic to one component: no tree required.",
+      description: "Only an Orchestrator may declare a dependencyClass (DEPENDENCY_CLASS_ON_NON_ORCHESTRATOR); what the class allows is judged by logic-dependency-class. Intrinsic to one component: no tree required.",
       codes: [
         { code: "DEPENDENCY_CLASS_ON_NON_ORCHESTRATOR", defaultSeverity: "error", summary: "dependencyClass declared on a component that is not an Orchestrator" }
       ],
@@ -10154,45 +10540,61 @@ var init_portal_endpoints = __esm({
     };
     portalsRule = {
       name: "portal-endpoints",
-      description: "A Portal binds every interface method to a concrete endpoint of the matching transport, and only a Portal may carry endpoints at all.",
+      description: "A Portal binds every interface method to a concrete endpoint of the transport its portalType expects.",
       codes: [
         { code: "MISSING_ENDPOINT", defaultSeverity: "error", summary: "Portal method without a wire endpoint binding" },
-        { code: "ENDPOINT_TRANSPORT_MISMATCH", defaultSeverity: "error", summary: "Endpoint transport does not match the Portal portalType" },
-        { code: "ARCHITECTURE_VIOLATION_NON_PORTAL_ENDPOINT", defaultSeverity: "error", summary: "Non-Portal component method declaring an endpoint" }
+        { code: "ENDPOINT_TRANSPORT_MISMATCH", defaultSeverity: "error", summary: "Endpoint transport does not match the Portal portalType" }
       ],
       check(ctx) {
         for (const comp of ctx.components) {
+          if (comp.componentType !== "Portal") continue;
+          const expected = comp.portalType ? PORTAL_TRANSPORT[comp.portalType] : void 0;
+          if (!expected) continue;
           const isDraftCtx = ctx.isComponentDraft(comp.id);
-          const compInterfaces = ctx.interfaces.filter((i) => i.component === comp.id);
-          if (comp.componentType === "Portal") {
-            if (!comp.portalType) continue;
-            const expected = PORTAL_TRANSPORT[comp.portalType];
-            if (!expected) continue;
-            for (const intf of compInterfaces) {
-              const isIntfDraft = intf.status === "draft" || intf.status === "design";
-              for (const m of intf.methods) {
-                if (!m.endpoint) {
-                  ctx.addIssue(
-                    "error",
-                    "MISSING_ENDPOINT",
-                    `Method "${m.name}" on interface "${intf.id}" (Portal ${comp.portalType}) is missing an "endpoint" mapping. Bind it with sdd_set_endpoints (transport "${expected}").`,
-                    intf.id,
-                    isDraftCtx || isIntfDraft
-                  );
-                } else if (m.endpoint.transport !== expected) {
-                  ctx.addIssue(
-                    "error",
-                    "ENDPOINT_TRANSPORT_MISMATCH",
-                    `Method "${m.name}" on interface "${intf.id}" declares a "${m.endpoint.transport}" endpoint, but its Portal "${comp.id}" is portalType "${comp.portalType}" (expects transport "${expected}").`,
-                    intf.id,
-                    isDraftCtx || isIntfDraft
-                  );
-                }
+          for (const intf of ctx.interfaces.filter((i) => i.component === comp.id)) {
+            const isIntfDraft = intf.status === "draft" || intf.status === "design";
+            for (const m of intf.methods) {
+              if (!m.endpoint) {
+                ctx.addIssue(
+                  "error",
+                  "MISSING_ENDPOINT",
+                  `Method "${m.name}" on interface "${intf.id}" (Portal ${comp.portalType}) is missing an "endpoint" mapping. Bind it with sdd_set_endpoints (transport "${expected}").`,
+                  intf.id,
+                  isDraftCtx || isIntfDraft
+                );
+              } else if (m.endpoint.transport !== expected) {
+                ctx.addIssue(
+                  "error",
+                  "ENDPOINT_TRANSPORT_MISMATCH",
+                  `Method "${m.name}" on interface "${intf.id}" declares a "${m.endpoint.transport}" endpoint, but its Portal "${comp.id}" is portalType "${comp.portalType}" (expects transport "${expected}").`,
+                  intf.id,
+                  isDraftCtx || isIntfDraft
+                );
               }
             }
-            continue;
           }
-          for (const intf of compInterfaces) {
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/doctrine/non-portal-endpoints.ts
+var nonPortalEndpointsRule;
+var init_non_portal_endpoints = __esm({
+  "src/core/rules/doctrine/non-portal-endpoints.ts"() {
+    "use strict";
+    nonPortalEndpointsRule = {
+      name: "non-portal-endpoints",
+      description: "Only a Portal may carry endpoints: a method on a non-Portal component's interface that declares one is publishing a block that is not the system's boundary as if it were.",
+      codes: [
+        { code: "ARCHITECTURE_VIOLATION_NON_PORTAL_ENDPOINT", defaultSeverity: "error", summary: "Non-Portal component method declaring an endpoint" }
+      ],
+      check(ctx) {
+        for (const comp of ctx.components) {
+          if (comp.componentType === "Portal") continue;
+          const isDraftCtx = ctx.isComponentDraft(comp.id);
+          for (const intf of ctx.interfaces.filter((i) => i.component === comp.id)) {
             const isIntfDraft = intf.status === "draft" || intf.status === "design";
             for (const m of intf.methods) {
               if (m.endpoint) {
@@ -10213,20 +10615,16 @@ var init_portal_endpoints = __esm({
 });
 
 // src/core/rules/doctrine/portal-call-auth.ts
-var COMPONENT_REF_PREFIX, portalCallAuthRule;
+var portalCallAuthRule;
 var init_portal_call_auth = __esm({
   "src/core/rules/doctrine/portal-call-auth.ts"() {
     "use strict";
-    COMPONENT_REF_PREFIX = "component:";
     portalCallAuthRule = {
       name: "portal-call-auth",
-      description: "Hardens authenticated cross-service calls. An OUTBOUND narrative `call` into ANOTHER component's Portal whose auth is not `none` must (a) be made by an Adapter \u2014 the only block that does external I/O \u2014 and (b) declare the credential source it presents via the step's `auth.from`. Absence of a source warns PORTAL_AUTH_UNMET; a non-Adapter presenter warns AUTH_PRESENTER_NOT_ADAPTER. When `auth.from` is a modeled reference (`component:<id>`) it must resolve to an Adapter/Store the presenter is wired to (UNKNOWN_AUTH_SOURCE / AUTH_SOURCE_NOT_PROVIDER / AUTH_SOURCE_UNWIRED). The actual secret is never stored in the spec. Dispatch steps (a portal's OWN inbound routing) and self-calls are not cross-service calls and are excluded.",
+      description: "Hardens authenticated cross-service calls. An OUTBOUND narrative `call` into ANOTHER component's Portal whose auth is not `none` must (a) be made by an Adapter \u2014 the only block that does external I/O \u2014 and (b) declare the credential source it presents via the step's `auth.from`. Absence of a source warns PORTAL_AUTH_UNMET; a non-Adapter presenter warns AUTH_PRESENTER_NOT_ADAPTER. The actual secret is never stored in the spec. Dispatch steps (a portal's OWN inbound routing) and self-calls are not cross-service calls and are excluded.",
       codes: [
         { code: "PORTAL_AUTH_UNMET", defaultSeverity: "warning", summary: "A narrative call into another component's authed Portal does not declare where its credential loads from" },
-        { code: "AUTH_PRESENTER_NOT_ADAPTER", defaultSeverity: "warning", summary: "A non-Adapter component authenticates an outbound call to a portal (external I/O must go through an Adapter)" },
-        { code: "UNKNOWN_AUTH_SOURCE", defaultSeverity: "warning", summary: "auth.from references a component: source that does not exist" },
-        { code: "AUTH_SOURCE_NOT_PROVIDER", defaultSeverity: "warning", summary: "auth.from references a component that is not an Adapter or Store" },
-        { code: "AUTH_SOURCE_UNWIRED", defaultSeverity: "warning", summary: "The presenter declares a component: credential source it does not depend on or own" }
+        { code: "AUTH_PRESENTER_NOT_ADAPTER", defaultSeverity: "warning", summary: "A non-Adapter component authenticates an outbound call to a portal (external I/O must go through an Adapter)" }
       ],
       check(ctx) {
         for (const impl of ctx.implementations) {
@@ -10249,8 +10647,7 @@ var init_portal_call_auth = __esm({
                   draft
                 );
               }
-              const from = step.auth?.from;
-              if (!from) {
+              if (!step.auth?.from) {
                 ctx.addIssue(
                   "warning",
                   "PORTAL_AUTH_UNMET",
@@ -10258,40 +10655,73 @@ var init_portal_call_auth = __esm({
                   impl.id,
                   draft
                 );
+              }
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/doctrine/auth-source-wiring.ts
+var COMPONENT_REF_PREFIX, authSourceWiringRule;
+var init_auth_source_wiring = __esm({
+  "src/core/rules/doctrine/auth-source-wiring.ts"() {
+    "use strict";
+    COMPONENT_REF_PREFIX = "component:";
+    authSourceWiringRule = {
+      name: "auth-source-wiring",
+      description: "Resolves the credential source a narrative call presents to an authenticated Portal. When the step's `auth.from` is a modeled reference (`component:<id>`) it must name a component that exists (UNKNOWN_AUTH_SOURCE), that can hold or load a secret \u2014 an Adapter or a Store (AUTH_SOURCE_NOT_PROVIDER) \u2014 and that the presenting component depends on or owns (AUTH_SOURCE_UNWIRED). Opaque sources (env:/config:/vault:/free note) are design notes and are never resolved; a missing source is portal-call-auth's finding.",
+      codes: [
+        { code: "UNKNOWN_AUTH_SOURCE", defaultSeverity: "warning", summary: "auth.from references a component: source that does not exist" },
+        { code: "AUTH_SOURCE_NOT_PROVIDER", defaultSeverity: "warning", summary: "auth.from references a component that is not an Adapter or Store" },
+        { code: "AUTH_SOURCE_UNWIRED", defaultSeverity: "warning", summary: "The presenter declares a component: credential source it does not depend on or own" }
+      ],
+      check(ctx) {
+        for (const impl of ctx.implementations) {
+          const ownComponent = ctx.interfaceMap.get(impl.contract)?.component;
+          const presenter = ownComponent ? ctx.componentMap.get(ownComponent) : void 0;
+          const draft = ctx.isImplementationDraft(impl);
+          for (const method of impl.methods ?? []) {
+            for (const step of method.narrative ?? []) {
+              if (step.type !== "call") continue;
+              if (!step.targetComponent || step.targetComponent === ownComponent) continue;
+              const target = ctx.componentMap.get(step.targetComponent);
+              if (!target || target.componentType !== "Portal") continue;
+              if (!target.auth || target.auth.scheme === "none") continue;
+              const from = step.auth?.from;
+              if (!from || !from.startsWith(COMPONENT_REF_PREFIX)) continue;
+              const srcId = from.slice(COMPONENT_REF_PREFIX.length);
+              const src = ctx.componentMap.get(srcId);
+              if (!src) {
+                ctx.addIssue(
+                  "warning",
+                  "UNKNOWN_AUTH_SOURCE",
+                  `Narrative step ${step.stepNumber} of "${method.name}" in "${impl.id}": auth.from references component "${srcId}", which does not exist.`,
+                  impl.id,
+                  draft
+                );
                 continue;
               }
-              if (from.startsWith(COMPONENT_REF_PREFIX)) {
-                const srcId = from.slice(COMPONENT_REF_PREFIX.length);
-                const src = ctx.componentMap.get(srcId);
-                if (!src) {
-                  ctx.addIssue(
-                    "warning",
-                    "UNKNOWN_AUTH_SOURCE",
-                    `Narrative step ${step.stepNumber} of "${method.name}" in "${impl.id}": auth.from references component "${srcId}", which does not exist.`,
-                    impl.id,
-                    draft
-                  );
-                } else {
-                  if (src.componentType !== "Adapter" && src.componentType !== "Store") {
-                    ctx.addIssue(
-                      "warning",
-                      "AUTH_SOURCE_NOT_PROVIDER",
-                      `Narrative step ${step.stepNumber} of "${method.name}" in "${impl.id}": auth.from references "${srcId}" (${src.componentType}); a credential source must be an Adapter (loads the secret via external I/O) or a Store (holds it).`,
-                      impl.id,
-                      draft
-                    );
-                  }
-                  const wired = (presenter?.dependsOn ?? []).includes(srcId) || (presenter?.owns ?? []).includes(srcId);
-                  if (presenter && !wired) {
-                    ctx.addIssue(
-                      "warning",
-                      "AUTH_SOURCE_UNWIRED",
-                      `Narrative step ${step.stepNumber} of "${method.name}" in "${impl.id}": "${presenter.id}" loads its credential from "${srcId}" but neither depends on nor owns it \u2014 declare the dependsOn edge so the credential wiring is real.`,
-                      impl.id,
-                      draft
-                    );
-                  }
-                }
+              if (src.componentType !== "Adapter" && src.componentType !== "Store") {
+                ctx.addIssue(
+                  "warning",
+                  "AUTH_SOURCE_NOT_PROVIDER",
+                  `Narrative step ${step.stepNumber} of "${method.name}" in "${impl.id}": auth.from references "${srcId}" (${src.componentType}); a credential source must be an Adapter (loads the secret via external I/O) or a Store (holds it).`,
+                  impl.id,
+                  draft
+                );
+              }
+              const wired = (presenter?.dependsOn ?? []).includes(srcId) || (presenter?.owns ?? []).includes(srcId);
+              if (presenter && !wired) {
+                ctx.addIssue(
+                  "warning",
+                  "AUTH_SOURCE_UNWIRED",
+                  `Narrative step ${step.stepNumber} of "${method.name}" in "${impl.id}": "${presenter.id}" loads its credential from "${srcId}" but neither depends on nor owns it \u2014 declare the dependsOn edge so the credential wiring is real.`,
+                  impl.id,
+                  draft
+                );
               }
             }
           }
@@ -10301,257 +10731,341 @@ var init_portal_call_auth = __esm({
   }
 });
 
-// src/core/rules/doctrine/stereotype-dependencies.ts
-var NEVER_INLINE_STATE, storeResolutionHint, isPureLogic, isReadLogic, stereotypeOf, stereotypeDepsRule;
-var init_stereotype_dependencies = __esm({
-  "src/core/rules/doctrine/stereotype-dependencies.ts"() {
+// src/core/rules/doctrine/subsystem-boundary-dependencies.ts
+var subsystemBoundaryDepsRule;
+var init_subsystem_boundary_dependencies = __esm({
+  "src/core/rules/doctrine/subsystem-boundary-dependencies.ts"() {
     "use strict";
     init_models();
-    NEVER_INLINE_STATE = " Never resolve this by merging the store's state into the consuming component \u2014 state hidden inside a logic block is invisible to the spec and unrecoverable.";
-    storeResolutionHint = (consumerType, storeId) => {
-      if (consumerType === "Orchestrator") {
-        return ` Resolution: wrap "${storeId}" in a Repository pattern (owns: Store + Registry + Index) and depend on that Repository facade instead.${NEVER_INLINE_STATE}`;
-      }
-      return ` Resolution: wrap "${storeId}" in a Repository pattern and reach it through an Orchestrator that uses the Repository facade.${NEVER_INLINE_STATE}`;
-    };
-    isPureLogic = (comp) => comp.componentType === "Orchestrator" && comp.dependencyClass === "pure";
-    isReadLogic = (comp) => comp.componentType === "Orchestrator" && comp.dependencyClass === "read";
-    stereotypeOf = (comp) => comp.dependencyClass ? `${comp.componentType} (dependencyClass ${comp.dependencyClass})` : comp.componentType;
-    stereotypeDepsRule = {
-      name: "stereotype-dependencies",
-      description: "Enforces the component-stereotype interaction matrix and the cross-subsystem shape. The matrix: a Portal reaches the data layer only through Repository/Index READ faces, and writes route through Orchestrators (PORTAL_WRITE_SHORTCUT); Stores are depended upon; Registries write their Store; Adapters are sinks; Views stay passive; an Orchestrator's dependencyClass bounds what it may depend on; a Supervisor reaches data only through workflows; a live Actor is reached through a Supervisor that supervises it; a Query reads its Store; any block may use pure logic. Across subsystems: client Adapter \u2192 published remote Portal, OR a direct in-process edge licensed by a trustedLink declared on the SOURCE subsystem (the published-Portal target requirement applies either way). A governing pack profile may license intra-subsystem edges the matrix refuses via allowedEdges (its platform idiom, with the stated reason); boundary rules stay unrelaxable.",
+    subsystemBoundaryDepsRule = {
+      name: "subsystem-boundary-dependencies",
+      description: "Judges every dependsOn edge that leaves its own subsystem, and every one that resolves nowhere. Across subsystems the shape is client Adapter \u2192 published remote Portal, OR a direct in-process edge licensed by a trustedLink declared on the SOURCE subsystem (the published-Portal target requirement applies either way). A reference that names nothing in this tree is resolved against the stored surface snapshots: a hit is a DECLARED remote portal and the same Adapter requirement applies to it, snapshots of several providers that disagree make the reference ambiguous, and a reference authored to leave this root that no snapshot covers warns instead of erroring. Boundary rules are never relaxed by a pack profile.",
       codes: [
         { code: "INVALID_DEPENDENCY_REFERENCE", defaultSeverity: "error", summary: "dependsOn names a non-existent component" },
         { code: "CROSS_TREE_REF_UNRESOLVED", defaultSeverity: "warning", summary: "Cross-tree dependsOn (super::/:: form) with no surface snapshot covering it" },
         { code: "SURFACE_REF_AMBIGUOUS", defaultSeverity: "error", summary: "Cross-tree dependsOn matched by surface snapshots of several providers with different contracts" },
         { code: "CROSS_SUBSYSTEM_NON_ADAPTER", defaultSeverity: "error", summary: "Non-Adapter component crossing a subsystem boundary" },
         { code: "CROSS_SUBSYSTEM_PRIVATE_ACCESS", defaultSeverity: "error", summary: "Cross-subsystem dependency on an unpublished component" },
-        { code: "CROSS_SUBSYSTEM_TARGET_NON_PORTAL", defaultSeverity: "error", summary: "Cross-subsystem hop entering through a non-Portal" },
-        { code: "ARCHITECTURE_VIOLATION_PORTAL_DEP", defaultSeverity: "error", summary: "Component depending on a Portal/Observer" },
-        { code: "ARCHITECTURE_VIOLATION_PORTAL_FORBIDDEN_DEP", defaultSeverity: "error", summary: "Portal/Observer reaching the data layer directly" },
-        { code: "ARCHITECTURE_VIOLATION_STORE_DEP", defaultSeverity: "error", summary: "Store depending on anything but another Store, a backend Adapter or pure logic" },
-        { code: "ARCHITECTURE_VIOLATION_REGISTRY_DEP", defaultSeverity: "warning", summary: "Registry depending on anything but its Store, a backend Adapter or pure logic (warning while new; aligned to the standard \xA77 validate\u2192write path)" },
-        { code: "ARCHITECTURE_VIOLATION_ADAPTER_DEP", defaultSeverity: "error", summary: "Adapter depending on a Store or on an Orchestrator that is not pure" },
-        { code: "ARCHITECTURE_VIOLATION_INDEX_DEP", defaultSeverity: "error", summary: "Index depending on anything but its Store, an Adapter or pure logic" },
-        { code: "ARCHITECTURE_VIOLATION_VIEW_DEP", defaultSeverity: "error", summary: "View depending on persistence layers or on logic that is not pure" },
-        { code: "PORTAL_WRITE_SHORTCUT", defaultSeverity: "error", summary: "Portal narrative call or dispatch-table binding reaches a write-effect method on a Repository/Index directly \u2014 reads may shortcut, writes route through an Orchestrator (judged on effect-tagged facade methods; untagged methods are not yet judged)" },
-        { code: "DEPENDENCY_CLASS_VIOLATION", defaultSeverity: "error", summary: "Orchestrator depending on a component its dependencyClass does not allow: pure logic depends only on pure Orchestrators; read logic also on read Orchestrators, Repositories, Indexes and Adapters" },
-        { code: "ARCHITECTURE_VIOLATION_SUPERVISOR_DEP", defaultSeverity: "error", summary: "Supervisor depending on anything but Actors, Orchestrators, Adapters or other Supervisors \u2014 it reaches data only through workflows" },
-        { code: "ACTOR_REACHED_WITHOUT_SUPERVISOR", defaultSeverity: "error", summary: "Component depending on a live Actor it does not supervise, without also depending on a Supervisor that supervises it \u2014 a live Actor is reached by id through its Supervisor" },
-        { code: "ARCHITECTURE_VIOLATION_QUERY_DEP", defaultSeverity: "error", summary: "Query depending on anything but its Store, a backend Adapter or pure logic" }
+        { code: "CROSS_SUBSYSTEM_TARGET_NON_PORTAL", defaultSeverity: "error", summary: "Cross-subsystem hop entering through a non-Portal" }
       ],
       check(ctx) {
-        for (const comp of ctx.components) {
-          const isDraftCtx = ctx.isComponentDraft(comp.id);
-          const dependencies = comp.dependsOn;
-          for (const depId of dependencies) {
-            const depComp = ctx.componentMap.get(depId);
-            if (!depComp) {
-              const external = ctx.isExternalNamespaceRef(depId);
-              if (external || ctx.isCollapsedCrossTreeRef(depId, comp.subsystem)) {
-                const resolved = ctx.resolveSurfaceRef(depId, comp.subsystem);
-                if (resolved.kind === "ambiguous") {
-                  ctx.addIssue("error", "SURFACE_REF_AMBIGUOUS", ambiguityMessage(resolved, `Component "${comp.id}" depends on`, depId), comp.id, isDraftCtx);
-                  continue;
-                }
-                if (resolved.kind === "resolved") {
-                  if (comp.componentType !== "Adapter") {
-                    ctx.addIssue(
-                      "error",
-                      "CROSS_SUBSYSTEM_NON_ADAPTER",
-                      `Boundary violation: ${comp.componentType} "${comp.id}" depends directly on "${depId}", a surface of project "${resolved.snapshot.projectName}". Only a local client Adapter may cross a project boundary \u2014 route this hop through an Adapter.`,
-                      comp.id,
-                      isDraftCtx,
-                      true
-                    );
-                  }
-                  continue;
-                }
-                if (external) {
-                  ctx.addIssue(
-                    "warning",
-                    "CROSS_TREE_REF_UNRESOLVED",
-                    `Component "${comp.id}" depends on cross-tree component "${depId}", and no surface snapshot covers it \u2014 validate from the parent project, pin the family surfaces ("wairon surface pin"), or import the producing project's surface.`,
-                    comp.id,
-                    isDraftCtx
-                  );
-                  continue;
-                }
-              }
+        for (const edge of ctx.dependencyEdges().all) {
+          if (edge.retired) continue;
+          const comp = edge.from;
+          switch (edge.reach) {
+            case "missing":
               ctx.addIssue(
                 "error",
                 "INVALID_DEPENDENCY_REFERENCE",
-                `Component "${comp.id}" lists dependency "${depId}" which does not exist.`,
+                `Component "${comp.id}" lists dependency "${edge.ref}" which does not exist.`,
                 comp.id,
-                isDraftCtx
+                edge.draftContext
               );
               continue;
-            }
-            if (isRetired(comp) || isRetired(depComp)) continue;
-            if (depComp.subsystem !== comp.subsystem) {
-              const crossDraft = isDraftCtx || ctx.isComponentDraft(depComp.id);
-              const sourceSub = ctx.subsystems.find((s) => s.id === comp.subsystem);
-              const licensed = sourceSub?.trustedLinks?.some((t) => t.subsystem === depComp.subsystem) ?? false;
-              if (comp.componentType !== "Adapter" && !licensed) {
-                ctx.addIssue(
-                  "error",
-                  "CROSS_SUBSYSTEM_NON_ADAPTER",
-                  `Boundary violation: ${comp.componentType} "${comp.id}" (subsystem "${comp.subsystem}") depends directly on "${depComp.id}" in subsystem "${depComp.subsystem}". Only a local client Adapter may cross a subsystem boundary \u2014 route this hop through an Adapter that calls "${depComp.subsystem}"'s public interface, or declare a trustedLink on "${comp.subsystem}" (with the reason) to license a direct in-process edge to that peer's published Portal.`,
-                  comp.id,
-                  crossDraft
-                );
-              }
-              const targetIsPublic = ctx.publicSet.get(depComp.subsystem)?.has(depComp.id) ?? false;
-              if (!targetIsPublic) {
-                ctx.addIssue(
-                  "error",
-                  "CROSS_SUBSYSTEM_PRIVATE_ACCESS",
-                  `Boundary violation: "${comp.id}" depends on "${depComp.id}", which is not part of subsystem "${depComp.subsystem}"'s published public surface. Depend on one of its publicInterfaces components instead.`,
-                  comp.id,
-                  crossDraft
-                );
-              } else if (depComp.componentType !== "Portal") {
-                const crosser = comp.componentType === "Adapter" ? "client Adapter" : comp.componentType;
-                ctx.addIssue(
-                  "error",
-                  "CROSS_SUBSYSTEM_TARGET_NON_PORTAL",
-                  `Boundary violation: ${crosser} "${comp.id}" enters subsystem "${depComp.subsystem}" through "${depComp.id}" (${depComp.componentType}), not its inbound Portal. A cross-subsystem hop must target the remote subsystem's Portal (its front door), which dispatches inward \u2014 publishing/depending on an internal ${depComp.componentType} leaks the boundary and breaks the distribution seam. Expose a Portal for "${depComp.subsystem}" and point "${comp.id}" at it.`,
-                  comp.id,
-                  crossDraft
-                );
-              }
-              continue;
-            }
-            const governingProfile2 = ctx.ext.profiles[ctx.getComponentProfile(comp.id)];
-            if (governingProfile2?.allowedEdges?.some((e) => e.from.includes(comp.componentType) && e.to.includes(depComp.componentType))) {
+            case "unpinned":
+              ctx.addIssue(
+                "warning",
+                "CROSS_TREE_REF_UNRESOLVED",
+                `Component "${comp.id}" depends on cross-tree component "${edge.ref}", and no surface snapshot covers it \u2014 validate from the parent project, pin the family surfaces ("wairon surface pin"), or import the producing project's surface.`,
+                comp.id,
+                edge.draftContext
+              );
               continue;
-            }
-            const edgeDraft = isDraftCtx || ctx.isComponentDraft(depComp.id);
-            const depPure = isPureLogic(depComp);
-            const depRead = isReadLogic(depComp);
-            const storeHint = depComp.componentType === "Store" ? storeResolutionHint(comp.componentType, depComp.id) : "";
-            if (depComp.componentType === "Portal" || depComp.componentType === "Observer") {
+            case "ambiguous":
               ctx.addIssue(
                 "error",
-                "ARCHITECTURE_VIOLATION_PORTAL_DEP",
-                `Architectural violation: Component "${comp.id}" cannot depend on ${depComp.componentType} component "${depComp.id}". ${depComp.componentType}s are top-level entry points/subscribers and cannot be dependencies.`,
+                "SURFACE_REF_AMBIGUOUS",
+                ambiguityMessage(edge.surface, `Component "${comp.id}" depends on`, edge.ref),
                 comp.id,
-                edgeDraft
+                edge.draftContext
               );
               continue;
-            }
-            if (comp.componentType === "Portal" || comp.componentType === "Observer") {
-              const forbiddenTypes = comp.componentType === "Portal" ? ["Store", "Registry", "Adapter", "Query"] : ["Store", "Registry", "Repository", "Index", "Query"];
-              if (forbiddenTypes.includes(depComp.componentType)) {
+            case "surface":
+              if (comp.componentType !== "Adapter") {
+                const provider = edge.surface.kind === "resolved" ? edge.surface.snapshot.projectName : "";
                 ctx.addIssue(
                   "error",
-                  "ARCHITECTURE_VIOLATION_PORTAL_FORBIDDEN_DEP",
-                  `Architectural violation: ${comp.componentType} component "${comp.id}" cannot depend directly on "${depComp.componentType}" component "${depComp.id}". ${comp.componentType}s coordinate through Orchestrators (and Supervisors); they do not reach the data layer directly.` + storeHint,
+                  "CROSS_SUBSYSTEM_NON_ADAPTER",
+                  `Boundary violation: ${comp.componentType} "${comp.id}" depends directly on "${edge.ref}", a surface of project "${provider}". Only a local client Adapter may cross a project boundary \u2014 route this hop through an Adapter.`,
                   comp.id,
-                  edgeDraft
+                  edge.draftContext,
+                  true
                 );
               }
-            }
-            if (isPureLogic(comp) && !depPure) {
-              ctx.addIssue(
-                "error",
-                "DEPENDENCY_CLASS_VIOLATION",
-                `Architectural violation: Orchestrator "${comp.id}" (dependencyClass pure) cannot depend on ${stereotypeOf(depComp)} "${depComp.id}". Pure logic depends only on pure Orchestrators \u2014 move that dependency to the workflow that calls "${comp.id}", or declare "${comp.id}" read when it reads through read logic, a Repository, an Index or an Adapter.` + storeHint,
-                comp.id,
-                edgeDraft
-              );
-            }
-            if (isReadLogic(comp) && !depPure && !depRead && !["Repository", "Index", "Adapter"].includes(depComp.componentType)) {
-              ctx.addIssue(
-                "error",
-                "DEPENDENCY_CLASS_VIOLATION",
-                `Architectural violation: Orchestrator "${comp.id}" (dependencyClass read) cannot depend on ${stereotypeOf(depComp)} "${depComp.id}". Read logic depends only on pure or read Orchestrators, Repositories, Indexes and Adapters \u2014 move that dependency to the workflow that calls "${comp.id}", or unset the dependencyClass of "${comp.id}" when it is itself a workflow.` + storeHint,
-                comp.id,
-                edgeDraft
-              );
-            }
-            if (comp.componentType === "Store" && depComp.componentType !== "Store" && depComp.componentType !== "Adapter" && !depPure) {
-              ctx.addIssue(
-                "error",
-                "ARCHITECTURE_VIOLATION_STORE_DEP",
-                `Architectural violation: Store component "${comp.id}" cannot depend on "${depComp.componentType}" component "${depComp.id}". Stores may only depend on other Stores, a backend Adapter or pure logic \u2014 Registries and Indexes depend on the Store, never the reverse.`,
-                comp.id,
-                edgeDraft
-              );
-            }
-            if (comp.componentType === "Registry" && depComp.componentType !== "Store" && depComp.componentType !== "Adapter" && !depPure) {
-              ctx.addIssue(
-                "warning",
-                "ARCHITECTURE_VIOLATION_REGISTRY_DEP",
-                `Architectural violation: Registry component "${comp.id}" should not depend on "${depComp.componentType}" component "${depComp.id}". A Registry is the write path to its Store and may depend only on that Store, a backend Adapter, or pure logic that validates the write \u2014 the Registry never updates Indexes and never drives workflow.`,
-                comp.id,
-                edgeDraft
-              );
-            }
-            if (comp.componentType === "Adapter" && (depComp.componentType === "Store" || depComp.componentType === "Orchestrator" && !depPure)) {
-              ctx.addIssue(
-                "error",
-                "ARCHITECTURE_VIOLATION_ADAPTER_DEP",
-                `Architectural violation: Adapter component "${comp.id}" cannot depend on ${stereotypeOf(depComp)} component "${depComp.id}". An Adapter may use pure logic, but never a Store or any other Orchestrator.`,
-                comp.id,
-                edgeDraft
-              );
-            }
-            if (comp.componentType === "Index" && depComp.componentType !== "Store" && depComp.componentType !== "Adapter" && !depPure) {
-              ctx.addIssue(
-                "error",
-                "ARCHITECTURE_VIOLATION_INDEX_DEP",
-                `Architectural violation: Index component "${comp.id}" cannot depend on "${depComp.componentType}" component "${depComp.id}". An Index is a read projection and may depend only on its Store, a backend Adapter or pure logic.`,
-                comp.id,
-                edgeDraft
-              );
-            }
-            if (comp.componentType === "Query" && depComp.componentType !== "Store" && depComp.componentType !== "Adapter" && !depPure) {
-              ctx.addIssue(
-                "error",
-                "ARCHITECTURE_VIOLATION_QUERY_DEP",
-                `Architectural violation: Query "${comp.id}" cannot depend on ${stereotypeOf(depComp)} "${depComp.id}". A Query computes reads over its Store, through a backend Adapter where one serves it, with pure logic \u2014 move any other dependency to the workflow that calls the Repository facade.`,
-                comp.id,
-                edgeDraft
-              );
-            }
-            if (comp.componentType === "View" && (["Store", "Registry", "Index", "Query", "Adapter", "Repository"].includes(depComp.componentType) || depComp.componentType === "Orchestrator" && !depPure)) {
+              continue;
+            case "cross-subsystem":
+              break;
+            default:
+              continue;
+          }
+          const depComp = edge.to;
+          const sourceSub = ctx.subsystems.find((s) => s.id === comp.subsystem);
+          const licensed = sourceSub?.trustedLinks?.some((t) => t.subsystem === depComp.subsystem) ?? false;
+          if (comp.componentType !== "Adapter" && !licensed) {
+            ctx.addIssue(
+              "error",
+              "CROSS_SUBSYSTEM_NON_ADAPTER",
+              `Boundary violation: ${comp.componentType} "${comp.id}" (subsystem "${comp.subsystem}") depends directly on "${depComp.id}" in subsystem "${depComp.subsystem}". Only a local client Adapter may cross a subsystem boundary \u2014 route this hop through an Adapter that calls "${depComp.subsystem}"'s public interface, or declare a trustedLink on "${comp.subsystem}" (with the reason) to license a direct in-process edge to that peer's published Portal.`,
+              comp.id,
+              edge.draftContext
+            );
+          }
+          const targetIsPublic = ctx.publicSet.get(depComp.subsystem)?.has(depComp.id) ?? false;
+          if (!targetIsPublic) {
+            ctx.addIssue(
+              "error",
+              "CROSS_SUBSYSTEM_PRIVATE_ACCESS",
+              `Boundary violation: "${comp.id}" depends on "${depComp.id}", which is not part of subsystem "${depComp.subsystem}"'s published public surface. Depend on one of its publicInterfaces components instead.`,
+              comp.id,
+              edge.draftContext
+            );
+          } else if (depComp.componentType !== "Portal") {
+            const crosser = comp.componentType === "Adapter" ? "client Adapter" : comp.componentType;
+            ctx.addIssue(
+              "error",
+              "CROSS_SUBSYSTEM_TARGET_NON_PORTAL",
+              `Boundary violation: ${crosser} "${comp.id}" enters subsystem "${depComp.subsystem}" through "${depComp.id}" (${depComp.componentType}), not its inbound Portal. A cross-subsystem hop must target the remote subsystem's Portal (its front door), which dispatches inward \u2014 publishing/depending on an internal ${depComp.componentType} leaks the boundary and breaks the distribution seam. Expose a Portal for "${depComp.subsystem}" and point "${comp.id}" at it.`,
+              comp.id,
+              edge.draftContext
+            );
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/doctrine/stereotype-terms.ts
+var NEVER_INLINE_STATE, storeResolutionHint, isPureLogic, isReadLogic, stereotypeOf;
+var init_stereotype_terms = __esm({
+  "src/core/rules/doctrine/stereotype-terms.ts"() {
+    "use strict";
+    NEVER_INLINE_STATE = " Never resolve this by merging the store's state into the consuming component \u2014 state hidden inside a logic block is invisible to the spec and unrecoverable.";
+    storeResolutionHint = (consumerType, storeId) => {
+      if (consumerType === "Orchestrator") {
+        return ` Resolution: wrap "${storeId}" in a Repository pattern (owns: Store + Registry + Index) and depend on that Repository facade instead.${NEVER_INLINE_STATE}`;
+      }
+      return ` Resolution: wrap "${storeId}" in a Repository pattern and reach it through an Orchestrator that uses the Repository facade.${NEVER_INLINE_STATE}`;
+    };
+    isPureLogic = (comp) => comp.componentType === "Orchestrator" && comp.dependencyClass === "pure";
+    isReadLogic = (comp) => comp.componentType === "Orchestrator" && comp.dependencyClass === "read";
+    stereotypeOf = (comp) => comp.dependencyClass ? `${comp.componentType} (dependencyClass ${comp.dependencyClass})` : comp.componentType;
+  }
+});
+
+// src/core/rules/doctrine/logic-dependency-class.ts
+var logicDependencyClassRule;
+var init_logic_dependency_class = __esm({
+  "src/core/rules/doctrine/logic-dependency-class.ts"() {
+    "use strict";
+    init_stereotype_terms();
+    logicDependencyClassRule = {
+      name: "logic-dependency-class",
+      description: "Bounds an Orchestrator's dependencies by the dependencyClass it declares: pure logic depends only on pure Orchestrators; read logic also on read Orchestrators, Repositories, Indexes and Adapters; an Orchestrator that declares no class is a workflow and may depend on anything the rest of the matrix allows. Whether read logic calls a WRITE method on one of those is judged only once facade methods carry effect tags.",
+      codes: [
+        { code: "DEPENDENCY_CLASS_VIOLATION", defaultSeverity: "error", summary: "Orchestrator depending on a component its dependencyClass does not allow: pure logic depends only on pure Orchestrators; read logic also on read Orchestrators, Repositories, Indexes and Adapters" }
+      ],
+      check(ctx) {
+        for (const edge of ctx.dependencyEdges().matrix) {
+          const comp = edge.from;
+          const depComp = edge.to;
+          if (depComp.componentType === "Portal" || depComp.componentType === "Observer") continue;
+          const depPure = isPureLogic(depComp);
+          const storeHint = depComp.componentType === "Store" ? storeResolutionHint(comp.componentType, depComp.id) : "";
+          if (isPureLogic(comp) && !depPure) {
+            ctx.addIssue(
+              "error",
+              "DEPENDENCY_CLASS_VIOLATION",
+              `Architectural violation: Orchestrator "${comp.id}" (dependencyClass pure) cannot depend on ${stereotypeOf(depComp)} "${depComp.id}". Pure logic depends only on pure Orchestrators \u2014 move that dependency to the workflow that calls "${comp.id}", or declare "${comp.id}" read when it reads through read logic, a Repository, an Index or an Adapter.` + storeHint,
+              comp.id,
+              edge.draftContext
+            );
+          }
+          if (isReadLogic(comp) && !depPure && !isReadLogic(depComp) && !["Repository", "Index", "Adapter"].includes(depComp.componentType)) {
+            ctx.addIssue(
+              "error",
+              "DEPENDENCY_CLASS_VIOLATION",
+              `Architectural violation: Orchestrator "${comp.id}" (dependencyClass read) cannot depend on ${stereotypeOf(depComp)} "${depComp.id}". Read logic depends only on pure or read Orchestrators, Repositories, Indexes and Adapters \u2014 move that dependency to the workflow that calls "${comp.id}", or unset the dependencyClass of "${comp.id}" when it is itself a workflow.` + storeHint,
+              comp.id,
+              edge.draftContext
+            );
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/doctrine/data-block-dependencies.ts
+var dataBlockDepsRule;
+var init_data_block_dependencies = __esm({
+  "src/core/rules/doctrine/data-block-dependencies.ts"() {
+    "use strict";
+    init_stereotype_terms();
+    dataBlockDepsRule = {
+      name: "data-block-dependencies",
+      description: "Keeps the data layer facing down. A Store may depend only on another Store, a backend Adapter or pure logic \u2014 Registries and Indexes depend on the Store, never the reverse. A Registry is the write path to its Store and may depend on that Store, a backend Adapter, or the pure logic that validates the write. An Index is a read projection and a Query a computed read, each over its Store through a backend Adapter where one serves it. An Adapter is a sink toward the system: it may use pure logic, but never a Store or any other Orchestrator.",
+      codes: [
+        { code: "ARCHITECTURE_VIOLATION_STORE_DEP", defaultSeverity: "error", summary: "Store depending on anything but another Store, a backend Adapter or pure logic" },
+        { code: "ARCHITECTURE_VIOLATION_REGISTRY_DEP", defaultSeverity: "warning", summary: "Registry depending on anything but its Store, a backend Adapter or pure logic (warning while new; aligned to the standard \xA77 validate\u2192write path)" },
+        { code: "ARCHITECTURE_VIOLATION_ADAPTER_DEP", defaultSeverity: "error", summary: "Adapter depending on a Store or on an Orchestrator that is not pure" },
+        { code: "ARCHITECTURE_VIOLATION_INDEX_DEP", defaultSeverity: "error", summary: "Index depending on anything but its Store, an Adapter or pure logic" },
+        { code: "ARCHITECTURE_VIOLATION_QUERY_DEP", defaultSeverity: "error", summary: "Query depending on anything but its Store, a backend Adapter or pure logic" }
+      ],
+      check(ctx) {
+        for (const edge of ctx.dependencyEdges().matrix) {
+          const comp = edge.from;
+          const depComp = edge.to;
+          if (depComp.componentType === "Portal" || depComp.componentType === "Observer") continue;
+          const depPure = isPureLogic(depComp);
+          const ownStoreOnly = depComp.componentType !== "Store" && depComp.componentType !== "Adapter" && !depPure;
+          if (comp.componentType === "Store" && ownStoreOnly) {
+            ctx.addIssue(
+              "error",
+              "ARCHITECTURE_VIOLATION_STORE_DEP",
+              `Architectural violation: Store component "${comp.id}" cannot depend on "${depComp.componentType}" component "${depComp.id}". Stores may only depend on other Stores, a backend Adapter or pure logic \u2014 Registries and Indexes depend on the Store, never the reverse.`,
+              comp.id,
+              edge.draftContext
+            );
+          }
+          if (comp.componentType === "Registry" && ownStoreOnly) {
+            ctx.addIssue(
+              "warning",
+              "ARCHITECTURE_VIOLATION_REGISTRY_DEP",
+              `Architectural violation: Registry component "${comp.id}" should not depend on "${depComp.componentType}" component "${depComp.id}". A Registry is the write path to its Store and may depend only on that Store, a backend Adapter, or pure logic that validates the write \u2014 the Registry never updates Indexes and never drives workflow.`,
+              comp.id,
+              edge.draftContext
+            );
+          }
+          if (comp.componentType === "Adapter" && (depComp.componentType === "Store" || depComp.componentType === "Orchestrator" && !depPure)) {
+            ctx.addIssue(
+              "error",
+              "ARCHITECTURE_VIOLATION_ADAPTER_DEP",
+              `Architectural violation: Adapter component "${comp.id}" cannot depend on ${stereotypeOf(depComp)} component "${depComp.id}". An Adapter may use pure logic, but never a Store or any other Orchestrator.`,
+              comp.id,
+              edge.draftContext
+            );
+          }
+          if (comp.componentType === "Index" && ownStoreOnly) {
+            ctx.addIssue(
+              "error",
+              "ARCHITECTURE_VIOLATION_INDEX_DEP",
+              `Architectural violation: Index component "${comp.id}" cannot depend on "${depComp.componentType}" component "${depComp.id}". An Index is a read projection and may depend only on its Store, a backend Adapter or pure logic.`,
+              comp.id,
+              edge.draftContext
+            );
+          }
+          if (comp.componentType === "Query" && ownStoreOnly) {
+            ctx.addIssue(
+              "error",
+              "ARCHITECTURE_VIOLATION_QUERY_DEP",
+              `Architectural violation: Query "${comp.id}" cannot depend on ${stereotypeOf(depComp)} "${depComp.id}". A Query computes reads over its Store, through a backend Adapter where one serves it, with pure logic \u2014 move any other dependency to the workflow that calls the Repository facade.`,
+              comp.id,
+              edge.draftContext
+            );
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/doctrine/entrypoint-dependencies.ts
+var entrypointDepsRule;
+var init_entrypoint_dependencies = __esm({
+  "src/core/rules/doctrine/entrypoint-dependencies.ts"() {
+    "use strict";
+    init_stereotype_terms();
+    entrypointDepsRule = {
+      name: "entrypoint-dependencies",
+      description: "Judges the edges at the system's entry points and its process layer. Portals and Observers are top-level entry points and subscribers, so nothing may depend on them \u2014 and that is the edge's one finding, which is why no other matrix rule judges it. Downward, a Portal dispatches to Orchestrators and may READ through Indexes and Repository facades but never reaches Store/Registry/Query or an Adapter, while an Observer forwards to one Orchestrator or Supervisor over a message-bus Adapter. A View stays a passive presenter. A Supervisor reaches data only through workflows, and a component depending on a live Actor must also depend on a Supervisor that supervises it.",
+      codes: [
+        { code: "ARCHITECTURE_VIOLATION_PORTAL_DEP", defaultSeverity: "error", summary: "Component depending on a Portal/Observer" },
+        { code: "ARCHITECTURE_VIOLATION_PORTAL_FORBIDDEN_DEP", defaultSeverity: "error", summary: "Portal/Observer reaching the data layer directly" },
+        { code: "ARCHITECTURE_VIOLATION_VIEW_DEP", defaultSeverity: "error", summary: "View depending on persistence layers or on logic that is not pure" },
+        { code: "ARCHITECTURE_VIOLATION_SUPERVISOR_DEP", defaultSeverity: "error", summary: "Supervisor depending on anything but Actors, Orchestrators, Adapters or other Supervisors \u2014 it reaches data only through workflows" },
+        { code: "ACTOR_REACHED_WITHOUT_SUPERVISOR", defaultSeverity: "error", summary: "Component depending on a live Actor it does not supervise, without also depending on a Supervisor that supervises it \u2014 a live Actor is reached by id through its Supervisor" }
+      ],
+      check(ctx) {
+        for (const edge of ctx.dependencyEdges().matrix) {
+          const comp = edge.from;
+          const depComp = edge.to;
+          const storeHint = depComp.componentType === "Store" ? storeResolutionHint(comp.componentType, depComp.id) : "";
+          if (depComp.componentType === "Portal" || depComp.componentType === "Observer") {
+            ctx.addIssue(
+              "error",
+              "ARCHITECTURE_VIOLATION_PORTAL_DEP",
+              `Architectural violation: Component "${comp.id}" cannot depend on ${depComp.componentType} component "${depComp.id}". ${depComp.componentType}s are top-level entry points/subscribers and cannot be dependencies.`,
+              comp.id,
+              edge.draftContext
+            );
+            continue;
+          }
+          if (comp.componentType === "Portal" || comp.componentType === "Observer") {
+            const forbiddenTypes = comp.componentType === "Portal" ? ["Store", "Registry", "Adapter", "Query"] : ["Store", "Registry", "Repository", "Index", "Query"];
+            if (forbiddenTypes.includes(depComp.componentType)) {
               ctx.addIssue(
                 "error",
-                "ARCHITECTURE_VIOLATION_VIEW_DEP",
-                `Architectural violation: View component "${comp.id}" cannot depend on ${stereotypeOf(depComp)} component "${depComp.id}". Views must remain passive UI blocks that use pure logic at most.` + storeHint,
+                "ARCHITECTURE_VIOLATION_PORTAL_FORBIDDEN_DEP",
+                `Architectural violation: ${comp.componentType} component "${comp.id}" cannot depend directly on "${depComp.componentType}" component "${depComp.id}". ${comp.componentType}s coordinate through Orchestrators (and Supervisors); they do not reach the data layer directly.` + storeHint,
                 comp.id,
-                edgeDraft
+                edge.draftContext
               );
             }
-            if (comp.componentType === "Supervisor" && ["Store", "Registry", "Repository", "Index", "Query", "View", "FeatureComponent", "RouterComponent"].includes(depComp.componentType)) {
+          }
+          if (comp.componentType === "View" && (["Store", "Registry", "Index", "Query", "Adapter", "Repository"].includes(depComp.componentType) || depComp.componentType === "Orchestrator" && !isPureLogic(depComp))) {
+            ctx.addIssue(
+              "error",
+              "ARCHITECTURE_VIOLATION_VIEW_DEP",
+              `Architectural violation: View component "${comp.id}" cannot depend on ${stereotypeOf(depComp)} component "${depComp.id}". Views must remain passive UI blocks that use pure logic at most.` + storeHint,
+              comp.id,
+              edge.draftContext
+            );
+          }
+          if (comp.componentType === "Supervisor" && ["Store", "Registry", "Repository", "Index", "Query", "View", "FeatureComponent", "RouterComponent"].includes(depComp.componentType)) {
+            ctx.addIssue(
+              "error",
+              "ARCHITECTURE_VIOLATION_SUPERVISOR_DEP",
+              `Architectural violation: Supervisor "${comp.id}" cannot depend on ${stereotypeOf(depComp)} "${depComp.id}". A Supervisor reaches data only through workflows \u2014 depend on the Orchestrator, Actor or Adapter that does that work instead.` + storeHint,
+              comp.id,
+              edge.draftContext
+            );
+          }
+          if (depComp.componentType === "Actor" && comp.componentType !== "Supervisor") {
+            const reachedThroughSupervisor = comp.dependsOn.some((id) => {
+              const supervisor = ctx.componentMap.get(id);
+              return supervisor?.componentType === "Supervisor" && supervisor.dependsOn.includes(depComp.id);
+            });
+            if (!reachedThroughSupervisor) {
+              const supervisors = ctx.components.filter((c) => c.componentType === "Supervisor" && c.dependsOn.includes(depComp.id)).map((c) => `"${c.id}"`);
+              const remedy = supervisors.length > 0 ? `also depend on ${supervisors.length === 1 ? "its Supervisor" : "one of its Supervisors"} (${supervisors.join(", ")})` : `no Supervisor depends on "${depComp.id}" yet, so give the Actor a Supervisor that depends on it and depend on that Supervisor`;
               ctx.addIssue(
                 "error",
-                "ARCHITECTURE_VIOLATION_SUPERVISOR_DEP",
-                `Architectural violation: Supervisor "${comp.id}" cannot depend on ${stereotypeOf(depComp)} "${depComp.id}". A Supervisor reaches data only through workflows \u2014 depend on the Orchestrator, Actor or Adapter that does that work instead.` + storeHint,
+                "ACTOR_REACHED_WITHOUT_SUPERVISOR",
+                `Architectural violation: ${stereotypeOf(comp)} "${comp.id}" depends on the live Actor "${depComp.id}" without a Supervisor that supervises it. A live Actor is reached by id through a Supervisor that supervises it \u2014 ${remedy}.`,
                 comp.id,
-                edgeDraft
+                edge.draftContext
               );
             }
-            if (depComp.componentType === "Actor" && comp.componentType !== "Supervisor") {
-              const reachedThroughSupervisor = comp.dependsOn.some((id) => {
-                const supervisor = ctx.componentMap.get(id);
-                return supervisor?.componentType === "Supervisor" && supervisor.dependsOn.includes(depComp.id);
-              });
-              if (!reachedThroughSupervisor) {
-                const supervisors = ctx.components.filter((c) => c.componentType === "Supervisor" && c.dependsOn.includes(depComp.id)).map((c) => `"${c.id}"`);
-                const remedy = supervisors.length > 0 ? `also depend on ${supervisors.length === 1 ? "its Supervisor" : "one of its Supervisors"} (${supervisors.join(", ")})` : `no Supervisor depends on "${depComp.id}" yet, so give the Actor a Supervisor that depends on it and depend on that Supervisor`;
-                ctx.addIssue(
-                  "error",
-                  "ACTOR_REACHED_WITHOUT_SUPERVISOR",
-                  `Architectural violation: ${stereotypeOf(comp)} "${comp.id}" depends on the live Actor "${depComp.id}" without a Supervisor that supervises it. A live Actor is reached by id through a Supervisor that supervises it \u2014 ${remedy}.`,
-                  comp.id,
-                  edgeDraft
-                );
-              }
-            }
           }
         }
+      }
+    };
+  }
+});
+
+// src/core/rules/doctrine/portal-write-shortcut.ts
+var portalWriteShortcutRule;
+var init_portal_write_shortcut = __esm({
+  "src/core/rules/doctrine/portal-write-shortcut.ts"() {
+    "use strict";
+    portalWriteShortcutRule = {
+      name: "portal-write-shortcut",
+      description: "A Portal narrative call step or dispatch-table binding that reaches a write-effect method on a Repository or Index directly is the write shortcut: the Portal\u2192data-facade edge is licensed for reads only, and a write routes through an Orchestrator that owns the workflow. A dispatch step reaches its server only through a table binding, so judging every binding judges each dispatch step that takes it, once, where the route is declared. Methods that carry no effect tag are not judged.",
+      codes: [
+        { code: "PORTAL_WRITE_SHORTCUT", defaultSeverity: "error", summary: "Portal narrative call or dispatch-table binding reaches a write-effect method on a Repository/Index directly \u2014 reads may shortcut, writes route through an Orchestrator (judged on effect-tagged facade methods; untagged methods are not yet judged)" }
+      ],
+      check(ctx) {
         for (const impl of ctx.implementations) {
           const contract = ctx.interfaceMap.get(impl.contract);
           const component = contract ? ctx.componentMap.get(contract.component) : void 0;
@@ -10596,31 +11110,23 @@ var init_stereotype_dependencies = __esm({
   }
 });
 
-// src/core/rules/doctrine/pattern-ownership.ts
-var patternsRule;
-var init_pattern_ownership = __esm({
-  "src/core/rules/doctrine/pattern-ownership.ts"() {
+// src/core/rules/doctrine/pattern-membership.ts
+var patternMembershipRule;
+var init_pattern_membership = __esm({
+  "src/core/rules/doctrine/pattern-membership.ts"() {
     "use strict";
     init_models();
-    patternsRule = {
-      name: "pattern-ownership",
-      description: "Patterns (Repository/FeatureComponent/RouterComponent) own member blocks with the containment their definition prescribes; blocks own nothing; a member has exactly one owner; and private members are reachable only via their facade or siblings.",
+    patternMembershipRule = {
+      name: "pattern-membership",
+      description: "Only patterns (Repository/FeatureComponent/RouterComponent) own member blocks, and every pattern owns at least one. Each claim must name a component that exists and is itself a building block \u2014 patterns compose at the subsystem (L1) level, never by owning one another \u2014 and a block has exactly one owner, the first pattern to claim it.",
       codes: [
         { code: "EMPTY_PATTERN", defaultSeverity: "error", summary: "Pattern with no owned member blocks" },
         { code: "BLOCK_OWNS_MEMBERS", defaultSeverity: "error", summary: "Building block using owns" },
         { code: "INVALID_OWNED_MEMBER", defaultSeverity: "error", summary: "owns names a non-existent component" },
         { code: "PATTERN_OWNS_PATTERN", defaultSeverity: "error", summary: "Pattern owning another pattern" },
-        { code: "SHARED_OWNED_MEMBER", defaultSeverity: "error", summary: "Block owned by two patterns" },
-        { code: "REPOSITORY_CONTAINMENT", defaultSeverity: "error", summary: "Repository owning a non Store/Registry/Index/Query/Adapter member" },
-        { code: "FEATURE_COMPONENT_CONTAINMENT", defaultSeverity: "error", summary: "FeatureComponent not owning exactly one Orchestrator + one or more Views" },
-        { code: "ROUTER_COMPONENT_CONTAINMENT", defaultSeverity: "error", summary: "RouterComponent not owning exactly one Portal facade, or owning no children to route to" },
-        { code: "VISIBILITY_VIOLATION", defaultSeverity: "error", summary: "Dependency on a block privately owned by another pattern" },
-        { code: "UNOWNED_STORE", defaultSeverity: "warning", summary: "Store not owned by any pattern \u2014 recommended shape is a Repository; a deliberate standalone Store needs a lint.allow" },
-        { code: "REGISTRY_WITHOUT_STORE", defaultSeverity: "warning", summary: "Standalone Registry with no Store to write to \u2014 either mistyped (a fused file-backed store belongs typed Store) or orphaned" },
-        { code: "UNOWNED_QUERY", defaultSeverity: "error", summary: "Query not owned by a Repository \u2014 a Query computes reads over its own Repository's Store" }
+        { code: "SHARED_OWNED_MEMBER", defaultSeverity: "error", summary: "Block owned by two patterns" }
       ],
       check(ctx) {
-        const ownedBy = /* @__PURE__ */ new Map();
         for (const comp of ctx.components) {
           if (isRetired(comp)) continue;
           const isDraftCtx = ctx.isComponentDraft(comp.id);
@@ -10631,6 +11137,12 @@ var init_pattern_ownership = __esm({
           if (!pattern && comp.owns.length > 0) {
             ctx.addIssue("error", "BLOCK_OWNS_MEMBERS", `Building block "${comp.id}" (${comp.componentType}) cannot own members; only patterns (${Array.from(PATTERN_TYPES).join("/")}) use "owns".`, comp.id, isDraftCtx);
           }
+        }
+        const ownership = ctx.ownershipIndex();
+        for (const comp of ctx.components) {
+          if (isRetired(comp)) continue;
+          const isDraftCtx = ctx.isComponentDraft(comp.id);
+          const pattern = isPattern(comp);
           for (const memberId of comp.owns) {
             const member = ctx.componentMap.get(memberId);
             if (!member) {
@@ -10642,26 +11154,50 @@ var init_pattern_ownership = __esm({
               ctx.addIssue("error", "PATTERN_OWNS_PATTERN", `Pattern "${comp.id}" owns "${memberId}", which is itself a pattern. Patterns own only building blocks \u2014 compose patterns at the subsystem (L1) level.`, comp.id, isDraftCtx);
               continue;
             }
-            const firstOwner = ownedBy.get(memberId);
+            const firstOwner = ownership.ownerOf(memberId);
             if (firstOwner && firstOwner !== comp.id) {
               ctx.addIssue("error", "SHARED_OWNED_MEMBER", `Block "${memberId}" is owned by both "${firstOwner}" and "${comp.id}"; a block has exactly one owner.`, comp.id, isDraftCtx);
             }
-            if (!firstOwner) ownedBy.set(memberId, comp.id);
           }
-          if ((comp.componentType === "FeatureComponent" || comp.componentType === "RouterComponent") && comp.owns.some((memberId) => {
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/doctrine/pattern-containment.ts
+var REPOSITORY_MEMBERS, patternContainmentRule;
+var init_pattern_containment = __esm({
+  "src/core/rules/doctrine/pattern-containment.ts"() {
+    "use strict";
+    init_models();
+    REPOSITORY_MEMBERS = /* @__PURE__ */ new Set(["Store", "Registry", "Index", "Query", "Adapter"]);
+    patternContainmentRule = {
+      name: "pattern-containment",
+      description: "Holds each pattern to the containment its definition prescribes. A Repository may own only Store, Registry, Index, Query and (optionally) Adapter, judged member by member. A FeatureComponent owns exactly one Orchestrator (the logic side) and one or more Views (its faces \u2014 list, detail, form \u2014 sharing the one logic component), and nothing else. A RouterComponent owns exactly one Portal as its facade and at least one other child to route to. A counting pattern that still owns a retired member is not judged until that member is migrated: its counts change with the migration, and STEREOTYPE_RETIRED is the one finding.",
+      codes: [
+        { code: "REPOSITORY_CONTAINMENT", defaultSeverity: "error", summary: "Repository owning a non Store/Registry/Index/Query/Adapter member" },
+        { code: "FEATURE_COMPONENT_CONTAINMENT", defaultSeverity: "error", summary: "FeatureComponent not owning exactly one Orchestrator + one or more Views" },
+        { code: "ROUTER_COMPONENT_CONTAINMENT", defaultSeverity: "error", summary: "RouterComponent not owning exactly one Portal facade, or owning no children to route to" }
+      ],
+      check(ctx) {
+        for (const comp of ctx.components) {
+          if (comp.componentType !== "Repository" || isRetired(comp)) continue;
+          const isDraftCtx = ctx.isComponentDraft(comp.id);
+          for (const memberId of comp.owns) {
             const member = ctx.componentMap.get(memberId);
-            return member !== void 0 && isRetired(member);
-          })) {
-            continue;
-          }
-          if (comp.componentType === "Repository") {
-            const allowed = /* @__PURE__ */ new Set(["Store", "Registry", "Index", "Query", "Adapter"]);
-            for (const memberId of comp.owns) {
-              const member = ctx.componentMap.get(memberId);
-              if (!member || isRetired(member) || allowed.has(member.componentType)) continue;
-              ctx.addIssue("error", "REPOSITORY_CONTAINMENT", `Repository "${comp.id}" owns "${memberId}" of type ${member.componentType}; a Repository may own only Store, Registry, Index, Query, and (optionally) Adapter.`, comp.id, isDraftCtx);
-            }
+            if (!member || isRetired(member) || REPOSITORY_MEMBERS.has(member.componentType)) continue;
+            ctx.addIssue("error", "REPOSITORY_CONTAINMENT", `Repository "${comp.id}" owns "${memberId}" of type ${member.componentType}; a Repository may own only Store, Registry, Index, Query, and (optionally) Adapter.`, comp.id, isDraftCtx);
           }
+        }
+        for (const comp of ctx.components) {
+          if (comp.componentType !== "FeatureComponent" && comp.componentType !== "RouterComponent") continue;
+          if (isRetired(comp)) continue;
+          if (comp.owns.some((memberId) => {
+            const member = ctx.componentMap.get(memberId);
+            return member !== void 0 && isRetired(member);
+          })) continue;
+          const isDraftCtx = ctx.isComponentDraft(comp.id);
           if (comp.componentType === "FeatureComponent") {
             let orchestrators = 0;
             let views = 0;
@@ -10692,45 +11228,83 @@ var init_pattern_ownership = __esm({
             }
           }
         }
+      }
+    };
+  }
+});
+
+// src/core/rules/doctrine/unowned-blocks.ts
+var unownedBlocksRule;
+var init_unowned_blocks = __esm({
+  "src/core/rules/doctrine/unowned-blocks.ts"() {
+    "use strict";
+    unownedBlocksRule = {
+      name: "unowned-blocks",
+      description: `Judges the data blocks no pattern owns. A Store may stand alone deliberately \u2014 the sanctioned lightweight form for genuinely simple state, acknowledged with a lint.allow \u2014 while the recommended shape stays a Repository; what must never happen is folding the state into a consuming component, where no spec, diagram or conformance check can see it again. A Registry standing alone with no Store to write to is either mistyped (the "file-backed Registry" idiom, a fused persistent store that belongs typed Store) or orphaned. A Query has no standalone form at all: it computes reads over its own Repository's Store.`,
+      codes: [
+        { code: "UNOWNED_STORE", defaultSeverity: "warning", summary: "Store not owned by any pattern \u2014 recommended shape is a Repository; a deliberate standalone Store needs a lint.allow" },
+        { code: "REGISTRY_WITHOUT_STORE", defaultSeverity: "warning", summary: "Standalone Registry with no Store to write to \u2014 either mistyped (a fused file-backed store belongs typed Store) or orphaned" },
+        { code: "UNOWNED_QUERY", defaultSeverity: "error", summary: "Query not owned by a Repository \u2014 a Query computes reads over its own Repository's Store" }
+      ],
+      check(ctx) {
+        const ownership = ctx.ownershipIndex();
         for (const comp of ctx.components) {
-          if (comp.componentType !== "Store" || ownedBy.has(comp.id)) continue;
-          ctx.addIssue(
-            "warning",
-            "UNOWNED_STORE",
-            `Store "${comp.id}" is not owned by any pattern. The recommended shape for held state is a Repository (owns: ["${comp.id}", its Registry, its Index]) with consumers on the facade. For genuinely simple state a deliberately standalone Store is the sanctioned lightweight form \u2014 keep it visible as this Store, reachable from the workflow layer (Orchestrator/Supervisor/Actor), and acknowledge it with a lint.allow reason. Never take the third path of merging the state into a consuming component: state hidden inside a logic block disappears from the architecture permanently.`,
-            comp.id,
-            ctx.isComponentDraft(comp.id)
-          );
-        }
-        for (const comp of ctx.components) {
-          if (comp.componentType !== "Registry" || ownedBy.has(comp.id)) continue;
-          const hasStoreDep = comp.dependsOn.some((depId) => ctx.componentMap.get(depId)?.componentType === "Store");
-          if (hasStoreDep) continue;
-          ctx.addIssue(
-            "warning",
-            "REGISTRY_WITHOUT_STORE",
-            `Registry "${comp.id}" stands alone with no Store to write to. A Registry is the write path to a Store \u2014 if this component itself holds the persisted state (a file-backed record/config store), retype it as a Store with the honest durability (read-through for no-RAM-copy file I/O) so the durability machinery can see it; otherwise wire its Store, or lint.allow with a reason.`,
-            comp.id,
-            ctx.isComponentDraft(comp.id)
-          );
-        }
-        for (const comp of ctx.components) {
-          if (comp.componentType !== "Query" || ownedBy.has(comp.id)) continue;
-          ctx.addIssue(
-            "error",
-            "UNOWNED_QUERY",
-            `Query "${comp.id}" is not owned by any pattern. A Query computes reads over its own Repository's Store \u2014 make it a member of the Repository whose Store it reads (owns: ["${comp.id}", \u2026]).`,
-            comp.id,
-            ctx.isComponentDraft(comp.id)
-          );
+          if (ownership.ownedMembers.has(comp.id)) continue;
+          const isDraftCtx = ctx.isComponentDraft(comp.id);
+          if (comp.componentType === "Store") {
+            ctx.addIssue(
+              "warning",
+              "UNOWNED_STORE",
+              `Store "${comp.id}" is not owned by any pattern. The recommended shape for held state is a Repository (owns: ["${comp.id}", its Registry, its Index]) with consumers on the facade. For genuinely simple state a deliberately standalone Store is the sanctioned lightweight form \u2014 keep it visible as this Store, reachable from the workflow layer (Orchestrator/Supervisor/Actor), and acknowledge it with a lint.allow reason. Never take the third path of merging the state into a consuming component: state hidden inside a logic block disappears from the architecture permanently.`,
+              comp.id,
+              isDraftCtx
+            );
+          }
+          if (comp.componentType === "Registry" && !comp.dependsOn.some((depId) => ctx.componentMap.get(depId)?.componentType === "Store")) {
+            ctx.addIssue(
+              "warning",
+              "REGISTRY_WITHOUT_STORE",
+              `Registry "${comp.id}" stands alone with no Store to write to. A Registry is the write path to a Store \u2014 if this component itself holds the persisted state (a file-backed record/config store), retype it as a Store with the honest durability (read-through for no-RAM-copy file I/O) so the durability machinery can see it; otherwise wire its Store, or lint.allow with a reason.`,
+              comp.id,
+              isDraftCtx
+            );
+          }
+          if (comp.componentType === "Query") {
+            ctx.addIssue(
+              "error",
+              "UNOWNED_QUERY",
+              `Query "${comp.id}" is not owned by any pattern. A Query computes reads over its own Repository's Store \u2014 make it a member of the Repository whose Store it reads (owns: ["${comp.id}", \u2026]).`,
+              comp.id,
+              isDraftCtx
+            );
+          }
         }
+      }
+    };
+  }
+});
+
+// src/core/rules/doctrine/member-visibility.ts
+var memberVisibilityRule;
+var init_member_visibility = __esm({
+  "src/core/rules/doctrine/member-visibility.ts"() {
+    "use strict";
+    init_models();
+    memberVisibilityRule = {
+      name: "member-visibility",
+      description: "A component may depend on a block within its own group (it is the owning pattern, or a sibling member of the same pattern), on any pattern facade, or on a standalone block \u2014 never on a block privately owned by ANOTHER pattern, which must be reached through that pattern's facade. A retired depending component is skipped, as everywhere in this family.",
+      codes: [
+        { code: "VISIBILITY_VIOLATION", defaultSeverity: "error", summary: "Dependency on a block privately owned by another pattern" }
+      ],
+      check(ctx) {
+        const ownership = ctx.ownershipIndex();
         for (const comp of ctx.components) {
           if (isRetired(comp)) continue;
           for (const depId of comp.dependsOn) {
-            const owner = ownedBy.get(depId);
+            const owner = ownership.ownerOf(depId);
             if (!owner) continue;
             if (owner === comp.id) continue;
-            if (ownedBy.get(comp.id) === owner) continue;
+            if (ownership.ownerOf(comp.id) === owner) continue;
             ctx.addIssue("error", "VISIBILITY_VIOLATION", `Component "${comp.id}" depends on "${depId}", which is privately owned by pattern "${owner}". Depend on the facade "${owner}" instead.`, comp.id, ctx.isComponentDraft(comp.id) || ctx.isComponentDraft(depId));
           }
         }
@@ -11023,17 +11597,135 @@ var init_component_variants = __esm({
   }
 });
 
-// src/core/rules/extension/declarative-assertions.ts
+// src/core/rules/extension/declared-assertion.ts
+function assertionsOfKind(ctx, kind) {
+  return ctx.ext.assertions.filter(
+    (a) => a.kind === kind
+  );
+}
 function globToRegExp(glob) {
   const escaped = glob.replace(/[.*+?^${}()|[\]\\]/g, (ch) => ch === "*" ? ".*" : `\\${ch}`);
   return new RegExp(`^${escaped}$`);
 }
-function matches(sel, comp, ctx) {
+function matchesSelector(sel, comp, ctx) {
   if (sel.componentType?.length && !sel.componentType.includes(comp.componentType)) return false;
   if (sel.profile?.length && !sel.profile.includes(ctx.getComponentProfile(comp.id))) return false;
   if (sel.id && !globToRegExp(sel.id).test(comp.id)) return false;
   return true;
 }
+function reportAssertion(ctx, a, message, specId, isDraftCtx) {
+  const severity = isDraftCtx && a.severity === "error" ? "warning" : a.severity;
+  ctx.addIssue(severity, a.fullCode, `${message} [pack "${a.pack}"]: ${a.reason}`, specId, isDraftCtx);
+}
+var init_declared_assertion = __esm({
+  "src/core/rules/extension/declared-assertion.ts"() {
+    "use strict";
+  }
+});
+
+// src/core/rules/extension/assertion-forbidden-edges.ts
+var assertionForbiddenEdgesRule;
+var init_assertion_forbidden_edges = __esm({
+  "src/core/rules/extension/assertion-forbidden-edges.ts"() {
+    "use strict";
+    init_declared_assertion();
+    assertionForbiddenEdgesRule = {
+      name: "assertion-forbidden-edges",
+      description: "Evaluates the `forbid-edge` assertions loaded packs declare: for every component matching the assertion's from-selector, every dependsOn/owns id whose target matches the to-selector is reported. Findings carry the pack's namespaced code (<PACK>_<CODE>) and its stated reason; severity is the pack's declaration (project sddRuleSeverity still wins, and error downgrades to warning in draft context). The codes are the packs' own, so no fixed code list applies.",
+      // Static codes are unknown here — packs bring their own. The validator
+      // gathers every loaded assertion's fullCode into knownIssueCodes.
+      codes: [],
+      check(ctx) {
+        for (const a of assertionsOfKind(ctx, "forbid-edge")) {
+          for (const comp of ctx.components) {
+            if (!matchesSelector(a.from, comp, ctx)) continue;
+            const isDraftCtx = ctx.isComponentDraft(comp.id);
+            const edges = a.relation.flatMap(
+              (relation) => comp[relation].map((targetId) => ({ relation, targetId }))
+            );
+            for (const { relation, targetId } of edges) {
+              const target = ctx.componentMap.get(targetId);
+              if (!target || !matchesSelector(a.to, target, ctx)) continue;
+              reportAssertion(
+                ctx,
+                a,
+                `Component "${comp.id}" (${comp.componentType}) ${relation === "owns" ? "owns" : "depends on"} "${target.id}" (${target.componentType}), forbidden by assertion ${a.code}`,
+                comp.id,
+                isDraftCtx
+              );
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/extension/assertion-required-fields.ts
+function fieldValue(spec, field) {
+  const segments = field.split(".");
+  if (segments[0] !== "ext") {
+    return segments.length === 1 ? spec[field] : void 0;
+  }
+  let cur = spec.ext;
+  for (const seg of segments.slice(1)) {
+    if (cur === null || typeof cur !== "object") return void 0;
+    if (!Object.prototype.hasOwnProperty.call(cur, seg)) return void 0;
+    cur = cur[seg];
+  }
+  return cur;
+}
+function holdersAt(ctx, level) {
+  const holders = [];
+  if (level === "component") {
+    for (const c of ctx.components) {
+      holders.push({ spec: c, specId: c.id, comp: c, draft: ctx.isComponentDraft(c.id) });
+    }
+  } else if (level === "interface") {
+    for (const i of ctx.interfaces) {
+      const comp = ctx.componentMap.get(i.component);
+      if (comp) holders.push({ spec: i, specId: i.id, comp, draft: ctx.isComponentDraft(comp.id) || i.status === "draft" || i.status === "design" });
+    }
+  } else {
+    for (const impl of ctx.implementations) {
+      const contract = ctx.interfaceMap.get(impl.contract);
+      const comp = contract ? ctx.componentMap.get(contract.component) : void 0;
+      if (comp) holders.push({ spec: impl, specId: impl.id, comp, draft: ctx.isImplementationDraft(impl) });
+    }
+  }
+  return holders;
+}
+var assertionRequiredFieldsRule;
+var init_assertion_required_fields = __esm({
+  "src/core/rules/extension/assertion-required-fields.ts"() {
+    "use strict";
+    init_declared_assertion();
+    assertionRequiredFieldsRule = {
+      name: "assertion-required-fields",
+      description: "Evaluates the `require-field` assertions loaded packs declare: at the assertion's level (component / interface / implementation), every spec whose owning component matches the on-selector must declare the named field \u2014 a top-level spec field or an `ext.*` path \u2014 and, when the assertion states a closed value set, hold one of those values. Findings carry the pack's namespaced code (<PACK>_<CODE>) and its stated reason; severity is the pack's declaration (project sddRuleSeverity still wins, and error downgrades to warning in draft context). The codes are the packs' own, so no fixed code list applies.",
+      // Static codes are unknown here — packs bring their own. The validator
+      // gathers every loaded assertion's fullCode into knownIssueCodes.
+      codes: [],
+      check(ctx) {
+        for (const a of assertionsOfKind(ctx, "require-field")) {
+          for (const h of holdersAt(ctx, a.level)) {
+            if (!matchesSelector(a.on, h.comp, ctx)) continue;
+            const v = fieldValue(h.spec, a.field);
+            if (v === void 0 || v === null) {
+              reportAssertion(ctx, a, `${a.level} spec "${h.specId}" does not declare "${a.field}", required by assertion ${a.code}`, h.specId, h.draft);
+              continue;
+            }
+            if (a.values && !a.values.includes(String(v))) {
+              reportAssertion(ctx, a, `${a.level} spec "${h.specId}" declares "${a.field}" = "${String(v)}", outside the allowed set (${a.values.join(", ")}) of assertion ${a.code}`, h.specId, h.draft);
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/extension/assertion-endpoint-shapes.ts
 function endpointAddress(ep) {
   switch (ep.transport) {
     case "HTTP":
@@ -11054,92 +11746,42 @@ function endpointAddress(ep) {
       return ep.address;
   }
 }
-function fieldValue(spec, field) {
-  const segments = field.split(".");
-  if (segments[0] !== "ext") {
-    return segments.length === 1 ? spec[field] : void 0;
-  }
-  let cur = spec.ext;
-  for (const seg of segments.slice(1)) {
-    if (cur === null || typeof cur !== "object") return void 0;
-    if (!Object.prototype.hasOwnProperty.call(cur, seg)) return void 0;
-    cur = cur[seg];
+function boundEndpoints(ctx, on) {
+  const out = [];
+  for (const intf of ctx.interfaces) {
+    const comp = ctx.componentMap.get(intf.component);
+    if (!comp || !matchesSelector(on, comp, ctx)) continue;
+    const draft = ctx.isComponentDraft(comp.id) || intf.status === "draft" || intf.status === "design";
+    for (const method of intf.methods) {
+      if (!method.endpoint) continue;
+      out.push({ intf, method, endpoint: method.endpoint, draft });
+    }
   }
-  return cur;
+  return out;
 }
-var declarativeAssertionsRule;
-var init_declarative_assertions = __esm({
-  "src/core/rules/extension/declarative-assertions.ts"() {
+var assertionEndpointShapesRule;
+var init_assertion_endpoint_shapes = __esm({
+  "src/core/rules/extension/assertion-endpoint-shapes.ts"() {
     "use strict";
-    declarativeAssertionsRule = {
-      name: "declarative-assertions",
-      description: "Evaluates the declarative rule assertions loaded packs declare (forbid-edge / require-field / endpoint-shape) \u2014 closed kinds instantiated with pack data, the hosted-safe doctrine channel. Findings carry the pack's namespaced code (<PACK>_<CODE>) and its stated reason; severity is the pack's declaration (project sddRuleSeverity still wins, and error downgrades to warning in draft context). The codes are the packs' own, so no fixed code list applies.",
+    init_declared_assertion();
+    assertionEndpointShapesRule = {
+      name: "assertion-endpoint-shapes",
+      description: "Evaluates the `endpoint-shape` assertions loaded packs declare: every endpoint bound on a contract whose component matches the on-selector must use an allowed transport and bind an address (path / topic / command / pipe / channel) matching the assertion's anchored pattern. Findings carry the pack's namespaced code (<PACK>_<CODE>) and its stated reason; severity is the pack's declaration (project sddRuleSeverity still wins, and error downgrades to warning in draft context). The codes are the packs' own, so no fixed code list applies.",
       // Static codes are unknown here — packs bring their own. The validator
       // gathers every loaded assertion's fullCode into knownIssueCodes.
       codes: [],
       check(ctx) {
-        const assertions = ctx.ext.assertions;
-        if (!assertions.length) return;
-        const emit = (a, message, specId, isDraftCtx) => {
-          const severity = isDraftCtx && a.severity === "error" ? "warning" : a.severity;
-          ctx.addIssue(severity, a.fullCode, `${message} [pack "${a.pack}"]: ${a.reason}`, specId, isDraftCtx);
-        };
-        for (const a of assertions) {
-          if (a.kind === "forbid-edge") {
-            for (const comp of ctx.components) {
-              if (!matches(a.from, comp, ctx)) continue;
-              const isDraftCtx = ctx.isComponentDraft(comp.id);
-              for (const relation of a.relation) {
-                for (const targetId of comp[relation]) {
-                  const target = ctx.componentMap.get(targetId);
-                  if (!target || !matches(a.to, target, ctx)) continue;
-                  emit(a, `Component "${comp.id}" (${comp.componentType}) ${relation === "owns" ? "owns" : "depends on"} "${target.id}" (${target.componentType}), forbidden by assertion ${a.code}`, comp.id, isDraftCtx);
-                }
-              }
-            }
-          } else if (a.kind === "require-field") {
-            const holders = [];
-            if (a.level === "component") {
-              for (const c of ctx.components) holders.push({ spec: c, specId: c.id, comp: c, draft: ctx.isComponentDraft(c.id) });
-            } else if (a.level === "interface") {
-              for (const i of ctx.interfaces) {
-                const comp = ctx.componentMap.get(i.component);
-                if (comp) holders.push({ spec: i, specId: i.id, comp, draft: ctx.isComponentDraft(comp.id) || i.status === "draft" || i.status === "design" });
-              }
-            } else {
-              for (const impl of ctx.implementations) {
-                const contract = ctx.interfaceMap.get(impl.contract);
-                const comp = contract ? ctx.componentMap.get(contract.component) : void 0;
-                if (comp) holders.push({ spec: impl, specId: impl.id, comp, draft: ctx.isImplementationDraft(impl) });
-              }
-            }
-            for (const h of holders) {
-              if (!matches(a.on, h.comp, ctx)) continue;
-              const v = fieldValue(h.spec, a.field);
-              if (v === void 0 || v === null) {
-                emit(a, `${a.level} spec "${h.specId}" does not declare "${a.field}", required by assertion ${a.code}`, h.specId, h.draft);
-              } else if (a.values && !a.values.includes(String(v))) {
-                emit(a, `${a.level} spec "${h.specId}" declares "${a.field}" = "${String(v)}", outside the allowed set (${a.values.join(", ")}) of assertion ${a.code}`, h.specId, h.draft);
-              }
+        for (const a of assertionsOfKind(ctx, "endpoint-shape")) {
+          const pattern = a.pathPattern ? new RegExp(a.pathPattern) : void 0;
+          for (const bound2 of boundEndpoints(ctx, a.on)) {
+            const { intf, method, endpoint } = bound2;
+            if (a.transport?.length && !a.transport.includes(endpoint.transport)) {
+              reportAssertion(ctx, a, `Endpoint of "${intf.id}.${method.name}" uses transport ${endpoint.transport}, outside the allowlist (${a.transport.join(", ")}) of assertion ${a.code}`, intf.id, bound2.draft);
+              continue;
             }
-          } else if (a.kind === "endpoint-shape") {
-            const pattern = a.pathPattern ? new RegExp(a.pathPattern) : void 0;
-            for (const intf of ctx.interfaces) {
-              const comp = ctx.componentMap.get(intf.component);
-              if (!comp || !matches(a.on, comp, ctx)) continue;
-              const isDraftCtx = ctx.isComponentDraft(comp.id) || intf.status === "draft" || intf.status === "design";
-              for (const method of intf.methods) {
-                if (!method.endpoint) continue;
-                const ep = method.endpoint;
-                if (a.transport?.length && !a.transport.includes(ep.transport)) {
-                  emit(a, `Endpoint of "${intf.id}.${method.name}" uses transport ${ep.transport}, outside the allowlist (${a.transport.join(", ")}) of assertion ${a.code}`, intf.id, isDraftCtx);
-                  continue;
-                }
-                const address = endpointAddress(ep);
-                if (pattern && !pattern.test(address)) {
-                  emit(a, `Endpoint of "${intf.id}.${method.name}" binds "${address}", which does not match ${a.pathPattern} required by assertion ${a.code}`, intf.id, isDraftCtx);
-                }
-              }
+            const address = endpointAddress(endpoint);
+            if (pattern && !pattern.test(address)) {
+              reportAssertion(ctx, a, `Endpoint of "${intf.id}.${method.name}" binds "${address}", which does not match ${a.pathPattern} required by assertion ${a.code}`, intf.id, bound2.draft);
             }
           }
         }
@@ -11579,16 +12221,13 @@ var reachabilityRule;
 var init_unused_detection = __esm({
   "src/core/rules/wiring/unused-detection.ts"() {
     "use strict";
-    init_models();
     init_narrative_graph_projector();
     reachabilityRule = {
       name: "unused-detection",
-      description: "Walks the narrative execution graph (call steps, register handoffs, dispatch-table routing, lifecycle flows) from every entrypoint (Portal/Observer/published component/lifecycle entrypoint/invokedBy-declared method) and flags components and methods no execution chain reaches, plus types no field or signature references. An interface method declaring invokedBy (a real caller outside the modeled graph) seeds the walk, so its narrative propagates reachability; the declaration itself is audited (thin caller prose, or a method the internal walk already reaches).",
+      description: "Walks the narrative execution graph (call steps, register handoffs, dispatch-table routing, lifecycle flows) from every entrypoint (Portal/Observer/published component/lifecycle entrypoint/invokedBy-declared method) and flags components and methods no execution chain reaches. An interface method declaring invokedBy (a real caller outside the modeled graph) seeds the walk, so its narrative propagates reachability; a declaration the INTERNAL walk (without those seeds) already reaches is stale and is reported.",
       codes: [
         { code: "UNUSED_COMPONENT", defaultSeverity: "warning", summary: "Component never reached by any narrative call chain" },
         { code: "UNUSED_METHOD", defaultSeverity: "warning", summary: "Method never called by any narrative step" },
-        { code: "UNUSED_TYPE", defaultSeverity: "warning", summary: "Type never referenced by fields or signatures" },
-        { code: "INVOKED_BY_UNDESCRIBED", defaultSeverity: "warning", summary: "invokedBy declaration whose caller prose is missing or placeholder-thin" },
         { code: "INVOKED_BY_REDUNDANT", defaultSeverity: "warning", summary: "invokedBy declaration on a method the internal narrative walk already reaches \u2014 stale, remove it" }
       ],
       check(ctx) {
@@ -11616,17 +12255,8 @@ var init_unused_detection = __esm({
             if (!m.invokedBy) continue;
             invokedBySeeds.push({ compId: intf.component, methodName: m.name });
             if (!ctx.isSpecInScope(intf.id)) continue;
-            const isDraftCtx = ctx.isComponentDraft(intf.component) || intf.status === "draft" || intf.status === "design";
-            if (!passesIntentFloor(m.invokedBy.caller, m.name)) {
-              ctx.addIssue(
-                "warning",
-                "INVOKED_BY_UNDESCRIBED",
-                `Method "${m.name}" on component "${intf.component}" declares invokedBy (${m.invokedBy.kind}) but its "caller" prose is missing or placeholder-thin \u2014 state WHO invokes it and when, so the entrypoint claim stays reviewable.`,
-                intf.id,
-                isDraftCtx
-              );
-            }
             if (baseWalk.reachesMethod(intf.component, m.name)) {
+              const isDraftCtx = ctx.isComponentDraft(intf.component) || intf.status === "draft" || intf.status === "design";
               ctx.addIssue(
                 "warning",
                 "INVOKED_BY_REDUNDANT",
@@ -11649,23 +12279,75 @@ var init_unused_detection = __esm({
               comp.id,
               isDraftCtx
             );
-          } else {
-            for (const intf of ctx.interfacesByComponent.get(comp.id) ?? []) {
-              for (const m of intf.methods) {
-                if (!reach.reachesMethod(comp.id, m.name)) {
-                  const isDraftCtx = ctx.isComponentDraft(comp.id) || intf.status === "draft" || intf.status === "design";
-                  ctx.addIssue(
-                    "warning",
-                    "UNUSED_METHOD",
-                    `Method "${m.name}" on component "${comp.id}" is defined but never called by any narrative step.`,
-                    intf.id,
-                    isDraftCtx
-                  );
-                }
+            continue;
+          }
+          for (const intf of ctx.interfacesByComponent.get(comp.id) ?? []) {
+            for (const m of intf.methods) {
+              if (!reach.reachesMethod(comp.id, m.name)) {
+                const isDraftCtx = ctx.isComponentDraft(comp.id) || intf.status === "draft" || intf.status === "design";
+                ctx.addIssue(
+                  "warning",
+                  "UNUSED_METHOD",
+                  `Method "${m.name}" on component "${comp.id}" is defined but never called by any narrative step.`,
+                  intf.id,
+                  isDraftCtx
+                );
               }
             }
           }
         }
+      }
+    };
+  }
+});
+
+// src/core/rules/wiring/invoked-by-description.ts
+var invokedByDescriptionRule;
+var init_invoked_by_description = __esm({
+  "src/core/rules/wiring/invoked-by-description.ts"() {
+    "use strict";
+    init_models();
+    invokedByDescriptionRule = {
+      name: "invoked-by-description",
+      description: 'An invokedBy declaration names a caller outside the modeled graph and silences unused-detection for its method, so the claim must stay reviewable: its "caller" prose is held to the intent floor (missing or placeholder-thin prose is reported), stating WHO invokes the method and when.',
+      codes: [
+        { code: "INVOKED_BY_UNDESCRIBED", defaultSeverity: "warning", summary: "invokedBy declaration whose caller prose is missing or placeholder-thin" }
+      ],
+      check(ctx) {
+        for (const intf of ctx.interfaces) {
+          if (!ctx.componentMap.has(intf.component)) continue;
+          if (!ctx.isSpecInScope(intf.id)) continue;
+          for (const m of intf.methods) {
+            if (!m.invokedBy) continue;
+            if (passesIntentFloor(m.invokedBy.caller, m.name)) continue;
+            const isDraftCtx = ctx.isComponentDraft(intf.component) || intf.status === "draft" || intf.status === "design";
+            ctx.addIssue(
+              "warning",
+              "INVOKED_BY_UNDESCRIBED",
+              `Method "${m.name}" on component "${intf.component}" declares invokedBy (${m.invokedBy.kind}) but its "caller" prose is missing or placeholder-thin \u2014 state WHO invokes it and when, so the entrypoint claim stays reviewable.`,
+              intf.id,
+              isDraftCtx
+            );
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/wiring/unused-types.ts
+var unusedTypesRule;
+var init_unused_types = __esm({
+  "src/core/rules/wiring/unused-types.ts"() {
+    "use strict";
+    init_models();
+    unusedTypesRule = {
+      name: "unused-types",
+      description: "Flags types no field of any type and no interface method signature references. References are matched through the type-reference grammar (generic arguments, collections, qualified ids), and the declaring type's own generic parameters are left out \u2014 a type parameter is not a reference to a type.",
+      codes: [
+        { code: "UNUSED_TYPE", defaultSeverity: "warning", summary: "Type never referenced by fields or signatures" }
+      ],
+      check(ctx) {
         const referencedTypes = /* @__PURE__ */ new Set();
         const markTypeReferenced = (ref) => {
           if (ctx.isBuiltinType(ref)) return;
@@ -11899,7 +12581,44 @@ var init_prose_claims = __esm({
   }
 });
 
-// src/core/rules/wiring/invariant-backing.ts
+// src/core/rules/wiring/unique-invariant-ids.ts
+var uniqueInvariantIdsRule;
+var init_unique_invariant_ids = __esm({
+  "src/core/rules/wiring/unique-invariant-ids.ts"() {
+    "use strict";
+    init_models();
+    uniqueInvariantIdsRule = {
+      name: "unique-invariant-ids",
+      description: `An entity's declared invariant ids must be unique within the entity: a narrative step asserts an invariant by "<type-id>.<invariant-id>", so a repeated id makes one assertion stand for two properties and satisfying either silences both.`,
+      codes: [
+        { code: "DUPLICATE_INVARIANT_ID", defaultSeverity: "error", summary: "An entity declares two invariants with the same id" }
+      ],
+      check(ctx) {
+        for (const t of ctx.types) {
+          const invariants = t.invariants ?? [];
+          if (invariants.length === 0) continue;
+          const sub = t.subsystem ? ctx.subsystems.find((s) => s.id === t.subsystem) : void 0;
+          const entityDraft = sub !== void 0 && isDraftSubsystem(sub);
+          const seen = /* @__PURE__ */ new Set();
+          for (const inv of invariants) {
+            if (seen.has(inv.id)) {
+              ctx.addIssue(
+                "error",
+                "DUPLICATE_INVARIANT_ID",
+                `Entity "${t.id}" declares invariant id "${inv.id}" more than once \u2014 invariant ids must be unique within the entity.`,
+                t.id,
+                entityDraft
+              );
+            }
+            seen.add(inv.id);
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/wiring/invariant-ref.ts
 function splitInvariantRef(ref) {
   const at = ref.lastIndexOf(".");
   if (at <= 0 || at === ref.length - 1) return null;
@@ -11923,6 +12642,14 @@ function refMatchesInvariant(ref, type, invariantId) {
   if (!(type.invariants ?? []).some((inv) => inv.id === invariantId)) return false;
   return typeMatchesRef(type, parts.typeRef);
 }
+var init_invariant_ref = __esm({
+  "src/core/rules/wiring/invariant-ref.ts"() {
+    "use strict";
+    init_models();
+  }
+});
+
+// src/core/rules/wiring/invariant-backing.ts
 function stepAsserts(impl, methodName, type, invariantId) {
   const method = impl.methods.find((m) => m.name === methodName);
   if (!method) return false;
@@ -11947,33 +12674,19 @@ var init_invariant_backing = __esm({
   "src/core/rules/wiring/invariant-backing.ts"() {
     "use strict";
     init_models();
+    init_invariant_ref();
     invariantBackingRule = {
       name: "invariant-backing",
-      description: 'The invariant registry: entities may declare domain invariants (type.invariants), anchored through their componentClass. Every write-effect contract method of the owning component must carry a narrative step asserting each invariant (step.assertsInvariants: "<type-id>.<invariant-id>") \u2014 the same declared-and-backed shape as semantic guarantees. This is an HONEST lint over declarations: a green run means every write path visibly claims the invariant, never that the narrative or code actually enforces it. An invariant with no resolvable owner or no declared write path is unanchored; dangling assertion references are errors.',
+      description: 'The invariant registry: entities may declare domain invariants (type.invariants), anchored through their componentClass. Every write-effect contract method of the owning component must carry a narrative step asserting each invariant (step.assertsInvariants: "<type-id>.<invariant-id>") \u2014 the same declared-and-backed shape as semantic guarantees. This is an HONEST lint over declarations: a green run means every write path visibly claims the invariant, never that the narrative or code actually enforces it. An invariant with no resolvable owner or no declared write path is unanchored, and nothing further is claimed about it.',
       codes: [
-        { code: "DUPLICATE_INVARIANT_ID", defaultSeverity: "error", summary: "An entity declares two invariants with the same id" },
         { code: "INVARIANT_UNANCHORED", defaultSeverity: "warning", summary: "An entity declares invariants but has no componentClass, its componentClass does not resolve, or the owning component declares no write-effect contract methods" },
-        { code: "UNASSERTED_INVARIANT", defaultSeverity: "warning", summary: "A write-effect method of the invariant's owning component has no narrative step asserting it" },
-        { code: "UNKNOWN_INVARIANT_REF", defaultSeverity: "error", summary: "A narrative step asserts an invariant that no entity declares" }
+        { code: "UNASSERTED_INVARIANT", defaultSeverity: "warning", summary: "A write-effect method of the invariant's owning component has no narrative step asserting it" }
       ],
       check(ctx) {
         for (const t of ctx.types) {
           const invariants = t.invariants ?? [];
           if (invariants.length === 0) continue;
           const entityDraft = isEntityDraft(t, ctx);
-          const seen = /* @__PURE__ */ new Set();
-          for (const inv of invariants) {
-            if (seen.has(inv.id)) {
-              ctx.addIssue(
-                "error",
-                "DUPLICATE_INVARIANT_ID",
-                `Entity "${t.id}" declares invariant id "${inv.id}" more than once \u2014 invariant ids must be unique within the entity.`,
-                t.id,
-                entityDraft
-              );
-            }
-            seen.add(inv.id);
-          }
           const comp = resolveComponentClass(t, ctx);
           if (!comp) {
             ctx.addIssue(
@@ -12015,6 +12728,24 @@ var init_invariant_backing = __esm({
             }
           }
         }
+      }
+    };
+  }
+});
+
+// src/core/rules/wiring/invariant-references.ts
+var invariantReferencesRule;
+var init_invariant_references = __esm({
+  "src/core/rules/wiring/invariant-references.ts"() {
+    "use strict";
+    init_invariant_ref();
+    invariantReferencesRule = {
+      name: "invariant-references",
+      description: "Every invariant a narrative step asserts (step.assertsInvariants) must resolve to a declared entity invariant: the reference splits at its last dot into a type reference and an invariant id, and some entity matching that type reference must declare that id. A reference nothing declares is an error \u2014 the step claims a property that exists nowhere.",
+      codes: [
+        { code: "UNKNOWN_INVARIANT_REF", defaultSeverity: "error", summary: "A narrative step asserts an invariant that no entity declares" }
+      ],
+      check(ctx) {
         for (const impl of ctx.implementations) {
           const isDraftCtx = ctx.isImplementationDraft(impl);
           for (const method of impl.methods) {
@@ -12128,8 +12859,7 @@ var init_source_file_linkage = __esm({
         { code: "CONFORMANCE_DEGRADED", defaultSeverity: "warning", summary: "TypeScript/JavaScript files were analyzed below exact grade (compiler not resolvable) \u2014 dependency conformance skips them" }
       ],
       check(ctx) {
-        const factsByPath = /* @__PURE__ */ new Map();
-        for (const facts of ctx.codeModel.files) factsByPath.set(pathKey(facts.path), facts);
+        const code = ctx.codeIndex();
         const degradedTsFiles = ctx.codeModel.files.filter(
           (f) => f.status === "analyzed" && (f.language === "typescript" || f.language === "javascript") && f.analysisGrade !== "exact"
         );
@@ -12177,7 +12907,7 @@ var init_source_file_linkage = __esm({
             const key = pathKey(file);
             if (reported.has(key)) continue;
             reported.add(key);
-            const facts = factsByPath.get(key);
+            const facts = code.factsAt(key);
             if (!facts || facts.status === "analyzed") continue;
             const isImplementationFile = !!impl.sourcePath && pathKey(impl.sourcePath) === key;
             const users = isImplementationFile ? [] : impl.methods.filter((m) => m.sourcePath && pathKey(m.sourcePath) === key).map((m) => m.name);
@@ -12227,14 +12957,7 @@ var init_method_realization = __esm({
         { code: "UNREALIZED_METHOD", defaultSeverity: "warning", summary: "An L3 contract method has no anchor in its own source file (the method's sourcePath, else the implementation's) at the required conformance tier" }
       ],
       check(ctx) {
-        const lookups = /* @__PURE__ */ new Map();
-        for (const facts of ctx.codeModel.files) {
-          lookups.set(pathKey(facts.path), {
-            declared: /* @__PURE__ */ new Set([...facts.declaredNames, ...facts.exportedNames]),
-            anchored: /* @__PURE__ */ new Set([...facts.declaredNames, ...facts.exportedNames, ...facts.anchoredNames]),
-            facts
-          });
-        }
+        const code = ctx.codeIndex();
         for (const impl of ctx.implementations) {
           const contract = ctx.interfaceMap.get(impl.contract);
           if (!contract) continue;
@@ -12249,11 +12972,11 @@ var init_method_realization = __esm({
             if (tier === "off") continue;
             const file = methodSourceFile(methodImpl ?? {}, impl.sourcePath);
             if (!file) continue;
-            const lookup = lookups.get(pathKey(file));
-            if (!lookup || lookup.facts.status !== "analyzed") continue;
+            const facts = code.factsAt(file);
+            if (!facts || facts.status !== "analyzed") continue;
             const symbol = methodImpl?.symbol ?? method.name;
-            const inDeclared = lookup.declared.has(symbol);
-            const inAnchored = inDeclared || lookup.anchored.has(symbol);
+            const inDeclared = code.declarationsAt(file).has(symbol);
+            const inAnchored = inDeclared || code.anchorsAt(file).has(symbol);
             const realized = tier === "declared" ? inDeclared : inAnchored;
             if (realized) continue;
             const label = methodImpl?.symbol ? `"${method.name}" (symbol "${symbol}")` : `"${method.name}"`;
@@ -12261,7 +12984,7 @@ var init_method_realization = __esm({
             ctx.addIssue(
               "warning",
               "UNREALIZED_METHOD",
-              `Method ${label} of contract "${impl.contract}" is not realized in "${file}" at the "${tier}" tier (analysis grade: ${lookup.facts.analysisGrade}).${weakHint}`,
+              `Method ${label} of contract "${impl.contract}" is not realized in "${file}" at the "${tier}" tier (analysis grade: ${facts.analysisGrade}).${weakHint}`,
               impl.id,
               draft
             );
@@ -12285,10 +13008,7 @@ var init_finding_realization = __esm({
         { code: "UNREALIZED_FINDING", defaultSeverity: "warning", summary: "A finding code a contract method declares appears in the method's source file neither as a string literal nor as a property-access name (below exact grade, any identifier counts)" }
       ],
       check(ctx) {
-        const lookups = /* @__PURE__ */ new Map();
-        for (const facts of ctx.codeModel.files) {
-          lookups.set(pathKey(facts.path), { findingAnchors: new Set(facts.anchoredNames), facts });
-        }
+        const code = ctx.codeIndex();
         for (const impl of ctx.implementations) {
           const contract = ctx.interfaceMap.get(impl.contract);
           if (!contract) continue;
@@ -12304,14 +13024,15 @@ var init_finding_realization = __esm({
             if (tier === "off") continue;
             const file = methodSourceFile(methodImpl ?? {}, impl.sourcePath);
             if (!file) continue;
-            const lookup = lookups.get(pathKey(file));
-            if (!lookup || lookup.facts.status !== "analyzed") continue;
+            const facts = code.factsAt(file);
+            if (!facts || facts.status !== "analyzed") continue;
+            const findingAnchors = code.findingAnchorsAt(file);
             for (const finding of method.findings) {
-              if (lookup.findingAnchors.has(finding.code)) continue;
+              if (findingAnchors.has(finding.code)) continue;
               ctx.addIssue(
                 "warning",
                 "UNREALIZED_FINDING",
-                `Method "${method.name}" of contract "${impl.contract}" declares finding "${finding.code}", but "${file}" has no string literal or property-access name "${finding.code}" (analysis grade: ${lookup.facts.analysisGrade}) \u2014 report the finding under its declared code, or remove the declaration.`,
+                `Method "${method.name}" of contract "${impl.contract}" declares finding "${finding.code}", but "${file}" has no string literal or property-access name "${finding.code}" (analysis grade: ${facts.analysisGrade}) \u2014 report the finding under its declared code, or remove the declaration.`,
                 impl.id,
                 draft
               );
@@ -12343,68 +13064,58 @@ function closedCallees(facts, fn) {
   }
   return closed;
 }
-var callConformanceRule;
-var init_call_conformance = __esm({
-  "src/core/rules/conformance/call-conformance.ts"() {
-    "use strict";
-    init_models();
-    callConformanceRule = {
-      name: "call-conformance",
-      description: "Code\u2194spec Level 3 (opener): every narrative `call` step of an exactly-analyzed method must be realized as a call in the realized function, read from the method's own source file (its sourcePath, else the implementation's) \u2014 the target method's contract name or its per-method symbol override must appear among the function's callees, closed transitively over same-file named helpers. Set membership only: order, arguments, and conditions are deliberately unverified, and dispatch steps (runtime-table routed) are skipped. Respects the conformance dial (off skips) and fires only at exact analysis grade \u2014 weaker grades never guess.",
-      codes: [
-        { code: "CALL_STEP_UNREALIZED", defaultSeverity: "warning", summary: "Narrative call step whose target method name (or symbol) never appears among the realized function's callees in the method's source file (exact grade, set membership)" }
-      ],
-      check(ctx) {
-        const factsByPath = /* @__PURE__ */ new Map();
-        for (const f of ctx.codeModel.files) factsByPath.set(pathKey(f.path), f);
-        for (const impl of ctx.implementations) {
-          const contract = ctx.interfaceMap.get(impl.contract);
-          if (!contract) continue;
-          const component = ctx.componentMap.get(contract.component);
-          if (!component) continue;
-          if (ctx.isInChainedSubproject(component.subsystem)) continue;
-          const specTier = impl.conformance ?? defaultConformanceTier(component);
-          const isDraftCtx = ctx.isImplementationDraft(impl);
-          for (const implMethod of impl.methods) {
-            const tier = implMethod.conformance ?? specTier;
-            if (tier === "off") continue;
-            if (!implMethod.narrative.length) continue;
-            const file = methodSourceFile(implMethod, impl.sourcePath);
-            if (!file) continue;
-            const facts = factsByPath.get(pathKey(file));
-            if (!facts || facts.status !== "analyzed" || facts.analysisGrade !== "exact") continue;
-            const fnSymbol = implMethod.symbol ?? implMethod.name;
-            const callees = closedCallees(facts, fnSymbol);
-            if (!callees) continue;
-            const missing = [];
-            for (const step of implMethod.narrative) {
-              if (step.type !== "call" || !step.targetComponent || !step.targetMethod) continue;
-              if (!ctx.componentMap.has(step.targetComponent)) continue;
-              const accepted = /* @__PURE__ */ new Set([step.targetMethod]);
-              for (const targetIntf of ctx.interfacesByComponent.get(step.targetComponent) ?? []) {
-                for (const targetImpl of ctx.implementationsByContract.get(targetIntf.id) ?? []) {
-                  const targetMethod = targetImpl.methods.find((m) => m.name === step.targetMethod);
-                  if (targetMethod?.symbol) accepted.add(targetMethod.symbol);
-                }
+var callConformanceRule;
+var init_call_conformance = __esm({
+  "src/core/rules/conformance/call-conformance.ts"() {
+    "use strict";
+    init_models();
+    callConformanceRule = {
+      name: "call-conformance",
+      description: "Code\u2194spec Level 3 (opener): every narrative `call` step of an exactly-analyzed method must be realized as a call in the realized function, read from the method's own source file (its sourcePath, else the implementation's) \u2014 the target method's contract name or its per-method symbol override must appear among the function's callees, closed transitively over same-file named helpers. Set membership only: order, arguments, and conditions are deliberately unverified, and dispatch steps (runtime-table routed) are skipped. Respects the conformance dial (off skips) and fires only at exact analysis grade \u2014 weaker grades never guess.",
+      codes: [
+        { code: "CALL_STEP_UNREALIZED", defaultSeverity: "warning", summary: "Narrative call step whose target method name (or symbol) never appears among the realized function's callees in the method's source file (exact grade, set membership)" }
+      ],
+      check(ctx) {
+        const code = ctx.codeIndex();
+        for (const entry of ctx.implementationMethods()) {
+          const { implementation: impl, method: implMethod, component, sourceFile: file } = entry;
+          const tier = implMethod.conformance ?? impl.conformance ?? defaultConformanceTier(component);
+          if (tier === "off") continue;
+          if (!implMethod.narrative.length) continue;
+          if (!file) continue;
+          const facts = code.factsAt(file);
+          if (!facts || facts.status !== "analyzed" || facts.analysisGrade !== "exact") continue;
+          const fnSymbol = implMethod.symbol ?? implMethod.name;
+          const callees = closedCallees(facts, fnSymbol);
+          if (!callees) continue;
+          const missing = [];
+          for (const step of implMethod.narrative) {
+            if (step.type !== "call" || !step.targetComponent || !step.targetMethod) continue;
+            if (!ctx.componentMap.has(step.targetComponent)) continue;
+            const accepted = /* @__PURE__ */ new Set([step.targetMethod]);
+            for (const targetIntf of ctx.interfacesByComponent.get(step.targetComponent) ?? []) {
+              for (const targetImpl of ctx.implementationsByContract.get(targetIntf.id) ?? []) {
+                const targetMethod = targetImpl.methods.find((m) => m.name === step.targetMethod);
+                if (targetMethod?.symbol) accepted.add(targetMethod.symbol);
               }
-              if (accepted.has(fnSymbol)) continue;
-              if ([...accepted].some((name) => callees.has(name))) continue;
-              missing.push({
-                step: step.stepNumber,
-                target: `${step.targetComponent}.${step.targetMethod}`,
-                accepted: [...accepted]
-              });
             }
-            if (missing.length === 0) continue;
-            const detail = missing.map((m) => `step ${m.step} \u2192 ${m.target} (looked for ${m.accepted.map((a) => `"${a}"`).join(" / ")})`).join("; ");
-            ctx.addIssue(
-              "warning",
-              "CALL_STEP_UNREALIZED",
-              `Method "${implMethod.name}" in implementation "${impl.id}": ${missing.length} narrative call step(s) are not realized as calls of the function "${fnSymbol}" in "${file}" \u2014 ${detail}. Callees are matched by name, closed over same-file helpers (exact grade, set membership \u2014 order and arguments are not checked). Realize the calls, fix the narrative, or map code names via per-method symbols on the targets.`,
-              impl.id,
-              isDraftCtx
-            );
+            if (accepted.has(fnSymbol)) continue;
+            if ([...accepted].some((name) => callees.has(name))) continue;
+            missing.push({
+              step: step.stepNumber,
+              target: `${step.targetComponent}.${step.targetMethod}`,
+              accepted: [...accepted]
+            });
           }
+          if (missing.length === 0) continue;
+          const detail = missing.map((m) => `step ${m.step} \u2192 ${m.target} (looked for ${m.accepted.map((a) => `"${a}"`).join(" / ")})`).join("; ");
+          ctx.addIssue(
+            "warning",
+            "CALL_STEP_UNREALIZED",
+            `Method "${implMethod.name}" in implementation "${impl.id}": ${missing.length} narrative call step(s) are not realized as calls of the function "${fnSymbol}" in "${file}" \u2014 ${detail}. Callees are matched by name, closed over same-file helpers (exact grade, set membership \u2014 order and arguments are not checked). Realize the calls, fix the narrative, or map code names via per-method symbols on the targets.`,
+            impl.id,
+            entry.draftContext
+          );
         }
       }
     };
@@ -12425,6 +13136,7 @@ var init_hidden_state = __esm({
         { code: "HIDDEN_STATE", defaultSeverity: "warning", summary: "Module-scope mutable binding in a file mapped only to stateless logic (Orchestrators) \u2014 held state hiding outside a Store, Supervisor or Actor" }
       ],
       check(ctx) {
+        const code = ctx.codeIndex();
         const byPath = /* @__PURE__ */ new Map();
         for (const impl of ctx.implementations) {
           const contract = ctx.interfaceMap.get(impl.contract);
@@ -12446,11 +13158,11 @@ var init_hidden_state = __esm({
             byPath.set(key, list);
           }
         }
-        for (const facts of ctx.codeModel.files) {
-          if (facts.status !== "analyzed" || facts.analysisGrade !== "exact") continue;
+        for (const path27 of code.exactPaths) {
+          const facts = code.factsAt(path27);
           const bindings = facts.topLevelMutableBindings ?? [];
           if (bindings.length === 0) continue;
-          const mapped = byPath.get(pathKey(facts.path)) ?? [];
+          const mapped = byPath.get(path27) ?? [];
           if (mapped.length === 0) continue;
           if (!mapped.every((m) => isStatelessLogic(m.component))) continue;
           const anchor = [...mapped].sort((a, b) => a.impl.id.localeCompare(b.impl.id))[0];
@@ -12482,54 +13194,21 @@ var init_dependency_conformance = __esm({
         { code: "UNREALIZED_DEPENDENCY", defaultSeverity: "warning", summary: "A declared dependsOn/owns edge between components in different files is realized by no import between any of their files" }
       ],
       check(ctx) {
-        const factsByPath = new Map(ctx.codeModel.files.map((f) => [pathKey(f.path), f]));
-        const nodes = /* @__PURE__ */ new Map();
-        const filesByComponent = /* @__PURE__ */ new Map();
-        const implsByComponent = /* @__PURE__ */ new Map();
-        for (const impl of ctx.implementations) {
-          const contract = ctx.interfaceMap.get(impl.contract);
-          if (!contract) continue;
-          const component = ctx.componentMap.get(contract.component);
-          if (!component) continue;
-          if (ctx.isInChainedSubproject(component.subsystem)) continue;
-          let mapped = false;
-          for (const file of implementationSourceFiles(impl)) {
-            const p = pathKey(file);
-            const facts = factsByPath.get(p);
-            if (!facts || facts.status !== "analyzed" || facts.analysisGrade !== "exact") continue;
-            let node = nodes.get(p);
-            if (!node) {
-              node = { path: p, components: [], anchorImplId: impl.id, imports: facts.imports, reexports: facts.reexports, draft: false };
-              nodes.set(p, node);
-            }
-            if (!node.components.some((c) => c.id === component.id)) node.components.push(component);
-            node.draft = node.draft || ctx.isImplementationDraft(impl);
-            if (!filesByComponent.has(component.id)) filesByComponent.set(component.id, /* @__PURE__ */ new Set());
-            filesByComponent.get(component.id).add(p);
-            mapped = true;
-          }
-          if (mapped) {
-            if (!implsByComponent.has(component.id)) implsByComponent.set(component.id, []);
-            implsByComponent.get(component.id).push(impl);
-          }
-        }
-        const mappedPaths = new Set(nodes.keys());
-        const edges = /* @__PURE__ */ new Map();
-        const realizationEdges = /* @__PURE__ */ new Map();
-        for (const node of nodes.values()) {
-          const targets = /* @__PURE__ */ new Set();
-          for (const spec of node.imports) {
-            const resolved = resolveImport(node.path, spec, mappedPaths);
-            if (resolved && resolved !== node.path) targets.add(resolved);
-          }
-          edges.set(node.path, targets);
-          const realized = new Set(targets);
-          for (const spec of node.reexports) {
-            const resolved = resolveImport(node.path, spec, mappedPaths);
-            if (resolved && resolved !== node.path) realized.add(resolved);
-          }
-          realizationEdges.set(node.path, realized);
-        }
+        const code = ctx.codeIndex();
+        const realization = ctx.realizationIndex();
+        const isExact = (p) => code.exactPaths.has(p);
+        const mappedPaths = new Set(realization.paths.filter(isExact));
+        const graph = ctx.importGraph(mappedPaths);
+        const exactFiles = /* @__PURE__ */ new Map();
+        const filesOf = (compId) => {
+          let files = exactFiles.get(compId);
+          if (!files) {
+            files = realization.filesOf(compId).filter(isExact);
+            exactFiles.set(compId, files);
+          }
+          return files;
+        };
+        const mappedImplsOf = (compId) => realization.implementationsOf(compId).filter((impl) => implementationSourceFiles(impl).some((f) => isExact(pathKey(f))));
         const dependsOrOwns = (from, toId) => from.dependsOn.includes(toId) || (from.owns ?? []).includes(toId);
         const ownerOf = /* @__PURE__ */ new Map();
         for (const c of ctx.components) {
@@ -12540,9 +13219,9 @@ var init_dependency_conformance = __esm({
           if (!published || published.size === 0) return false;
           return from.dependsOn.some((d) => published.has(d));
         };
-        const edgeJustified = (fromNode, toNode) => {
-          for (const cf of fromNode.components) {
-            for (const cg of toNode.components) {
+        const edgeJustified = (from, to) => {
+          for (const cf of from) {
+            for (const cg of to) {
               if (cf.id === cg.id) return true;
               if (dependsOrOwns(cf, cg.id)) return true;
               if (cf.subsystem === cg.subsystem && dependsOrOwns(cg, cf.id) && (cg.componentType === "Portal" || cg.componentType === "Observer")) return true;
@@ -12556,60 +13235,35 @@ var init_dependency_conformance = __esm({
           }
           return false;
         };
-        for (const [fromPath, targets] of edges) {
-          const fromNode = nodes.get(fromPath);
-          for (const toPath of targets) {
-            const toNode = nodes.get(toPath);
-            if (edgeJustified(fromNode, toNode)) continue;
+        const draftAt = (path27) => realization.implementationsAt(path27).some((impl) => ctx.isImplementationDraft(impl));
+        for (const fromPath of mappedPaths) {
+          const fromComponents = realization.componentsAt(fromPath);
+          for (const toPath of graph.importsOf(fromPath)) {
+            const toComponents = realization.componentsAt(toPath);
+            if (edgeJustified(fromComponents, toComponents)) continue;
             ctx.addIssue(
               "warning",
               "UNDECLARED_DEPENDENCY",
-              `"${fromPath}" (realizing ${fromNode.components.map((c) => c.id).join(", ")}) imports "${toPath}" (realizing ${toNode.components.map((c) => c.id).join(", ")}) but no declared dependsOn/owns edge justifies it \u2014 declare the collaboration on the component that actually uses it, or route the cross-subsystem hop through the target's published surface.`,
-              fromNode.anchorImplId,
-              fromNode.draft || toNode.draft
+              `"${fromPath}" (realizing ${fromComponents.map((c) => c.id).join(", ")}) imports "${toPath}" (realizing ${toComponents.map((c) => c.id).join(", ")}) but no declared dependsOn/owns edge justifies it \u2014 declare the collaboration on the component that actually uses it, or route the cross-subsystem hop through the target's published surface.`,
+              realization.implementationsAt(fromPath)[0]?.id,
+              draftAt(fromPath) || draftAt(toPath)
             );
           }
         }
-        const hasImportBetween = (fromFiles, toFiles, allowReverse) => {
-          for (const f of fromFiles) {
-            const targets = realizationEdges.get(f);
-            if (!targets) continue;
-            for (const t of toFiles) if (targets.has(t)) return true;
-          }
-          if (allowReverse) {
-            for (const t of toFiles) {
-              const reverse = realizationEdges.get(t);
-              if (!reverse) continue;
-              for (const f of fromFiles) if (reverse.has(f)) return true;
-            }
-          }
-          return false;
-        };
         for (const component of ctx.components) {
-          const fromFiles = filesByComponent.get(component.id);
-          if (!fromFiles) continue;
+          const fromFiles = filesOf(component.id);
+          if (fromFiles.length === 0) continue;
           const isMountingDeclarer = component.componentType === "Portal" || component.componentType === "Observer";
           const declaredTargets = [.../* @__PURE__ */ new Set([...component.dependsOn, ...component.owns ?? []])];
           for (const targetId of declaredTargets) {
             const target = ctx.componentMap.get(targetId);
             if (!target) continue;
-            if (component.subsystem !== target.subsystem) {
-              const subsystemFiles = /* @__PURE__ */ new Set();
-              for (const node of nodes.values()) {
-                if (node.components.some((c) => c.subsystem === target.subsystem)) subsystemFiles.add(node.path);
-              }
-              if (subsystemFiles.size === 0) continue;
-              for (const f of fromFiles) subsystemFiles.delete(f);
-              if (subsystemFiles.size === 0) continue;
-              if (hasImportBetween(fromFiles, subsystemFiles, isMountingDeclarer)) continue;
-            } else {
-              const toFiles = filesByComponent.get(targetId);
-              if (!toFiles) continue;
-              if ([...fromFiles].some((f) => toFiles.has(f))) continue;
-              if (hasImportBetween(fromFiles, toFiles, isMountingDeclarer)) continue;
-            }
-            const impls = implsByComponent.get(component.id) ?? [];
-            const anchor = impls[0];
+            const crossSubsystem = component.subsystem !== target.subsystem;
+            const toFiles = crossSubsystem ? realization.filesIn(target.subsystem).filter((p) => isExact(p) && !fromFiles.includes(p)) : filesOf(targetId);
+            if (toFiles.length === 0) continue;
+            if (fromFiles.some((f) => toFiles.includes(f))) continue;
+            if (graph.connects(fromFiles, toFiles, isMountingDeclarer)) continue;
+            const impls = mappedImplsOf(component.id);
             const declaredDependsOn = component.dependsOn.includes(targetId);
             const declaredOwns = (component.owns ?? []).includes(targetId);
             const relation = declaredDependsOn && declaredOwns ? "dependsOn and owns" : declaredDependsOn ? "dependsOn" : "owns";
@@ -12617,8 +13271,8 @@ var init_dependency_conformance = __esm({
             ctx.addIssue(
               "warning",
               "UNREALIZED_DEPENDENCY",
-              `Component "${component.id}" declares ${relation} "${targetId}", but no runtime import connects their source files (${[...fromFiles].join(", ")} \u219B ${target.subsystem !== component.subsystem ? `subsystem ${target.subsystem}` : [...filesByComponent.get(targetId) ?? []].join(", ")}) \u2014 either the collaboration is wired indirectly (DI) or the declared edge is stale.`,
-              anchor?.id ?? component.id,
+              `Component "${component.id}" declares ${relation} "${targetId}", but no runtime import connects their source files (${fromFiles.join(", ")} \u219B ${crossSubsystem ? `subsystem ${target.subsystem}` : filesOf(targetId).join(", ")}) \u2014 either the collaboration is wired indirectly (DI) or the declared edge is stale.`,
+              impls[0]?.id ?? component.id,
               draft
             );
           }
@@ -12628,124 +13282,171 @@ var init_dependency_conformance = __esm({
   }
 });
 
-// src/core/rules/conformance/integration-conformance.ts
-var integrationConformanceRule;
-var init_integration_conformance = __esm({
-  "src/core/rules/conformance/integration-conformance.ts"() {
+// src/core/rules/conformance/integration-sim-declaration.ts
+var integrationSimDeclarationRule;
+var init_integration_sim_declaration = __esm({
+  "src/core/rules/conformance/integration-sim-declaration.ts"() {
     "use strict";
-    init_models();
-    integrationConformanceRule = {
-      name: "integration-conformance",
-      description: "A component cannot honestly claim completeness until a committed integration harness wires it to its REAL dependencies (L4 simPath). Statically checked: the harness file exists inside the project root, and its import graph \u2014 closed transitively over the analyzed module set, exact grade only \u2014 reaches at least one of the component's own source modules (its implementation's or a method's) and at least one source module of each direct dependsOn/owns component (technology-boundary dependencies exempt: their fakes are sanctioned). Execution is CI's job \u2014 these findings prove wiring, never that the sim passes. MISSING_INTEGRATION_SIM activates per subsystem once its first simPath is declared.",
+    integrationSimDeclarationRule = {
+      name: "integration-sim-declaration",
+      description: "Once a subsystem has adopted integration sims (its first declared L4 simPath), every OTHER complete, non-leaf implementation of that subsystem must declare one too: its unit suite proves contract shape against mocks, not that the wired components run together. A leaf component's unit suite IS its sim, and a subsystem that has adopted nothing is never flooded.",
       codes: [
-        { code: "MISSING_INTEGRATION_SIM", defaultSeverity: "warning", summary: "Complete non-leaf implementation in a sim-adopting subsystem declares no simPath" },
-        { code: "SIM_FILE_MISSING", defaultSeverity: "warning", summary: "Declared simPath resolves to no file inside the project root" },
-        { code: "UNWIRED_INTEGRATION_SIM", defaultSeverity: "warning", summary: "Sim file does not import the real modules it claims to wire" },
-        { code: "SIM_PATH_UNCOVERED", defaultSeverity: "warning", summary: "A narrative path has no sim:<component>.<method>[:<label>] anchor in the component's coverage-opted harness" }
+        { code: "MISSING_INTEGRATION_SIM", defaultSeverity: "warning", summary: "Complete non-leaf implementation in a sim-adopting subsystem declares no simPath" }
       ],
       check(ctx) {
-        const factsByPath = new Map(ctx.codeModel.files.map((f) => [pathKey(f.path), f]));
-        const allPaths = new Set(factsByPath.keys());
-        const filesByComponent = /* @__PURE__ */ new Map();
-        const filesBySubsystem = /* @__PURE__ */ new Map();
-        const implsByComponent = /* @__PURE__ */ new Map();
         const adopted = /* @__PURE__ */ new Set();
-        const exists = (p) => {
-          const status = factsByPath.get(p)?.status;
-          return status === "analyzed" || status === "unreadable";
-        };
         for (const impl of ctx.implementations) {
+          if (!impl.simPath) continue;
           const contract = ctx.interfaceMap.get(impl.contract);
           const comp = contract ? ctx.componentMap.get(contract.component) : void 0;
           if (!comp || ctx.isInChainedSubproject(comp.subsystem)) continue;
-          if (!implsByComponent.has(comp.id)) implsByComponent.set(comp.id, []);
-          implsByComponent.get(comp.id).push(impl);
-          for (const file of implementationSourceFiles(impl)) {
-            const p = pathKey(file);
-            if (!exists(p)) continue;
-            if (!filesByComponent.has(comp.id)) filesByComponent.set(comp.id, /* @__PURE__ */ new Set());
-            filesByComponent.get(comp.id).add(p);
-            if (!filesBySubsystem.has(comp.subsystem)) filesBySubsystem.set(comp.subsystem, /* @__PURE__ */ new Set());
-            filesBySubsystem.get(comp.subsystem).add(p);
-          }
-          if (impl.simPath) adopted.add(comp.subsystem);
-        }
-        const isTechBoundary = (compId) => (implsByComponent.get(compId) ?? []).some((i) => (i.technologies ?? []).length > 0);
-        const reachFrom = (start) => {
-          const seen = /* @__PURE__ */ new Set([start]);
-          const stack = [start];
-          while (stack.length) {
-            const from = stack.pop();
-            const facts = factsByPath.get(from);
-            if (!facts || facts.status !== "analyzed") continue;
-            for (const spec of [...facts.imports, ...facts.reexports]) {
-              const to = resolveImport(from, spec, allPaths);
-              if (to && !seen.has(to)) {
-                seen.add(to);
-                stack.push(to);
-              }
-            }
-          }
-          return seen;
-        };
+          adopted.add(comp.subsystem);
+        }
         for (const impl of ctx.implementations) {
+          if (impl.simPath) continue;
           const contract = ctx.interfaceMap.get(impl.contract);
           const comp = contract ? ctx.componentMap.get(contract.component) : void 0;
           if (!comp) continue;
           if (ctx.isInChainedSubproject(comp.subsystem)) continue;
+          if (!adopted.has(comp.subsystem)) continue;
+          if (ctx.isImplementationDraft(impl)) continue;
           const deps = [.../* @__PURE__ */ new Set([...comp.dependsOn, ...comp.owns])].filter((d) => ctx.componentMap.has(d));
-          if (!impl.simPath) {
-            if (!adopted.has(comp.subsystem)) continue;
-            if (ctx.isImplementationDraft(impl)) continue;
-            if (deps.length === 0) continue;
-            ctx.addIssue(
-              "warning",
-              "MISSING_INTEGRATION_SIM",
-              `Implementation "${impl.id}" (component "${comp.id}") is complete with ${deps.length} declared dependenc${deps.length === 1 ? "y" : "ies"}, its subsystem "${comp.subsystem}" has adopted integration sims, but it declares no simPath \u2014 its unit suite proves contract shape against mocks, not that the wired components run together. Declare the committed harness that constructs it with its REAL dependencies (N:1 sharing allowed), or lint.allow with the reason.`,
-              impl.id
-            );
-            continue;
-          }
+          if (deps.length === 0) continue;
+          ctx.addIssue(
+            "warning",
+            "MISSING_INTEGRATION_SIM",
+            `Implementation "${impl.id}" (component "${comp.id}") is complete with ${deps.length} declared dependenc${deps.length === 1 ? "y" : "ies"}, its subsystem "${comp.subsystem}" has adopted integration sims, but it declares no simPath \u2014 its unit suite proves contract shape against mocks, not that the wired components run together. Declare the committed harness that constructs it with its REAL dependencies (N:1 sharing allowed), or lint.allow with the reason.`,
+            impl.id
+          );
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/conformance/integration-sim-file.ts
+var integrationSimFileRule;
+var init_integration_sim_file = __esm({
+  "src/core/rules/conformance/integration-sim-file.ts"() {
+    "use strict";
+    init_models();
+    integrationSimFileRule = {
+      name: "integration-sim-file",
+      description: "A declared L4 simPath must resolve to a readable, committed file inside the project root \u2014 the integration harness is a re-runnable file, not a claim. Execution stays CI's job.",
+      codes: [
+        { code: "SIM_FILE_MISSING", defaultSeverity: "warning", summary: "Declared simPath resolves to no file inside the project root" }
+      ],
+      check(ctx) {
+        const code = ctx.codeIndex();
+        for (const impl of ctx.implementations) {
+          if (!impl.simPath) continue;
+          const contract = ctx.interfaceMap.get(impl.contract);
+          const comp = contract ? ctx.componentMap.get(contract.component) : void 0;
+          if (!comp) continue;
+          if (ctx.isInChainedSubproject(comp.subsystem)) continue;
+          const facts = code.factsAt(pathKey(impl.simPath));
+          if (facts && facts.status === "analyzed") continue;
+          const why = !facts || facts.status === "missing" ? "resolves to no file" : facts.status === "escaped" ? "escapes the project root \u2014 sims are project-relative, committed files" : "is not readable as source text";
+          ctx.addIssue(
+            "warning",
+            "SIM_FILE_MISSING",
+            `Implementation "${impl.id}" declares simPath "${impl.simPath}", which ${why}. The integration harness must be a committed, re-runnable file inside the project.`,
+            impl.id,
+            ctx.isImplementationDraft(impl)
+          );
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/conformance/integration-sim-wiring.ts
+var integrationSimWiringRule;
+var init_integration_sim_wiring = __esm({
+  "src/core/rules/conformance/integration-sim-wiring.ts"() {
+    "use strict";
+    init_models();
+    integrationSimWiringRule = {
+      name: "integration-sim-wiring",
+      description: "A committed integration harness's import graph \u2014 closed transitively over the analyzed module set, exact grade only \u2014 must reach at least one of the component's own source modules (its implementation's or a method's) and at least one source module of each direct dependsOn/owns component (technology-boundary dependencies exempt: their contract-faithful fakes are sanctioned). Execution is CI's job \u2014 this proves wiring, never that the sim passes.",
+      codes: [
+        { code: "UNWIRED_INTEGRATION_SIM", defaultSeverity: "warning", summary: "Sim file does not import the real modules it claims to wire" }
+      ],
+      check(ctx) {
+        const code = ctx.codeIndex();
+        const realization = ctx.realizationIndex();
+        const graph = ctx.importGraph();
+        const exists = (p) => {
+          const status = code.factsAt(p)?.status;
+          return status === "analyzed" || status === "unreadable";
+        };
+        const modulesOf = (compId) => realization.filesOf(compId).filter(exists);
+        const modulesIn = (subsystemId) => realization.filesIn(subsystemId).filter(exists);
+        const isTechBoundary = (compId) => realization.implementationsOf(compId).some((i) => (i.technologies ?? []).length > 0);
+        for (const impl of ctx.implementations) {
+          if (!impl.simPath) continue;
+          const contract = ctx.interfaceMap.get(impl.contract);
+          const comp = contract ? ctx.componentMap.get(contract.component) : void 0;
+          if (!comp) continue;
+          if (ctx.isInChainedSubproject(comp.subsystem)) continue;
           const simPath = pathKey(impl.simPath);
-          const facts = factsByPath.get(simPath);
-          const isDraftCtx = ctx.isImplementationDraft(impl);
-          if (!facts || facts.status === "missing" || facts.status === "escaped" || facts.status === "unreadable") {
-            const why = !facts || facts.status === "missing" ? "resolves to no file" : facts.status === "escaped" ? "escapes the project root \u2014 sims are project-relative, committed files" : "is not readable as source text";
-            ctx.addIssue(
-              "warning",
-              "SIM_FILE_MISSING",
-              `Implementation "${impl.id}" declares simPath "${impl.simPath}", which ${why}. The integration harness must be a committed, re-runnable file inside the project.`,
-              impl.id,
-              isDraftCtx
-            );
-            continue;
-          }
+          const facts = code.factsAt(simPath);
+          if (!facts || facts.status !== "analyzed") continue;
           if (facts.analysisGrade !== "exact") continue;
-          const reach = reachFrom(simPath);
-          const ownFiles = filesByComponent.get(comp.id) ?? /* @__PURE__ */ new Set();
+          const deps = [.../* @__PURE__ */ new Set([...comp.dependsOn, ...comp.owns])].filter((d) => ctx.componentMap.has(d));
+          const reach = graph.reachFrom(simPath);
+          const ownFiles = modulesOf(comp.id);
           const missing = [];
-          if (ownFiles.size > 0 && ![...ownFiles].some((f) => reach.has(f))) {
-            missing.push(`the component's own module (${[...ownFiles].join(" | ")})`);
+          if (ownFiles.length > 0 && !ownFiles.some((f) => reach.has(f))) {
+            missing.push(`the component's own module (${ownFiles.join(" | ")})`);
           }
           for (const dep of deps) {
             if (isTechBoundary(dep)) continue;
             const depComp = ctx.componentMap.get(dep);
-            const depFiles = depComp.subsystem !== comp.subsystem ? filesBySubsystem.get(depComp.subsystem) : filesByComponent.get(dep);
-            if (!depFiles || depFiles.size === 0) continue;
-            if (![...depFiles].some((f) => reach.has(f))) {
-              const label = depComp.subsystem !== comp.subsystem ? `"${dep}" (any module of subsystem "${depComp.subsystem}")` : `"${dep}" (${[...depFiles].join(" | ")})`;
+            const depFiles = depComp.subsystem !== comp.subsystem ? modulesIn(depComp.subsystem) : modulesOf(dep);
+            if (depFiles.length === 0) continue;
+            if (!depFiles.some((f) => reach.has(f))) {
+              const label = depComp.subsystem !== comp.subsystem ? `"${dep}" (any module of subsystem "${depComp.subsystem}")` : `"${dep}" (${depFiles.join(" | ")})`;
               missing.push(label);
             }
           }
-          if (missing.length) {
-            ctx.addIssue(
-              "warning",
-              "UNWIRED_INTEGRATION_SIM",
-              `Sim "${impl.simPath}" of implementation "${impl.id}" does not reach ${missing.join(", nor ")} through its import graph (closed over the analyzed modules, exact grade) \u2014 the harness is not wiring the real implementations it claims to exercise. Import the real modules (technology-boundary adapters may stay contract-faithfully faked), or fix the simPath.`,
-              impl.id,
-              isDraftCtx
-            );
-          }
+          if (missing.length === 0) continue;
+          ctx.addIssue(
+            "warning",
+            "UNWIRED_INTEGRATION_SIM",
+            `Sim "${impl.simPath}" of implementation "${impl.id}" does not reach ${missing.join(", nor ")} through its import graph (closed over the analyzed modules, exact grade) \u2014 the harness is not wiring the real implementations it claims to exercise. Import the real modules (technology-boundary adapters may stay contract-faithfully faked), or fix the simPath.`,
+            impl.id,
+            ctx.isImplementationDraft(impl)
+          );
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/conformance/integration-sim-coverage.ts
+var integrationSimCoverageRule;
+var init_integration_sim_coverage = __esm({
+  "src/core/rules/conformance/integration-sim-coverage.ts"() {
+    "use strict";
+    init_models();
+    integrationSimCoverageRule = {
+      name: "integration-sim-coverage",
+      description: "Once a committed integration harness carries sim:<component-id>. anchors, that component claims path coverage: every narrated method's happy path and every labeled throw step needs its exact sim:<component>.<method>[:<label>] string-literal anchor. Anchors prove the path is NAMED \u2014 assertion quality and execution stay CI's job.",
+      codes: [
+        { code: "SIM_PATH_UNCOVERED", defaultSeverity: "warning", summary: "A narrative path has no sim:<component>.<method>[:<label>] anchor in the component's coverage-opted harness" }
+      ],
+      check(ctx) {
+        const code = ctx.codeIndex();
+        for (const impl of ctx.implementations) {
+          if (!impl.simPath) continue;
+          const contract = ctx.interfaceMap.get(impl.contract);
+          const comp = contract ? ctx.componentMap.get(contract.component) : void 0;
+          if (!comp) continue;
+          if (ctx.isInChainedSubproject(comp.subsystem)) continue;
+          const facts = code.factsAt(pathKey(impl.simPath));
+          if (!facts || facts.status !== "analyzed") continue;
+          if (facts.analysisGrade !== "exact") continue;
           const simAnchors = new Set(facts.anchoredNames.filter((a) => a.startsWith("sim:")));
           if (simAnchors.size === 0) continue;
           const compPrefix = `sim:${comp.id}.`;
@@ -12766,15 +13467,14 @@ var init_integration_conformance = __esm({
               }
             }
           }
-          if (uncovered.length) {
-            ctx.addIssue(
-              "warning",
-              "SIM_PATH_UNCOVERED",
-              `Sim "${impl.simPath}" declares path coverage for component "${comp.id}" (it carries sim: anchors) but does not name ${uncovered.join(", nor ")}. Drive the path and anchor it with the exact string literal, or drop the component's sim: anchors to withdraw the coverage claim. Unlabeled throw steps are not expected \u2014 a step's label is the path's identity. Anchors prove the path is NAMED; assertion quality and execution stay CI's job.`,
-              impl.id,
-              isDraftCtx
-            );
-          }
+          if (uncovered.length === 0) continue;
+          ctx.addIssue(
+            "warning",
+            "SIM_PATH_UNCOVERED",
+            `Sim "${impl.simPath}" declares path coverage for component "${comp.id}" (it carries sim: anchors) but does not name ${uncovered.join(", nor ")}. Drive the path and anchor it with the exact string literal, or drop the component's sim: anchors to withdraw the coverage claim. Unlabeled throw steps are not expected \u2014 a step's label is the path's identity. Anchors prove the path is NAMED; assertion quality and execution stay CI's job.`,
+            impl.id,
+            ctx.isImplementationDraft(impl)
+          );
         }
       }
     };
@@ -12884,10 +13584,10 @@ var init_coupling_health = __esm({
   }
 });
 
-// src/core/rules/heuristic/target-language.ts
-var LANGUAGE_MARKERS, UNSUPPORTED_FLOW, languageRule;
-var init_target_language = __esm({
-  "src/core/rules/heuristic/target-language.ts"() {
+// src/core/rules/heuristic/signature-language-builtins.ts
+var LANGUAGE_MARKERS, signatureLanguageBuiltinsRule;
+var init_signature_language_builtins = __esm({
+  "src/core/rules/heuristic/signature-language-builtins.ts"() {
     "use strict";
     init_models();
     LANGUAGE_MARKERS = {
@@ -12922,6 +13622,68 @@ var init_target_language = __esm({
       csharp: /* @__PURE__ */ new Set(["task"]),
       go: /* @__PURE__ */ new Set(["chan", "rune"])
     };
+    signatureLanguageBuiltinsRule = {
+      name: "signature-language-builtins",
+      description: "Contracts must speak the declared target language: builtin types that unambiguously belong to another language family are flagged in method signatures (e.g. `usize` in a TypeScript system, `Promise` in a Rust one). Set targetLanguage on the system (L0) or override per subsystem (L1).",
+      codes: [
+        { code: "LANGUAGE_FOREIGN_BUILTIN", defaultSeverity: "warning", summary: "Signature uses a builtin from a different language family" }
+      ],
+      check(ctx) {
+        const markersFor = (family) => {
+          const base = LANGUAGE_MARKERS[family];
+          const extra = ctx.ext.languages[family]?.foreignBuiltins;
+          if (!extra?.length) return base;
+          return /* @__PURE__ */ new Set([...base ?? [], ...extra.map((s) => s.toLowerCase())]);
+        };
+        const families = [.../* @__PURE__ */ new Set([...Object.keys(LANGUAGE_MARKERS), ...Object.keys(ctx.ext.languages)])];
+        const scans = [];
+        for (const intf of ctx.interfaces) {
+          const comp = ctx.componentMap.get(intf.component);
+          const lang = ctx.targetLanguageFor(comp?.subsystem);
+          if (!lang) continue;
+          const ownMarkers = markersFor(lang);
+          if (!ownMarkers || ownMarkers.size === 0) continue;
+          const draft = ctx.isComponentDraft(intf.component) || intf.status === "draft" || intf.status === "design";
+          for (const method of intf.methods) {
+            for (const ref of methodTypeRefs(method)) scans.push({ intf, method, ref, lang, ownMarkers, draft });
+          }
+        }
+        for (const scan of scans) {
+          const refLower = scan.ref.toLowerCase();
+          if (scan.ownMarkers.has(refLower)) continue;
+          const foreign = families.find((family) => family !== scan.lang && markersFor(family)?.has(refLower));
+          if (!foreign) continue;
+          ctx.addIssue(
+            "warning",
+            "LANGUAGE_FOREIGN_BUILTIN",
+            `Method "${scan.method.name}" on interface "${scan.intf.id}" uses "${scan.ref}", a ${foreign} builtin, but the target language here is ${scan.lang}. Use the ${scan.lang} equivalent so implementers generate idiomatic code.`,
+            scan.intf.id,
+            scan.draft
+          );
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/heuristic/narrative-language-constructs.ts
+function constructsOf(step) {
+  const constructs = [
+    step.type === "loop" ? step.loopKind ?? (step.over ? "forEach" : "while") : step.type
+  ];
+  if (step.detach) constructs.push("detach");
+  return constructs;
+}
+function constructLabel(construct) {
+  if (construct === "doWhile") return "a do-while loop";
+  if (construct === "forEach" || construct === "for" || construct === "while") return `a ${construct} loop`;
+  if (construct === "detach") return "a detached (fire-and-forget) call";
+  return `a ${construct} step`;
+}
+var UNSUPPORTED_FLOW, narrativeLanguageConstructsRule;
+var init_narrative_language_constructs = __esm({
+  "src/core/rules/heuristic/narrative-language-constructs.ts"() {
+    "use strict";
     UNSUPPORTED_FLOW = {
       rust: {
         try: "Rust models errors as values (Result + ?) \u2014 specify the guarded logic as explicit error branches, or note the Result mapping in the step description",
@@ -12941,53 +13703,18 @@ var init_target_language = __esm({
         doWhile: "Python has no do-while \u2014 prefer loopKind: while, or state the emulation (while True + break)"
       }
     };
-    languageRule = {
-      name: "target-language",
-      description: "Contracts must speak the declared target language: builtin types that unambiguously belong to another language family are flagged in method signatures, and narrative flow steps using constructs the language lacks (e.g. exceptions in Rust/Go, do-while in Python) are flagged too. Set targetLanguage on the system (L0) or override per subsystem (L1).",
+    narrativeLanguageConstructsRule = {
+      name: "narrative-language-constructs",
+      description: "Narratives must describe flows the declared target language can express: steps using constructs the language lacks (e.g. exceptions in Rust/Go, do-while in Python) are flagged with the idiomatic alternative. Set targetLanguage on the system (L0) or override per subsystem (L1).",
       codes: [
-        { code: "LANGUAGE_FOREIGN_BUILTIN", defaultSeverity: "warning", summary: "Signature uses a builtin from a different language family" },
         { code: "LANGUAGE_FOREIGN_FLOW", defaultSeverity: "warning", summary: "Narrative flow step uses a construct the target language does not have" }
       ],
       check(ctx) {
-        const markersFor = (family) => {
-          const base = LANGUAGE_MARKERS[family];
-          const extra = ctx.ext.languages[family]?.foreignBuiltins;
-          if (!extra?.length) return base;
-          return /* @__PURE__ */ new Set([...base ?? [], ...extra.map((s) => s.toLowerCase())]);
-        };
-        const families = /* @__PURE__ */ new Set([...Object.keys(LANGUAGE_MARKERS), ...Object.keys(ctx.ext.languages)]);
         const gapsFor = (lang) => ({
           ...UNSUPPORTED_FLOW[lang] ?? {},
           ...ctx.ext.languages[lang]?.unsupportedFlow ?? {}
         });
-        for (const intf of ctx.interfaces) {
-          const comp = ctx.componentMap.get(intf.component);
-          const lang = ctx.targetLanguageFor(comp?.subsystem);
-          if (!lang) continue;
-          const ownMarkers = markersFor(lang);
-          if (!ownMarkers || ownMarkers.size === 0) continue;
-          const isDraftCtx = ctx.isComponentDraft(intf.component) || intf.status === "draft" || intf.status === "design";
-          for (const m of intf.methods) {
-            const refs = methodTypeRefs(m);
-            for (const ref of refs) {
-              const refLower = ref.toLowerCase();
-              if (ownMarkers.has(refLower)) continue;
-              for (const family of families) {
-                if (family === lang) continue;
-                if (markersFor(family)?.has(refLower)) {
-                  ctx.addIssue(
-                    "warning",
-                    "LANGUAGE_FOREIGN_BUILTIN",
-                    `Method "${m.name}" on interface "${intf.id}" uses "${ref}", a ${family} builtin, but the target language here is ${lang}. Use the ${lang} equivalent so implementers generate idiomatic code.`,
-                    intf.id,
-                    isDraftCtx
-                  );
-                  break;
-                }
-              }
-            }
-          }
-        }
+        const scans = [];
         for (const impl of ctx.implementations) {
           const contract = ctx.interfaceMap.get(impl.contract);
           if (!contract) continue;
@@ -12996,26 +13723,22 @@ var init_target_language = __esm({
           if (!lang) continue;
           const gaps = gapsFor(lang);
           if (Object.keys(gaps).length === 0) continue;
-          const isDraftCtx = ctx.isImplementationDraft(impl);
-          for (const implMethod of impl.methods) {
-            for (const step of implMethod.narrative) {
-              const constructs = [
-                step.type === "loop" ? step.loopKind ?? (step.over ? "forEach" : "while") : step.type
-              ];
-              if (step.detach) constructs.push("detach");
-              for (const construct of constructs) {
-                const guidance = gaps[construct];
-                if (!guidance) continue;
-                const label = construct === "doWhile" ? "a do-while loop" : construct === "forEach" || construct === "for" || construct === "while" ? `a ${construct} loop` : construct === "detach" ? "a detached (fire-and-forget) call" : `a ${construct} step`;
-                ctx.addIssue(
-                  "warning",
-                  "LANGUAGE_FOREIGN_FLOW",
-                  `Step ${step.stepNumber} of "${implMethod.name}" in implementation "${impl.id}" uses ${label}, but the target language is ${lang}: ${guidance}.`,
-                  impl.id,
-                  isDraftCtx
-                );
-              }
-            }
+          const draft = ctx.isImplementationDraft(impl);
+          for (const method of impl.methods) {
+            for (const step of method.narrative) scans.push({ implementation: impl, method, step, lang, gaps, draft });
+          }
+        }
+        for (const scan of scans) {
+          for (const construct of constructsOf(scan.step)) {
+            const guidance = scan.gaps[construct];
+            if (!guidance) continue;
+            ctx.addIssue(
+              "warning",
+              "LANGUAGE_FOREIGN_FLOW",
+              `Step ${scan.step.stepNumber} of "${scan.method.name}" in implementation "${scan.implementation.id}" uses ${constructLabel(construct)}, but the target language is ${scan.lang}: ${guidance}.`,
+              scan.implementation.id,
+              scan.draft
+            );
           }
         }
       }
@@ -13023,6 +13746,36 @@ var init_target_language = __esm({
   }
 });
 
+// src/core/rules/heuristic/technology-binding.ts
+var DATA_LAYER, technologyBindingRule;
+var init_technology_binding = __esm({
+  "src/core/rules/heuristic/technology-binding.ts"() {
+    "use strict";
+    DATA_LAYER = /* @__PURE__ */ new Set(["Adapter", "Store", "Registry", "Index"]);
+    technologyBindingRule = {
+      name: "technology-binding",
+      description: "Only data-layer stereotypes (Adapter/Store/Registry/Index) should bind a technology directly: an L4 that declares `technologies` on logic has no swap seam. No hardcoded vendor lists \u2014 only declared tokens are policed, so the rule never fires on a tree that doesn't opt in.",
+      codes: [
+        { code: "TECH_ON_LOGIC_COMPONENT", defaultSeverity: "warning", summary: "Technology bound by a non-data-layer stereotype" }
+      ],
+      check(ctx) {
+        for (const impl of ctx.implementations) {
+          const intf = ctx.interfaceMap.get(impl.contract);
+          const comp = intf ? ctx.componentMap.get(intf.component) : void 0;
+          if (!impl.technologies?.length || !comp || DATA_LAYER.has(comp.componentType)) continue;
+          ctx.addIssue(
+            "warning",
+            "TECH_ON_LOGIC_COMPONENT",
+            `Implementation "${impl.id}" binds technology (${impl.technologies.join(", ")}) on component "${comp.id}" (${comp.componentType}). Technology belongs behind a data-layer seam \u2014 extract an Adapter (or Store/Registry/Index) behind an intent interface and let this component depend on that.`,
+            impl.id,
+            ctx.isImplementationDraft(impl)
+          );
+        }
+      }
+    };
+  }
+});
+
 // src/core/rules/heuristic/technology-boundaries.ts
 function makeMatcher(tech) {
   const parts = tech.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
@@ -13046,19 +13799,29 @@ function contractIdentifiers(m) {
   if (m.endpoint) parts.push(Object.values(m.endpoint).map(String).join(" "));
   return parts.join(" ");
 }
-var DATA_LAYER, technologyRule;
+function implementationText(impl) {
+  const parts = [impl.description, ...implementationSourceFiles(impl)];
+  for (const m of impl.methods) {
+    parts.push(m.intent);
+    for (const s of m.narrative ?? []) {
+      parts.push(s.description, s.targetComponent, s.targetMethod, s.condition, s.over, s.on, s.outcome, s.error);
+      for (const c of s.cases ?? []) parts.push(c.value);
+      for (const c of s.catches ?? []) parts.push(c.error);
+    }
+  }
+  return parts.filter(Boolean).join(" ");
+}
+var technologyRule;
 var init_technology_boundaries = __esm({
   "src/core/rules/heuristic/technology-boundaries.ts"() {
     "use strict";
     init_models();
-    DATA_LAYER = /* @__PURE__ */ new Set(["Adapter", "Store", "Registry", "Index"]);
     technologyRule = {
       name: "technology-boundaries",
-      description: "Technology stays behind its owning boundary: an L4 that declares `technologies` (e.g. [mysql]) makes its component's ownership tree the technology's home. References outside that tree are leakage, L3 contract identifiers must stay intent-language (the contract is the swap seam), and only data-layer stereotypes (Adapter/Store/Registry/Index) should bind a technology directly.",
+      description: "Technology stays behind its owning boundary: an L4 that declares `technologies` (e.g. [mysql]) makes its component's ownership tree the technology's home. References outside that tree are leakage, and L3 contract identifiers must stay intent-language \u2014 the contract is the swap seam, so the vendor name is wrong even on the owning component's own interface.",
       codes: [
         { code: "TECH_LEAKAGE", defaultSeverity: "warning", summary: "Technology referenced outside its owning boundary" },
-        { code: "VENDOR_NAME_IN_CONTRACT", defaultSeverity: "warning", summary: "Technology name in L3 contract identifiers" },
-        { code: "TECH_ON_LOGIC_COMPONENT", defaultSeverity: "warning", summary: "Technology bound by a non-data-layer stereotype" }
+        { code: "VENDOR_NAME_IN_CONTRACT", defaultSeverity: "warning", summary: "Technology name in L3 contract identifiers" }
       ],
       check(ctx) {
         const ownerOf = /* @__PURE__ */ new Map();
@@ -13086,21 +13849,18 @@ var init_technology_boundaries = __esm({
           }
           return out;
         };
-        const homes = /* @__PURE__ */ new Map();
+        const declarations = [];
         for (const impl of ctx.implementations) {
           if (!impl.technologies?.length) continue;
           const intf = ctx.interfaceMap.get(impl.contract);
           const comp = intf ? ctx.componentMap.get(intf.component) : void 0;
           if (!comp) continue;
-          if (!DATA_LAYER.has(comp.componentType)) {
-            ctx.addIssue(
-              "warning",
-              "TECH_ON_LOGIC_COMPONENT",
-              `Implementation "${impl.id}" binds technology (${impl.technologies.join(", ")}) on component "${comp.id}" (${comp.componentType}). Technology belongs behind a data-layer seam \u2014 extract an Adapter (or Store/Registry/Index) behind an intent interface and let this component depend on that.`,
-              impl.id,
-              ctx.isImplementationDraft(impl)
-            );
-          }
+          for (const tech of impl.technologies) declarations.push({ comp, tech });
+        }
+        const scopes = /* @__PURE__ */ new Map();
+        const scopeOf = (comp) => {
+          const cached = scopes.get(comp.id);
+          if (cached) return cached;
           const compSet = ownsClosure(ownershipRoot(comp.id));
           const scope = new Set(compSet);
           for (const i of ctx.interfaces) if (compSet.has(i.component)) scope.add(i.id);
@@ -13115,15 +13875,18 @@ var init_technology_boundaries = __esm({
               if (subId === s.id || subId.startsWith(`${s.id}::`)) scope.add(s.id);
             }
           }
-          for (const tech of impl.technologies) {
-            const match = makeMatcher(tech);
-            if (!match) continue;
-            const key = tech.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean).join("");
-            const home = homes.get(key) ?? { label: tech, match, ownerComponents: /* @__PURE__ */ new Set(), scope: /* @__PURE__ */ new Set() };
-            home.ownerComponents.add(comp.id);
-            for (const id of scope) home.scope.add(id);
-            homes.set(key, home);
-          }
+          scopes.set(comp.id, scope);
+          return scope;
+        };
+        const homes = /* @__PURE__ */ new Map();
+        for (const { comp, tech } of declarations) {
+          const match = makeMatcher(tech);
+          if (!match) continue;
+          const key = tech.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean).join("");
+          const home = homes.get(key) ?? { label: tech, match, ownerComponents: /* @__PURE__ */ new Set(), scope: /* @__PURE__ */ new Set() };
+          home.ownerComponents.add(comp.id);
+          for (const id of scopeOf(comp)) home.scope.add(id);
+          homes.set(key, home);
         }
         if (homes.size === 0) return;
         const ownersDesc = (h) => [...h.ownerComponents].map((c) => `"${c}"`).join(", ");
@@ -13187,16 +13950,7 @@ var init_technology_boundaries = __esm({
           }
           for (const impl of ctx.implementations) {
             if (home.scope.has(impl.id)) continue;
-            const parts = [impl.description, ...implementationSourceFiles(impl)];
-            for (const m of impl.methods) {
-              parts.push(m.intent);
-              for (const s of m.narrative ?? []) {
-                parts.push(s.description, s.targetComponent, s.targetMethod, s.condition, s.over, s.on, s.outcome, s.error);
-                for (const c of s.cases ?? []) parts.push(c.value);
-                for (const c of s.catches ?? []) parts.push(c.error);
-              }
-            }
-            if (home.match(parts.filter(Boolean).join(" "))) {
+            if (home.match(implementationText(impl))) {
               ctx.addIssue(
                 "warning",
                 "TECH_LEAKAGE",
@@ -13885,12 +14639,15 @@ var init_repository = __esm({
   "src/core/rules/repository.ts"() {
     "use strict";
     init_hierarchy_integrity();
-    init_namespace_hygiene();
+    init_reserved_id_segments();
+    init_namespace_shadowing();
     init_roundtrip_serialization();
     init_type_declarations();
     init_field_type_references();
     init_signature_type_references();
-    init_public_surface();
+    init_public_surface_binding();
+    init_public_surface_declared_type();
+    init_public_surface_bound_contract();
     init_lint_allows();
     init_contract_symmetry();
     init_narrative_target_references();
@@ -13900,23 +14657,37 @@ var init_repository = __esm({
     init_narrative_step_config();
     init_narrative_reachability();
     init_narrative_jump_edges();
-    init_narrative_antipatterns();
+    init_meaningless_branches();
+    init_inescapable_cycles();
+    init_unconditional_call_cycles();
     init_narrative_detail();
+    init_detail_sufficiency();
     init_portal_fields();
     init_durability_declaration();
     init_logic_declaration();
     init_retired_stereotypes();
     init_portal_endpoints();
+    init_non_portal_endpoints();
     init_portal_call_auth();
-    init_stereotype_dependencies();
-    init_pattern_ownership();
+    init_auth_source_wiring();
+    init_subsystem_boundary_dependencies();
+    init_logic_dependency_class();
+    init_data_block_dependencies();
+    init_entrypoint_dependencies();
+    init_portal_write_shortcut();
+    init_pattern_membership();
+    init_pattern_containment();
+    init_unowned_blocks();
+    init_member_visibility();
     init_facade_forwarding();
     init_profile_registration();
     init_profile_stereotype_fencing();
     init_pack_profile_stereotypes();
     init_pattern_references();
     init_component_variants();
-    init_declarative_assertions();
+    init_assertion_forbidden_edges();
+    init_assertion_required_fields();
+    init_assertion_endpoint_shapes();
     init_pack_resolution();
     init_pack_reproducibility();
     init_dependency_cycles();
@@ -13924,10 +14695,14 @@ var init_repository = __esm({
     init_dispatch_step_routing();
     init_lifecycle_entrypoints();
     init_unused_detection();
+    init_invoked_by_description();
+    init_unused_types();
     init_durability_round_trip();
     init_untyped_seams();
     init_prose_claims();
+    init_unique_invariant_ids();
     init_invariant_backing();
+    init_invariant_references();
     init_event_topology();
     init_source_file_linkage();
     init_method_realization();
@@ -13935,9 +14710,14 @@ var init_repository = __esm({
     init_call_conformance();
     init_hidden_state();
     init_dependency_conformance();
-    init_integration_conformance();
+    init_integration_sim_declaration();
+    init_integration_sim_file();
+    init_integration_sim_wiring();
+    init_integration_sim_coverage();
     init_coupling_health();
-    init_target_language();
+    init_signature_language_builtins();
+    init_narrative_language_constructs();
+    init_technology_binding();
     init_technology_boundaries();
     init_naming_conventions();
     init_complexity_and_metadata();
@@ -13947,8 +14727,11 @@ var init_repository = __esm({
     SDD_RULES = [
       hierarchyRule,
       // Namespace integrity right after hierarchy: unresolvable/unwritable ids
-      // explain many downstream findings, so surface them early in the list.
-      namespaceHygieneRule,
+      // explain many downstream findings, so surface them early in the list. Two
+      // questions of the same ids: the segment no id may spend, and the local name
+      // that would anchor a bare reference to the root instead.
+      reservedIdSegmentsRule,
+      namespaceShadowingRule,
       roundtripRule,
       // The type vocabulary in three questions: what a type declares about
       // itself, then the identifiers its fields name, then the ones its
@@ -13974,20 +14757,48 @@ var init_repository = __esm({
       narrativeStepConfigRule,
       narrativeReachabilityRule,
       narrativeJumpEdgesRule,
-      // Antipatterns right after flow soundness: they analyze the same step
-      // graphs and only make sense once the graphs are structurally valid.
-      narrativeAntipatternsRule,
+      // Antipatterns right after flow soundness: they read the same step graphs
+      // and only make sense once the graphs are structurally valid. Three things
+      // structure alone can prove, in widening scope: a decision that decides
+      // nothing, a step cycle nothing leaves, and a call cycle with no guard.
+      meaninglessBranchesRule,
+      inescapableCyclesRule,
+      unconditionalCallCyclesRule,
+      // The detail dial in two questions: does a method carry the detail its level
+      // promises, and is that level low enough to be hiding something.
       narrativeDetailRule,
+      detailSufficiencyRule,
       // Field shape before endpoint bindings: a Portal-only field on the wrong
       // stereotype explains the endpoint findings around it, and this half is
       // spec-scoped so the write boundary refuses it first.
       portalFieldsRule,
+      // Endpoints from both sides: a Portal binds every method to its transport,
+      // and nothing that is not a Portal may bind one at all.
       portalsRule,
-      // Cross-call auth: a narrative call into an authed Portal must name its
-      // credential source (rides with the portal family).
+      nonPortalEndpointsRule,
+      // Cross-call auth rides with the portal family, in two questions: does a
+      // call into an authed Portal present a credential properly, and does the
+      // source it names resolve to a provider it is wired to.
       portalCallAuthRule,
-      stereotypeDepsRule,
-      patternsRule,
+      authSourceWiringRule,
+      // Dependencies in five questions, one owner each: where an edge is
+      // allowed to LAND (the boundary, and what an unresolved id means), then
+      // the intra-subsystem matrix by the layer that answers for it — an
+      // Orchestrator's declared class, the data blocks, the entry points and
+      // the process layer — and finally the Portal read-face guard, the one
+      // that reads narratives and dispatch tables rather than dependsOn.
+      subsystemBoundaryDepsRule,
+      logicDependencyClassRule,
+      dataBlockDepsRule,
+      entrypointDepsRule,
+      portalWriteShortcutRule,
+      // Patterns in four questions: who may own and what a claim must name,
+      // what each pattern must contain, which data blocks are left standing
+      // alone, and who may see a private member.
+      patternMembershipRule,
+      patternContainmentRule,
+      unownedBlocksRule,
+      memberVisibilityRule,
       // Facade shape rides with pattern ownership: same §7 doctrine, narrative side.
       facadeForwardingRule,
       // Profiles in three questions, three owners: is the name real (the
@@ -13999,9 +14810,18 @@ var init_repository = __esm({
       patternReferencesRule,
       variantReferencesRule,
       // Pack-instantiated declarative doctrine rides with the pack-reference
-      // family: same data source, same provenance-bearing findings.
-      declarativeAssertionsRule,
-      publicSurfaceRule,
+      // family: same data source, same provenance-bearing findings. One rule per
+      // assertion kind — the kind is what a pack author writes, and each kind
+      // asks its own question of its own collection.
+      assertionForbiddenEdgesRule,
+      assertionRequiredFieldsRule,
+      assertionEndpointShapesRule,
+      // The published surface in three questions: what backs the entry, whether
+      // that component's stereotype can realize the type it declares, and whether
+      // the contract it binds is that component's own.
+      publicSurfaceBindingRule,
+      publicSurfaceDeclaredTypeRule,
+      publicSurfaceBoundContractRule,
       cyclesRule,
       // Semantic-edge family: dispatch/lifecycle validity BEFORE reachability so a
       // reader sees the broken edge finding next to the unused-detection fallout
@@ -14009,7 +14829,11 @@ var init_repository = __esm({
       dispatchTableBindingsRule,
       dispatchStepRoutingRule,
       lifecycleRule,
+      // The declared entrypoint's own prose before the walk that its declaration
+      // silences, then the walk, then the types no walk can reach.
+      invokedByDescriptionRule,
       reachabilityRule,
+      unusedTypesRule,
       // The declaration (spec-scoped, refused at the write boundary) before the
       // round-trip consequences it enables.
       durabilityDeclarationRule,
@@ -14021,8 +14845,13 @@ var init_repository = __esm({
       untypedSeamRule,
       proseClaimRule,
       // Invariant registry rides with the semantic-edge family: declared entity
-      // invariants must be asserted on every write path (declarations, not proofs).
+      // invariants must be asserted on every write path (declarations, not
+      // proofs). Three questions of one registry: are the entity's ids unique,
+      // does each invariant reach every write path of its owner, and does every
+      // asserted reference name something declared.
+      uniqueInvariantIdsRule,
       invariantBackingRule,
+      invariantReferencesRule,
       // Pub/sub completeness: emitted topics need subscribers and vice versa.
       eventTopologyRule,
       // Code↔spec: structural conformance consumes the injected CodeModel (built
@@ -14041,10 +14870,22 @@ var init_repository = __esm({
       hiddenStateRule,
       dependencyConformanceRule,
       // Integration wiring proof rides after the code↔spec family: it consumes
-      // the same code model and speaks about the same sourcePath modules.
-      integrationConformanceRule,
+      // the same code model and speaks about the same sourcePath modules. Four
+      // questions about one harness, in the order a reader meets them: is one
+      // expected here, does the declared one exist, does it wire the real
+      // modules, does it name every narrated path.
+      integrationSimDeclarationRule,
+      integrationSimFileRule,
+      integrationSimWiringRule,
+      integrationSimCoverageRule,
       couplingRule,
-      languageRule,
+      // Target-language fit in two questions: what a CONTRACT may name, and what
+      // a NARRATIVE may describe.
+      signatureLanguageBuiltinsRule,
+      narrativeLanguageConstructsRule,
+      // The declaration before the consequences: which stereotype may bind a
+      // technology at all, then where its name may appear.
+      technologyBindingRule,
       technologyRule,
       namingRule,
       complexityRule,
@@ -14758,11 +15599,15 @@ function buildRuleContext(opts) {
     }
     return { kind: "unresolved" };
   };
+  const contractMethods = /* @__PURE__ */ new Map();
   const interfaceMethodsOf = (compId) => {
+    const cached = contractMethods.get(compId);
+    if (cached) return cached;
     const out = [];
     for (const intf of interfacesByComponent.get(compId) ?? []) {
       out.push(...intf.methods);
     }
+    contractMethods.set(compId, out);
     return out;
   };
   const profileDefFor = (subsystemId) => {
@@ -14858,7 +15703,30 @@ function buildRuleContext(opts) {
       ...surfaceResolved ? { surfaceResolved: true } : {}
     });
   };
-  return {
+  let codeIndexMemo;
+  const codeIndex = () => codeIndexMemo ??= buildCodeIndex(ctx.codeModel);
+  let realizationMemo;
+  const realizationIndex = () => realizationMemo ??= buildRealizationIndex(ctx);
+  const importGraphs = /* @__PURE__ */ new Map();
+  const importGraph = (paths) => {
+    const universe = paths ?? codeIndex().paths;
+    const key = `${universe.size}\0${[...universe].join("\0")}`;
+    let graph = importGraphs.get(key);
+    if (!graph) {
+      graph = buildImportGraph(codeIndex(), universe);
+      importGraphs.set(key, graph);
+    }
+    return graph;
+  };
+  let ownershipMemo;
+  const ownershipIndex = () => ownershipMemo ??= buildOwnershipIndex(ctx);
+  let dependencyEdgesMemo;
+  const dependencyEdges = () => dependencyEdgesMemo ??= buildDependencyEdges(ctx);
+  let specIdsMemo;
+  const specIds = () => specIdsMemo ??= buildSpecIds(ctx);
+  let implementationMethodsMemo;
+  const implementationMethods = () => implementationMethodsMemo ??= buildImplementationMethods(ctx);
+  const ctx = {
     system,
     subsystems,
     components,
@@ -14887,6 +15755,13 @@ function buildRuleContext(opts) {
     isCollapsedCrossTreeRef,
     resolveSurfaceRef,
     interfaceMethodsOf,
+    codeIndex,
+    realizationIndex,
+    importGraph,
+    ownershipIndex,
+    dependencyEdges,
+    specIds,
+    implementationMethods,
     complexityConfigFor,
     documentationConfigFor,
     namingConfigFor,
@@ -14901,6 +15776,7 @@ function buildRuleContext(opts) {
     knownIssueCodes: opts.knownIssueCodes,
     addIssue
   };
+  return ctx;
 }
 var DEPTH_RANK, DEPTH_GATED_CODES, COMPLETENESS_RULES;
 var init_rules = __esm({
@@ -14909,6 +15785,7 @@ var init_rules = __esm({
     init_models();
     init_extensions();
     init_types();
+    init_read_model();
     init_repository();
     init_lint_allows();
     init_source_analysis();
@@ -16749,8 +17626,8 @@ function generateSequenceDiagram(componentId, methodName, options) {
   const componentById = new Map(graph.components.map((c) => [c.id, c]));
   const resolveComponent = (id) => {
     if (componentById.has(id)) return componentById.get(id);
-    const matches2 = graph.components.filter((c) => c.id.endsWith(`::${id}`));
-    return matches2.length === 1 ? matches2[0] : void 0;
+    const matches = graph.components.filter((c) => c.id.endsWith(`::${id}`));
+    return matches.length === 1 ? matches[0] : void 0;
   };
   const entry = resolveComponent(componentId);
   if (!entry) {
@@ -18011,9 +18888,9 @@ var init_specs2 = __esm({
           }
         }
         const suffix = `::${id}`;
-        const matches2 = Object.keys(index.paths.subsystem).filter((key) => key.endsWith(suffix));
-        if (matches2.length === 1) {
-          return index.paths.subsystem[matches2[0]];
+        const matches = Object.keys(index.paths.subsystem).filter((key) => key.endsWith(suffix));
+        if (matches.length === 1) {
+          return index.paths.subsystem[matches[0]];
         }
         if (pathExists(this.paths.specsSubsystemsDir()) && listFiles(this.paths.specsSubsystemsDir(), ".yaml").length > 0) {
           return path16.join(this.paths.specsSubsystemsDir(), `${id}.yaml`);