@wairon/cli 5.1.1-dev.36 → 5.1.1-dev.37

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.36";
+    WAIRON_VERSION = "5.1.1-dev.37";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     SUPPORTED_ALIASES = ["wai"];
     SCAN_EXCLUDE_DIRS = /* @__PURE__ */ new Set([
@@ -23209,6 +23209,7 @@ __export(specs_exports, {
   getSubprojectPrefix: () => getSubprojectPrefix,
   getSubsystemPath: () => getSubsystemPath,
   getTypePath: () => getTypePath,
+  ineffectiveDeltaPaths: () => ineffectiveDeltaPaths,
   inspectChainedRoots: () => inspectChainedRoots,
   invalidateSpecCache: () => invalidateSpecCache,
   listChainedRoots: () => listChainedRoots,
@@ -23727,6 +23728,117 @@ function specChanges(before, after, prefix = "") {
   if (JSON.stringify(before) === JSON.stringify(after)) return [];
   return [{ path: prefix, change: "set", before: summarizeValue(before), after: summarizeValue(after) }];
 }
+function identityFieldsOf(field) {
+  switch (field) {
+    case "dispatch":
+      return ["capability"];
+    case "lifecycle":
+      return ["phase", "component", "method"];
+    case "emits":
+    case "subscribesTo":
+      return ["topic", "event"];
+    case "trustedLinks":
+      return ["subsystem"];
+    case "allow":
+    case "findings":
+      return ["code"];
+    case "invariants":
+    case "patterns":
+      return ["id"];
+    case "boundaries":
+      return ["name"];
+    case "globalRequirements":
+      return ["description"];
+    case "databases":
+      return ["id", "name"];
+    case "cases":
+      return ["value"];
+    case "catches":
+      return ["error"];
+    case "narrative":
+      return ["stepNumber"];
+    default:
+      return ["name", "id"];
+  }
+}
+function carriesEditMarker(item) {
+  if (item === null || typeof item !== "object") return false;
+  const o = item;
+  return o.action !== void 0 || o.remove !== void 0;
+}
+function ineffectiveDeltaPaths(delta, merged, stored) {
+  const out = [];
+  const isPlain = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+  const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+  const at = (prefix, key) => prefix ? `${prefix}.${key}` : key;
+  const say = (path70, why) => {
+    out.push(`${path70} \u2014 ${why}`);
+  };
+  const walkValue = (d, m, s, path70, field) => {
+    if (Array.isArray(d)) {
+      if (!Array.isArray(m)) {
+        say(path70, "the level does not have this field, so the write dropped it");
+        return;
+      }
+      if (field === "narrative" && d.some(carriesEditMarker)) return;
+      for (const element of d) {
+        if (carriesEditMarker(element)) continue;
+        const key = reportIdentityOf(field, element);
+        if (key === null) {
+          if (!same(m, d)) say(path70, "the level does not keep this value, so the write dropped it");
+          else if (same(s, d)) say(path70, "the stored spec already held this value");
+          return;
+        }
+        const mMatch = m.find((i) => reportIdentityOf(field, i) === key);
+        const sMatch = Array.isArray(s) ? s.find((i) => reportIdentityOf(field, i) === key) : void 0;
+        if (mMatch === void 0) {
+          say(at(path70, key), "the write did not store this element");
+          continue;
+        }
+        walk2(element, mMatch, sMatch, at(path70, key), field);
+      }
+      return;
+    }
+    if (isPlain(d)) {
+      if (!isPlain(m)) {
+        say(path70, "the level does not have this field, so the write dropped it");
+        return;
+      }
+      walk2(d, m, s, path70, field);
+      return;
+    }
+    if (!same(m, d)) say(path70, "the write did not store it \u2014 the level's schema does not keep this value");
+    else if (same(s, d)) say(path70, "the stored spec already held this value");
+  };
+  function walk2(d, m, s, path70, container) {
+    for (const [key, value] of Object.entries(d)) {
+      if (DELTA_VERBS.has(key) || JUMP_LABEL_TWINS.has(key)) continue;
+      if (key === "label" && LABEL_TWIN_CONTAINERS.has(container)) continue;
+      if (identityFieldsOf(container).includes(key)) continue;
+      if (key === "unset") {
+        for (const name of Array.isArray(value) ? value : []) {
+          if (typeof name !== "string") continue;
+          const had = isPlain(s) && s[name] !== void 0;
+          const still = isPlain(m) && m[name] !== void 0;
+          if (!had) say(at(path70, name), "unset named a field the stored spec did not have");
+          else if (still) say(at(path70, name), "unset did not remove it");
+        }
+        continue;
+      }
+      if (value === void 0 || value === null) continue;
+      const here = at(path70, key);
+      const mValue = isPlain(m) ? m[key] : void 0;
+      const sValue = isPlain(s) ? s[key] : void 0;
+      if (mValue === void 0) {
+        say(here, "the level does not have this field, so the write dropped it");
+        continue;
+      }
+      walkValue(value, mValue, sValue, here, key);
+    }
+  }
+  walk2(delta, merged, stored, "", "");
+  return out;
+}
 function workspaceFor(rootDir) {
   const key = path23.resolve(rootDir);
   let ws = workspaces.get(key);
@@ -23952,10 +24064,10 @@ function restoreSpecFiles(snapshot) {
 function findLegacySpecFiles() {
   return current().findLegacySpecFiles();
 }
-function updateSpec(kind, id, delta, hooks) {
-  return current().updateSpec(kind, id, delta, hooks);
+function updateSpec(kind, id, delta, hooks, dryRun) {
+  return current().updateSpec(kind, id, delta, hooks, dryRun);
 }
-var fs17, path23, NO_ROOT_SUBSYSTEMS, SIGNATURE_TTL_MS, SpecWorkspace, workspaces;
+var fs17, path23, NO_ROOT_SUBSYSTEMS, SIGNATURE_TTL_MS, DELTA_VERBS, JUMP_LABEL_TWINS, LABEL_TWIN_CONTAINERS, SpecWorkspace, workspaces;
 var init_specs2 = __esm({
   "src/core/specs.ts"() {
     "use strict";
@@ -23973,6 +24085,16 @@ var init_specs2 = __esm({
     init_diagram();
     NO_ROOT_SUBSYSTEMS = /* @__PURE__ */ new Set();
     SIGNATURE_TTL_MS = 2e3;
+    DELTA_VERBS = /* @__PURE__ */ new Set(["action", "remove", "captureJumps"]);
+    JUMP_LABEL_TWINS = /* @__PURE__ */ new Set([
+      "onTrueLabel",
+      "onFalseLabel",
+      "defaultLabel",
+      "endLabel",
+      "finallyLabel",
+      "toLabel"
+    ]);
+    LABEL_TWIN_CONTAINERS = /* @__PURE__ */ new Set(["cases", "catches", "branches"]);
     SpecWorkspace = class {
       constructor(rootDir) {
         this.cachedIndex = null;
@@ -24688,6 +24810,9 @@ var init_specs2 = __esm({
         const existing = this.loadSubsystemSpec(spec.id);
         if (existing) {
           specToWrite.createdAt = existing.createdAt;
+          if (!opts?.allowStatusDemotion && existing.status && (!spec.status || spec.status === "draft")) {
+            specToWrite.status = existing.status;
+          }
         }
         specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
         writeYamlFile(p, parseOrThrow(SubsystemSpecSchema, specToWrite, "subsystem", spec.id));
@@ -25236,15 +25361,22 @@ var init_specs2 = __esm({
        *     carry, and a label in the delta retargets the stored numeric jump it
        *     twins. An unresolved reference aborts the whole update.
        *  7. COMPARE with what is stored, both read through the level's canonical
-       *     schema. Equal means nothing is written and `written` is false.
-       *  8. GATE the merged spec through the caller's hook, then SAVE.
+       *     schema. Equal means nothing is written and `written` is false. The same
+       *     comparison names every delta path the write did NOT act on — one the
+       *     schema drops at a depth the permissive delta cannot refuse, one the
+       *     stored spec already held, an `unset` that removed nothing.
+       *  8. GATE the merged spec through the caller's hook. A DRY RUN stops here
+       *     and answers with the report it would have produced — after the gate, so
+       *     it accounts for a write that would really be accepted, and before the
+       *     stamp, so not one byte of the stored file moves.
+       *  9. STAMP updatedAt and SAVE.
        *
        * Returns the change report, whose `notices` carry the non-fatal effects (an
        * insert whose position was a jump target, so the relocated jumps now bypass
        * the inserted step; the fields a retype dropped) — empty when the merge had
        * nothing to say.
        */
-      updateSpec(kind, id, delta, hooks) {
+      updateSpec(kind, id, delta, hooks, dryRun = false) {
         const notices = [];
         const result = (() => {
           switch (kind) {
@@ -25723,7 +25855,8 @@ var init_specs2 = __esm({
         const unsetFields = Array.isArray(delta.unset) ? delta.unset.filter((f) => typeof f === "string") : [];
         const { unset: _unset, ...mergeableDelta } = delta;
         const storedBefore = JSON.parse(JSON.stringify(result));
-        const mergedResult = mergeDelta(result, qualifyDeltaRefs(mergeableDelta));
+        const qualifiedDelta = qualifyDeltaRefs(mergeableDelta);
+        const mergedResult = mergeDelta(result, qualifiedDelta);
         for (const field of unsetFields) delete mergedResult[field];
         if (kind === "implementation" && Array.isArray(mergedResult.methods)) {
           const labelErrors = [];
@@ -25741,20 +25874,41 @@ var init_specs2 = __esm({
           delete value.updatedAt;
           return value;
         };
-        const changes = specChanges(canonical(storedBefore), canonical(mergedResult));
+        const canonicalStored = canonical(storedBefore);
+        const canonicalMerged = canonical(mergedResult);
+        const changes = specChanges(canonicalStored, canonicalMerged);
+        const ineffective = ineffectiveDeltaPaths(
+          { ...qualifiedDelta, ...unsetFields.length ? { unset: unsetFields } : {} },
+          canonicalMerged,
+          canonicalStored
+        );
         if (changes.length === 0) {
           return {
             kind,
             id,
             written: false,
+            dryRun,
             changes,
+            ineffective,
             notices,
-            summary: `No change to ${kind} "${id}" \u2014 the delta matches what is stored, so nothing was written.`
+            summary: `No change to ${kind} "${id}" \u2014 the delta matches what is stored, so nothing ${dryRun ? "would be" : "was"} written.`
           };
         }
-        mergedResult.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
         const gateNotices = hooks?.gate?.(kind, mergedResult);
         if (gateNotices?.length) notices.push(...gateNotices);
+        if (dryRun) {
+          return {
+            kind,
+            id,
+            written: false,
+            dryRun: true,
+            changes,
+            ineffective,
+            notices,
+            summary: `Dry run on ${kind} "${id}": ${changes.length} change${changes.length === 1 ? "" : "s"} would be made. Nothing was written.`
+          };
+        }
+        mergedResult.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
         const opts = {
           allowStatusDemotion: Object.prototype.hasOwnProperty.call(delta, "status")
         };
@@ -25763,7 +25917,7 @@ var init_specs2 = __esm({
             this.saveSystemSpec(mergedResult);
             break;
           case "subsystem":
-            this.saveSubsystemSpec(mergedResult);
+            this.saveSubsystemSpec(mergedResult, opts);
             break;
           case "component":
             notices.push(...this.saveComponentSpec(mergedResult, opts));
@@ -25782,7 +25936,9 @@ var init_specs2 = __esm({
           kind,
           id,
           written: true,
+          dryRun: false,
           changes,
+          ineffective,
           notices,
           summary: `Updated ${kind} "${id}": ${changes.length} change${changes.length === 1 ? "" : "s"}.`
         };
@@ -26652,8 +26808,8 @@ function addComponent(candidate) {
   if (verdict.errors.length) throw new Error(formatCandidateRefusal(verdict));
   return [...noticesFrom(verdict), ...saveComponentSpec(candidate)];
 }
-function updateSpecGated(kind, id, delta) {
-  return updateSpec(kind, id, delta, componentCandidateGate());
+function updateSpecGated(kind, id, delta, dryRun) {
+  return updateSpec(kind, id, delta, componentCandidateGate(), dryRun);
 }
 var init_authoring = __esm({
   "src/core/authoring.ts"() {
@@ -26752,11 +26908,14 @@ function errText(message) {
   return { content: [{ type: "text", text: `Error: ${message}` }], isError: true };
 }
 function renderChangeReport(report2) {
-  const lines = [report2.summary];
+  const lines = [report2.dryRun ? `DRY RUN \u2014 nothing was written. ${report2.summary}` : report2.summary];
   for (const change of report2.changes) {
     const to = change.after === void 0 ? "" : `: ${JSON.stringify(change.after)}`;
     const from = change.before === void 0 ? "" : ` (was ${JSON.stringify(change.before)})`;
-    lines.push(`- ${change.path} ${change.change}${to}${from}`);
+    lines.push(`- ${change.path} ${report2.dryRun ? `would be ${change.change}` : change.change}${to}${from}`);
+  }
+  if (report2.ineffective.length) {
+    lines.push("", "NO EFFECT:", ...report2.ineffective.map((i) => `- ${i}`));
   }
   if (report2.notices.length) lines.push("", "NOTICE:", ...report2.notices.map((n) => `- ${n}`));
   return lines.join("\n");
@@ -26798,6 +26957,18 @@ function reg(server, name, config, cb) {
   const strictConfig = config.inputSchema ? { ...config, inputSchema: import_zod11.z.object(config.inputSchema).strict() } : config;
   server.registerTool(name, strictConfig, guarded);
 }
+function statusForCreate(label, stated, existing) {
+  if (stated === void 0) return { status: "draft" };
+  const held = existing?.status ?? void 0;
+  if (held === void 0) return { status: stated };
+  const rank = (s) => STATUS_ORDER.indexOf(s);
+  if (rank(stated) < rank(held)) {
+    return {
+      refusal: `Refusing to re-author ${label} at status "${stated}": it is stored at "${held}", and a create tool never lowers a spec's status \u2014 a restatement that reopened a frozen spec would undo a lock without saying so. Nothing was written. To reopen it deliberately, use sdd_update_spec with {"status": "${stated}"}; to keep the level it has, leave status out.`
+    };
+  }
+  return { status: stated };
+}
 function isEmptyValue(value) {
   if (value === void 0 || value === null) return true;
   if (Array.isArray(value)) return value.length === 0;
@@ -27095,8 +27266,8 @@ function createMcpServer(options = {}) {
   const systemInput = {
     name: import_zod11.z.string().describe("Overarching name of the project/system"),
     vision: import_zod11.z.string().describe("Vision, mission, and core goals of the system"),
-    boundaries: import_zod11.z.array(import_zod11.z.union([import_zod11.z.string(), import_zod11.z.object({ name: import_zod11.z.string(), description: import_zod11.z.string().optional() })])).optional().describe("System boundary rules or scope statements (strings or name/description objects)"),
-    globalRequirements: import_zod11.z.array(import_zod11.z.union([import_zod11.z.string(), import_zod11.z.object({ description: import_zod11.z.string() })])).optional().describe("Global functional and non-functional requirements (strings or description objects)"),
+    boundaries: import_zod11.z.array(import_zod11.z.union([import_zod11.z.string(), import_zod11.z.object({ name: import_zod11.z.string(), description: import_zod11.z.string().optional() }).strict()])).optional().describe("System boundary rules or scope statements (strings or name/description objects)"),
+    globalRequirements: import_zod11.z.array(import_zod11.z.union([import_zod11.z.string(), import_zod11.z.object({ description: import_zod11.z.string() }).strict()])).optional().describe("Global functional and non-functional requirements (strings or description objects)"),
     targetLanguage: import_zod11.z.string().optional().describe('Default implementation language for the system (e.g. "typescript", "rust", "python"). Subsystems may override. Enables language-aware validation.')
   };
   const systemInputFields = Object.keys(systemInput);
@@ -27146,7 +27317,7 @@ NOTICE:
       details: import_zod11.z.string(),
       component: import_zod11.z.string().optional().describe("The L2 component id that realizes this interface (this subsystem's published surface)"),
       interface: import_zod11.z.string().optional().describe("Optional L3 interface id on that component backing this entry")
-    })).optional().describe("Public entrypoints exposed by this subsystem, each bound to a realizing component"),
+    }).strict()).optional().describe("Public entrypoints exposed by this subsystem, each bound to a realizing component"),
     projectPath: import_zod11.z.string().optional().describe("Relative path to external project root for subsystem chaining"),
     targetLanguage: import_zod11.z.string().optional().describe("Override of the system-level targetLanguage for this subsystem"),
     profile: import_zod11.z.string().optional().describe("Architectural profile override for this subsystem (built-ins: backend, frontend-reactive, frontend-controller, lowlevel-os, game-ecs, realtime-embedded, plc-cyclic; extension packs may add more \u2014 unknown names get UNKNOWN_PROFILE)"),
@@ -27154,29 +27325,32 @@ NOTICE:
     trustedLinks: import_zod11.z.array(import_zod11.z.object({
       subsystem: import_zod11.z.string().describe("Peer subsystem id"),
       reason: import_zod11.z.string().describe('Why the coupling is sanctioned (e.g. "dispatch latency fast lane")')
-    })).optional().describe("Sanctioned tight couplings with peers \u2014 required to acknowledge a mutual subsystem dependency; the Adapter \u2192 published Portal shape still applies."),
+    }).strict()).optional().describe("Sanctioned tight couplings with peers \u2014 required to acknowledge a mutual subsystem dependency; the Adapter \u2192 published Portal shape still applies."),
     lifecycle: import_zod11.z.array(import_zod11.z.object({
       phase: import_zod11.z.enum(["init", "shutdown", "cyclic", "interrupt", "scheduled"]).describe("Which lifecycle/execution flow this roots (cyclic = every scan/tick, interrupt = hardware/OS interrupt, scheduled = timer/cron)"),
       component: import_zod11.z.string().describe("Component id whose method the runtime invokes at this phase"),
       method: import_zod11.z.string().describe("Method name on that component's interface"),
       description: import_zod11.z.string().optional()
-    })).optional().describe("Declared execution-flow roots \u2014 reachability entrypoints alongside Portals/Observers. Only init flows feed the durable-Store hydration check (MISSING_HYDRATION); cyclic/interrupt/scheduled root non-request/response execution models (PLC scan, ISR, cron).")
+    }).strict()).optional().describe("Declared execution-flow roots \u2014 reachability entrypoints alongside Portals/Observers. Only init flows feed the durable-Store hydration check (MISSING_HYDRATION); cyclic/interrupt/scheduled root non-request/response execution models (PLC scan, ISR, cron)."),
+    status: statusInput
   };
   const subsystemInputFields = [...Object.keys(subsystemInput), "parentSystem"];
   reg(
     server,
     "sdd_add_subsystem",
     {
-      description: "Add an L1 Subsystem / Service under the system boundary. publicInterfaces should bind each entry to the component that realizes it (the subsystem's published surface); if components do not exist yet, add them later with sdd_set_public_interfaces. Re-running it on an existing id RE-AUTHORS it: the fields above are replaced, lint/ext are carried forward.",
+      description: "Add an L1 Subsystem / Service under the system boundary. publicInterfaces should bind each entry to the component that realizes it (the subsystem's published surface); if components do not exist yet, add them later with sdd_set_public_interfaces. Re-running it on an existing id RE-AUTHORS it: the fields above are replaced, lint/ext are carried forward, and the stored status is kept unless this input states a higher one.",
       inputSchema: subsystemInput
     },
-    ({ id, name, description, publicInterfaces, projectPath, targetLanguage, profile, designDepth, trustedLinks, lifecycle }) => {
+    ({ id, name, description, publicInterfaces, projectPath, targetLanguage, profile, designDepth, trustedLinks, lifecycle, status: status2 }) => {
       try {
         const { loadSystemSpec: loadSystemSpec3, loadSubsystemSpec: loadSubsystemSpec2, saveSubsystemSpec: saveSubsystemSpec2 } = requireSpecs();
         const system = loadSystemSpec3();
         if (!system) return errText("System spec must be initialized (sdd_initialize_system) first.");
         const now = (/* @__PURE__ */ new Date()).toISOString();
         const existing = loadSubsystemSpec2(id);
+        const resolved = statusForCreate(`subsystem "${id}"`, status2, existing);
+        if ("refusal" in resolved) return errText(resolved.refusal);
         const spec = {
           id,
           name,
@@ -27189,7 +27363,7 @@ NOTICE:
           ...designDepth ? { designDepth } : {},
           ...lifecycle ? { lifecycle } : {},
           trustedLinks: trustedLinks ?? [],
-          status: "draft",
+          status: resolved.status,
           createdAt: now,
           updatedAt: now
         };
@@ -27225,7 +27399,7 @@ NOTICE:
           details: import_zod11.z.string(),
           component: import_zod11.z.string().optional().describe("The L2 component id that realizes this interface"),
           interface: import_zod11.z.string().optional().describe("Optional L3 interface id on that component")
-        })).describe("The full replacement list of public interfaces for this subsystem")
+        }).strict()).describe("The full replacement list of public interfaces for this subsystem")
       }
     },
     ({ subsystem, publicInterfaces }) => {
@@ -27382,35 +27556,39 @@ NOTICE:
       component: import_zod11.z.string().describe("Component id serving this capability (must also appear under dependsOn/owns)"),
       method: import_zod11.z.string().describe("Method name on the serving component's interface"),
       description: import_zod11.z.string().optional()
-    })).optional().describe("Portal-only: capability \u2192 component.method dispatch table for generic-handle portals. Gives the reachability walker real edges and is validated against target interfaces (UNSERVED_CAPABILITY)."),
+    }).strict()).optional().describe("Portal-only: capability \u2192 component.method dispatch table for generic-handle portals. Gives the reachability walker real edges and is validated against target interfaces (UNSERVED_CAPABILITY)."),
     durability: import_zod11.z.enum(["ram-projection", "durable", "read-through", "cache"]).optional().describe("Store-only \u2014 OMIT IT on any other componentType, where it is refused at the write (DURABILITY_ON_NON_STORE) and nothing is saved. Every Store should declare one (MISSING_DURABILITY): durable = persisted RAM projection (hydration read-back from a lifecycle init entrypoint required \u2014 MISSING_HYDRATION); read-through = persisted with no RAM copy (every read is the read-back, hydration exempt); ram-projection = rebuilt not restored; cache = evictable loss-safe memo state."),
     dependencyClass: import_zod11.z.enum(["pure", "read"]).optional().describe("Orchestrator-only \u2014 OMIT IT on any other componentType, where it is refused at the write (DEPENDENCY_CLASS_ON_NON_ORCHESTRATOR) and nothing is saved. Declares what logic may depend on, enforced as a Store's durability is (DEPENDENCY_CLASS_VIOLATION): pure = depends only on pure Orchestrators (a computation over the values it is handed, e.g. an arbiter or codec); read = also on read Orchestrators, Repositories, Indexes and Adapters, never calling their write methods; unset = a workflow."),
     emits: import_zod11.z.array(import_zod11.z.object({
       topic: import_zod11.z.string().describe("Topic/channel name exactly as used on the bus"),
       event: import_zod11.z.string().optional().describe("Optional event name within the topic (informational; pairing is by topic)"),
       description: import_zod11.z.string().optional()
-    })).optional().describe("Topics this component publishes \u2014 every emitted topic needs a subscriber somewhere in the tree (UNCONSUMED_TOPIC)."),
+    }).strict()).optional().describe("Topics this component publishes \u2014 every emitted topic needs a subscriber somewhere in the tree (UNCONSUMED_TOPIC)."),
     subscribesTo: import_zod11.z.array(import_zod11.z.object({
       topic: import_zod11.z.string().describe("Topic/channel name exactly as used on the bus"),
       event: import_zod11.z.string().optional(),
       description: import_zod11.z.string().optional()
-    })).optional().describe("Topics this component consumes (typical on Observers) \u2014 every subscription needs an emitter somewhere in the tree (UNSOURCED_SUBSCRIPTION)."),
-    ext: import_zod11.z.record(import_zod11.z.unknown()).optional().describe('Opaque pack/tool extension data (namespaced keys, e.g. "mypack:priority") \u2014 preserved verbatim, never validated or interpreted by the core')
+    }).strict()).optional().describe("Topics this component consumes (typical on Observers) \u2014 every subscription needs an emitter somewhere in the tree (UNSOURCED_SUBSCRIPTION)."),
+    ext: import_zod11.z.record(import_zod11.z.unknown()).optional().describe('Opaque pack/tool extension data (namespaced keys, e.g. "mypack:priority") \u2014 preserved verbatim, never validated or interpreted by the core'),
+    status: statusInput
   };
   const componentInputFields = Object.keys(componentInput);
   reg(
     server,
     "sdd_add_component",
     {
-      description: `Add an L2 Component under a subsystem. componentType is a building block (Portal, Orchestrator, Supervisor, Actor, Store, Index, Query, Registry, Adapter, Observer) or the pattern Repository. Specialist and Gateway are retired (STEREOTYPE_RETIRED) and cannot be authored: logic is an Orchestrator with a dependencyClass (pure | read; unset = a workflow), and a gateway is a Portal with the gateway variant (set variant with sdd_update_spec). Patterns set "owns" (their private member blocks); all components set "dependsOn" (collaborators \u2014 facades or standalone blocks). Held/persisted state (configs, permissions, sessions, caches): model the Repository recipe \u2014 a Store + Registry (write) + Index (read), plus a Query for computed reads over the Store, owned by a Repository facade consumers depend on; a deliberately standalone Store is the sanctioned lightweight form (workflow-layer consumers + lint.allow on UNOWNED_STORE). Never hold state as fields inside an Orchestrator because a Store link was refused. Re-running it on an existing id RE-AUTHORS it: the fields above are replaced (an omitted array is CLEARED), while lint.allow, a Portal's auth, variant, patterns and externalLinks are carried forward \u2014 edit those with sdd_update_spec.`,
+      description: `Add an L2 Component under a subsystem. componentType is a building block (Portal, Orchestrator, Supervisor, Actor, Store, Index, Query, Registry, Adapter, Observer) or the pattern Repository. Specialist and Gateway are retired (STEREOTYPE_RETIRED) and cannot be authored: logic is an Orchestrator with a dependencyClass (pure | read; unset = a workflow), and a gateway is a Portal with the gateway variant (set variant with sdd_update_spec). Patterns set "owns" (their private member blocks); all components set "dependsOn" (collaborators \u2014 facades or standalone blocks). Held/persisted state (configs, permissions, sessions, caches): model the Repository recipe \u2014 a Store + Registry (write) + Index (read), plus a Query for computed reads over the Store, owned by a Repository facade consumers depend on; a deliberately standalone Store is the sanctioned lightweight form (workflow-layer consumers + lint.allow on UNOWNED_STORE). Never hold state as fields inside an Orchestrator because a Store link was refused. Re-running it on an existing id RE-AUTHORS it: the fields above are replaced (an omitted array is CLEARED), while lint.allow, a Portal's auth, variant, patterns and externalLinks are carried forward \u2014 edit those with sdd_update_spec. The stored status is kept unless this input states a higher one.`,
       inputSchema: componentInput
     },
-    ({ id, name, description, subsystem, componentType, owns, dependsOn, portalType, basePath, dispatch, durability, dependencyClass, emits, subscribesTo, ext }) => {
+    ({ id, name, description, subsystem, componentType, owns, dependsOn, portalType, basePath, dispatch, durability, dependencyClass, emits, subscribesTo, ext, status: status2 }) => {
       try {
         const { loadSubsystemSpec: loadSubsystemSpec2, loadComponentSpec: loadComponentSpec2 } = requireSpecs();
         const sub = loadSubsystemSpec2(subsystem);
         if (!sub) return errText(`Parent subsystem "${subsystem}" does not exist.`);
         const now = (/* @__PURE__ */ new Date()).toISOString();
+        const existing = loadComponentSpec2(id);
+        const resolved = statusForCreate(`component "${id}"`, status2, existing);
+        if ("refusal" in resolved) return errText(resolved.refusal);
         const candidate = {
           id,
           name,
@@ -27427,11 +27605,10 @@ NOTICE:
           ...emits ? { emits } : {},
           ...subscribesTo ? { subscribesTo } : {},
           ...ext ? { ext } : {},
-          status: "draft",
+          status: resolved.status,
           createdAt: now,
           updatedAt: now
         };
-        const existing = loadComponentSpec2(id);
         const carried = carryUnexpressed(existing, candidate, componentInputFields);
         const cleared = clearedByOmission(existing, candidate, componentInputFields);
         if (existing) candidate.createdAt = existing.createdAt;
@@ -27464,18 +27641,18 @@ NOTICE:
       type: import_zod11.z.string().describe('A primitive/builtin or a defined type id (e.g. "billing.Invoice")'),
       description: import_zod11.z.string().optional(),
       optional: import_zod11.z.boolean().optional()
-    })).optional().describe("Structured parameters \u2014 authoritative for type checking (the prose signature becomes display-only). Strongly preferred."),
+    }).strict()).optional().describe("Structured parameters \u2014 authoritative for type checking (the prose signature becomes display-only). Strongly preferred."),
     guarantees: import_zod11.z.array(import_zod11.z.string().min(1)).optional().describe("Semantic guarantees the method promises (combinable); any guarantee a narrative step asserts must be declared here. Builtin tokens: idempotent | atomic | transactional | exactly-once; extension packs may declare more (any other token is UNKNOWN_GUARANTEE)"),
     effect: import_zod11.z.enum(["read", "write"]).optional().describe("State-effect direction on the component's held state \u2014 required on a durable Store's contract methods so the durability round-trip rule can pair writes with hydration read-backs"),
     invokedBy: import_zod11.z.object({
       kind: import_zod11.z.enum(["runtime", "external", "sibling-subsystem"]).describe("Who owns the out-of-graph invocation: runtime (timer/signal/shutdown hook), external (a system outside this project), sibling-subsystem (a modeled sibling whose edge is not narrated here)"),
       caller: import_zod11.z.string().optional().describe("WHO invokes it and when, as reviewable prose \u2014 missing or placeholder-thin prose is INVOKED_BY_UNDESCRIBED")
-    }).optional().describe("Typed acknowledgment of a real caller OUTSIDE the modeled narrative graph. Unused-detection seeds the method as an entrypoint so reachability propagates through its narrative (unlike lint.allow); a method the internal walk already reaches is flagged stale (INVOKED_BY_REDUNDANT). Prefer a `register` narrative step when the wiring is internal."),
+    }).strict().optional().describe("Typed acknowledgment of a real caller OUTSIDE the modeled narrative graph. Unused-detection seeds the method as an entrypoint so reachability propagates through its narrative (unlike lint.allow); a method the internal walk already reaches is flagged stale (INVOKED_BY_REDUNDANT). Prefer a `register` narrative step when the wiring is internal."),
     findings: import_zod11.z.array(import_zod11.z.object({
       code: import_zod11.z.string().describe("UPPER_SNAKE finding code, unique within the method; a pack's codes carry the pack prefix (<PACK>_<CODE>)"),
       severity: import_zod11.z.enum(["error", "warning"]).describe("Default severity, before project severity overrides and draft-context downgrades"),
       summary: import_zod11.z.string().describe("One line saying what the finding means")
-    })).optional().describe("The finding codes this method can report, each with its default severity and summary. Each declared code must be anchored in the method's source file, as a string literal or a property-access name (UNREALIZED_FINDING). A code is declared once per method; sdd_update_spec upserts and deletes findings by code."),
+    }).strict()).optional().describe("The finding codes this method can report, each with its default severity and summary. Each declared code must be anchored in the method's source file, as a string literal or a property-access name (UNREALIZED_FINDING). A code is declared once per method; sdd_update_spec upserts and deletes findings by code."),
     ext: import_zod11.z.record(import_zod11.z.unknown()).optional().describe("Opaque pack/tool extension data for this method (namespaced keys) \u2014 preserved verbatim")
   };
   const interfaceMethodInputFields = Object.keys(interfaceMethodShape);
@@ -27484,23 +27661,26 @@ NOTICE:
     name: import_zod11.z.string().describe("Human-readable contract name"),
     description: import_zod11.z.string().describe("Contract description and obligations"),
     component: import_zod11.z.string().describe("The L2 component ID this interface belongs to"),
-    methods: import_zod11.z.array(import_zod11.z.object(interfaceMethodShape)).optional().describe("List of method signature contracts")
+    methods: import_zod11.z.array(import_zod11.z.object(interfaceMethodShape).strict()).optional().describe("List of method signature contracts"),
+    status: statusInput
   };
   const interfaceInputFields = Object.keys(interfaceInput);
   reg(
     server,
     "sdd_define_interface",
     {
-      description: "Define an L3 Contract / Interface with method signatures for a component. Prefer supplying structured `params` per method \u2014 they are the authoritative source for type checking (the free-form signature string then becomes display-only and is never heuristically parsed). A method declares the finding codes it reports in `findings` ({code, severity, summary}); each code must be anchored in the method's source file, as a string literal or a property-access name (UNREALIZED_FINDING). Re-defining an existing id REPLACES the method list: a method left out of the input is REMOVED (and reported); spec-level lint/ext and each method's endpoint binding are carried forward.",
+      description: "Define an L3 Contract / Interface with method signatures for a component. Prefer supplying structured `params` per method \u2014 they are the authoritative source for type checking (the free-form signature string then becomes display-only and is never heuristically parsed). A method declares the finding codes it reports in `findings` ({code, severity, summary}); each code must be anchored in the method's source file, as a string literal or a property-access name (UNREALIZED_FINDING). Re-defining an existing id REPLACES the method list: a method left out of the input is REMOVED (and reported); spec-level lint/ext and each method's endpoint binding are carried forward, and the stored status is kept unless this input states a higher one.",
       inputSchema: interfaceInput
     },
-    ({ id, name, description, component, methods }) => {
+    ({ id, name, description, component, methods, status: status2 }) => {
       try {
         const { loadComponentSpec: loadComponentSpec2, loadInterfaceSpec: loadInterfaceSpec2, saveInterfaceSpec: saveInterfaceSpec2 } = requireSpecs();
         const comp = loadComponentSpec2(component);
         if (!comp) return errText(`Component "${component}" does not exist.`);
         const now = (/* @__PURE__ */ new Date()).toISOString();
         const existing = loadInterfaceSpec2(id);
+        const resolved = statusForCreate(`interface "${id}"`, status2, existing);
+        if ("refusal" in resolved) return errText(resolved.refusal);
         const carried = [];
         const specMethods = (methods ?? []).map((m) => {
           const prev = existing?.methods.find((p) => p.name === m.name);
@@ -27516,7 +27696,7 @@ NOTICE:
           description,
           component,
           methods: specMethods,
-          status: "draft",
+          status: resolved.status,
           createdAt: now,
           updatedAt: now
         };
@@ -27567,7 +27747,7 @@ NOTICE:
           channel: import_zod11.z.string().optional().describe("IPC: channel name"),
           command: import_zod11.z.string().optional().describe("CLI: command/subcommand"),
           address: import_zod11.z.string().optional().describe("Custom: free-form address")
-        })).describe("One binding per method")
+        }).strict()).describe("One binding per method")
       }
     },
     ({ interface: interfaceId, endpoints }) => {
@@ -27624,7 +27804,7 @@ NOTICE:
     type: import_zod11.z.enum(["local", "call", "dispatch", "register", "branch", "switch", "loop", "try", "parallel", "jump", "return", "throw"]),
     targetComponent: import_zod11.z.string().optional().describe("call/register/dispatch: L2 component id (for dispatch, the Portal routed through)"),
     targetMethod: import_zod11.z.string().optional().describe("call/register: method name on the target. A register step hands the target method to the runtime as a callback (timer, event listener, shutdown hook): reachability follows the edge, but it is never an invocation \u2014 exempt from call-graph conformance, call-cycle detection, and the durability boot walk"),
-    auth: import_zod11.z.object({ from: import_zod11.z.string(), note: import_zod11.z.string().optional() }).optional().describe("call/dispatch: the credential this step presents to an AUTHED callee Portal and WHERE it loads from (`from`). Opaque form (env:API_KEY, a config key, vault:path) = a design note wairon never resolves; modeled form `component:<id>` references the Adapter/Store that provides the secret and is validated (must resolve, be an Adapter/Store, and be wired to the presenter). Absence on a call into a Portal whose auth \u2260 none warns (PORTAL_AUTH_UNMET). The authenticated call itself should be made by an Adapter (AUTH_PRESENTER_NOT_ADAPTER)."),
+    auth: import_zod11.z.object({ from: import_zod11.z.string(), note: import_zod11.z.string().optional() }).strict().optional().describe("call/dispatch: the credential this step presents to an AUTHED callee Portal and WHERE it loads from (`from`). Opaque form (env:API_KEY, a config key, vault:path) = a design note wairon never resolves; modeled form `component:<id>` references the Adapter/Store that provides the secret and is validated (must resolve, be an Adapter/Store, and be wired to the presenter). Absence on a call into a Portal whose auth \u2260 none warns (PORTAL_AUTH_UNMET). The authenticated call itself should be made by an Adapter (AUTH_PRESENTER_NOT_ADAPTER)."),
     detach: import_zod11.z.boolean().optional().describe("call/dispatch: fire-and-forget \u2014 issue the call and continue without awaiting the result (no later step consumes it)"),
     capability: import_zod11.z.string().optional().describe("dispatch: the capability routed through the target Portal's dispatch table (validated against it \u2014 UNSERVED_CAPABILITY)"),
     assertsGuarantees: import_zod11.z.array(import_zod11.z.string().min(1)).optional().describe("Semantic guarantees this step relies on \u2014 each must be declared in the called method's L3 guarantees (NARRATIVE_SEMANTIC_UNBACKED otherwise). Builtin tokens: idempotent | atomic | transactional | exactly-once; extension packs may declare more (any other token is UNKNOWN_GUARANTEE)"),
@@ -27635,22 +27815,22 @@ NOTICE:
     onFalseStep: stepNo().optional().describe("branch: required (or onFalseLabel)"),
     onFalseLabel: labelRef().optional().describe("branch: symbolic alternative to onFalseStep"),
     on: import_zod11.z.string().optional().describe("switch: the dispatched value"),
-    cases: import_zod11.z.array(import_zod11.z.object({ value: import_zod11.z.string(), step: stepNo().optional(), label: labelRef().optional() })).optional().describe("switch: required; each case targets its region by step number or label"),
+    cases: import_zod11.z.array(import_zod11.z.object({ value: import_zod11.z.string(), step: stepNo().optional(), label: labelRef().optional() }).strict()).optional().describe("switch: required; each case targets its region by step number or label"),
     defaultStep: stepNo().optional().describe("switch: default = next step"),
     defaultLabel: labelRef().optional().describe("switch: symbolic alternative to defaultStep"),
     loopKind: import_zod11.z.enum(["forEach", "for", "while", "doWhile"]).optional().describe('loop: default forEach when "over" is set, else while'),
     over: import_zod11.z.string().optional().describe("loop forEach/for: iteration source"),
     endStep: stepNo().optional().describe("loop/try: last step of the body region (required, or endLabel)"),
     endLabel: labelRef().optional().describe("loop/try: symbolic alternative to endStep"),
-    catches: import_zod11.z.array(import_zod11.z.object({ error: import_zod11.z.string(), step: stepNo().optional(), label: labelRef().optional() })).optional().describe("try: handler regions, each targeted by step number or label"),
+    catches: import_zod11.z.array(import_zod11.z.object({ error: import_zod11.z.string(), step: stepNo().optional(), label: labelRef().optional() }).strict()).optional().describe("try: handler regions, each targeted by step number or label"),
     finallyStep: stepNo().optional().describe("try: first step of the always-runs region"),
     finallyLabel: labelRef().optional().describe("try: symbolic alternative to finallyStep"),
-    branches: import_zod11.z.array(import_zod11.z.object({ step: stepNo().optional(), label: labelRef().optional(), name: import_zod11.z.string().optional() })).optional().describe("parallel: >= 2 arm entries (step number or label), ascending, first = the step after the header; arms are contiguous sub-regions of body next..endStep, joining after endStep once ALL complete"),
+    branches: import_zod11.z.array(import_zod11.z.object({ step: stepNo().optional(), label: labelRef().optional(), name: import_zod11.z.string().optional() }).strict()).optional().describe("parallel: >= 2 arm entries (step number or label), ascending, first = the step after the header; arms are contiguous sub-regions of body next..endStep, joining after endStep once ALL complete"),
     toStep: stepNo().optional().describe("jump: required (break/continue/rejoin), or toLabel"),
     toLabel: labelRef().optional().describe("jump: symbolic alternative to toStep \u2014 resolves to the labeled step at write time"),
     outcome: import_zod11.z.string().optional().describe('return: e.g. "success", "not found"'),
     error: import_zod11.z.string().optional().describe("throw: the raised error")
-  });
+  }).strict();
   const detailEnum = import_zod11.z.enum(["full", "calls-only", "intent"]);
   const conformanceEnum = import_zod11.z.enum(["declared", "anchored", "off"]);
   const implMethodShape = {
@@ -27674,22 +27854,25 @@ NOTICE:
     technologies: import_zod11.z.array(import_zod11.z.string()).optional().describe(`External technologies this implementation binds to (e.g. ["mysql"]) \u2014 declares this component's ownership tree as the technology's home; references outside it are flagged (TECH_LEAKAGE) and contract identifiers must stay intent-language. Only for Adapter/Store/Registry/Index components.`),
     detail: detailEnum.optional().describe("Spec-level narrative detail default for all methods"),
     conformance: conformanceEnum.optional().describe("Spec-level conformance tier default: declared | anchored | off (omitted = stereotype default: Portal \u2192 anchored, else declared)"),
-    methods: import_zod11.z.array(import_zod11.z.object(implMethodShape)).optional().describe("Method implementations containing L5 narratives")
+    methods: import_zod11.z.array(import_zod11.z.object(implMethodShape).strict()).optional().describe("Method implementations containing L5 narratives"),
+    status: statusInput
   };
   const implInputFields = Object.keys(implInput);
   reg(
     server,
     "sdd_write_narrative",
     {
-      description: "Write L4 Concrete Implementation spec containing L5 method narratives. Narratives are a FLAT ordered step list; flow steps (branch/switch/loop/try/parallel/jump/return/throw) jump by step number \u2014 blocks are just skipped regions. Steps may declare a `label` anchor, and every jump field has a *Label twin (toLabel, onTrueLabel, endLabel, \u2026) resolved to step numbers at write time \u2014 prefer labels over hand-counted numbers; an unresolvable label rejects the write. Detail dial per method: full (narrative required) | calls-only (call choreography suffices) | intent (prose instead of steps); omitted = stereotype default (Portal/Observer/Adapter: calls-only, Store/Index/Registry: intent, else full). Conformance dial per method or spec: declared | anchored | off \u2014 how strictly structural conformance requires contract methods to be realized in their source file (omitted = Portal: anchored, else declared). A method whose body lives in its own file names it in the method's sourcePath; the implementation's sourcePath is the default for every method that names none. Re-authoring an existing id REPLACES the method list: a method left out of the input is REMOVED together with its narrative (and reported); spec-level lint/ext are carried forward.",
+      description: "Write L4 Concrete Implementation spec containing L5 method narratives. Narratives are a FLAT ordered step list; flow steps (branch/switch/loop/try/parallel/jump/return/throw) jump by step number \u2014 blocks are just skipped regions. Steps may declare a `label` anchor, and every jump field has a *Label twin (toLabel, onTrueLabel, endLabel, \u2026) resolved to step numbers at write time \u2014 prefer labels over hand-counted numbers; an unresolvable label rejects the write. Detail dial per method: full (narrative required) | calls-only (call choreography suffices) | intent (prose instead of steps); omitted = stereotype default (Portal/Observer/Adapter: calls-only, Store/Index/Registry: intent, else full). Conformance dial per method or spec: declared | anchored | off \u2014 how strictly structural conformance requires contract methods to be realized in their source file (omitted = Portal: anchored, else declared). A method whose body lives in its own file names it in the method's sourcePath; the implementation's sourcePath is the default for every method that names none. Re-authoring an existing id REPLACES the method list: a method left out of the input is REMOVED together with its narrative (and reported); spec-level lint/ext are carried forward, and the stored status is kept unless this input states a higher one.",
       inputSchema: implInput
     },
-    ({ id, name, description, contract, sourcePath, simPath, technologies, detail, conformance, methods }) => {
+    ({ id, name, description, contract, sourcePath, simPath, technologies, detail, conformance, methods, status: status2 }) => {
       try {
         const { loadInterfaceSpec: loadInterfaceSpec2, loadImplementationSpec: loadImplementationSpec2, saveImplementationSpec: saveImplementationSpec2 } = requireSpecs();
         const intf = loadInterfaceSpec2(contract);
         if (!intf) return errText(`Interface contract "${contract}" does not exist.`);
         const existing = loadImplementationSpec2(id);
+        const resolved = statusForCreate(`implementation "${id}"`, status2, existing);
+        if ("refusal" in resolved) return errText(resolved.refusal);
         const carried = [];
         const resolvedMethods = (methods ?? []).map((m) => {
           const prev = existing?.methods.find((p) => p.name === m.name);
@@ -27719,7 +27902,7 @@ NOTICE:
           // Post-resolution every cases/catches entry has its numeric step —
           // the *Label twins exist only in the input type, not the spec's.
           methods: resolvedMethods,
-          status: "draft",
+          status: resolved.status,
           createdAt: now,
           updatedAt: now
         };
@@ -27760,13 +27943,13 @@ NOTICE:
       optional: import_zod11.z.boolean().optional(),
       key: import_zod11.z.enum(["primary", "unique", "foreign"]).optional().describe("Identity marker (PK/unique/FK) for ERD and database schema derivation"),
       references: import_zod11.z.string().optional().describe('For foreign keys, the referenced type/table id and optional field, e.g. "invoice.id"')
-    })).optional().describe('Data fields (type is a primitive or a qualified type id, e.g. "billing.Invoice")'),
-    methods: import_zod11.z.array(import_zod11.z.object({ name: import_zod11.z.string(), signature: import_zod11.z.string(), returns: import_zod11.z.string(), description: import_zod11.z.string().optional() })).optional().describe("Pure intrinsic methods only"),
+    }).strict()).optional().describe('Data fields (type is a primitive or a qualified type id, e.g. "billing.Invoice")'),
+    methods: import_zod11.z.array(import_zod11.z.object({ name: import_zod11.z.string(), signature: import_zod11.z.string(), returns: import_zod11.z.string(), description: import_zod11.z.string().optional() }).strict()).optional().describe("Pure intrinsic methods only"),
     componentClass: import_zod11.z.string().optional().describe("Optional component id that implements or owns this logical entity"),
     invariants: import_zod11.z.array(import_zod11.z.object({
       id: import_zod11.z.string().describe("Stable invariant id, unique within the entity"),
       description: import_zod11.z.string().describe("The property that must hold, stated precisely")
-    })).optional().describe("Declared domain invariants (entities): every write-effect method of the componentClass must carry a narrative step asserting each (assertsInvariants) \u2014 declarations checked, enforcement never proven"),
+    }).strict()).optional().describe("Declared domain invariants (entities): every write-effect method of the componentClass must carry a narrative step asserting each (assertsInvariants) \u2014 declarations checked, enforcement never proven"),
     database: import_zod11.z.string().optional().describe("Optional database id for table-schema types"),
     table: import_zod11.z.string().optional().describe("Optional database table name for table-schema types"),
     linkedEntity: import_zod11.z.string().optional().describe("Optional logical entity id represented by this table-schema type")
@@ -27870,13 +28053,14 @@ NOTICE:
     server,
     "sdd_get_spec",
     {
-      description: `Get/read the parsed JSON contents of a specific spec from the spec tree. Returns structural contents without file system path searching. For a variant-tagged COMPONENT the result also carries a derived, read-only "variantGuidance" (the variant's base, its implementation guidance, and the same-variant sibling components to implement alike) \u2014 it is resolved from the variant registry, not part of the spec, so never write it back.`,
+      description: `Get/read the parsed JSON contents of a specific spec from the spec tree. Returns structural contents without file system path searching. Pass "methods" to read only the named methods of a contract, an implementation or a type \u2014 a 45-method spec fetched whole to look at one of them is the read side of the same waste a restatement is on the write side; the answer then carries a "partialResult" marker naming what was left out, and must never be re-authored from. For a variant-tagged COMPONENT the result also carries a derived, read-only "variantGuidance" (the variant's base, its implementation guidance, and the same-variant sibling components to implement alike) \u2014 it is resolved from the variant registry, not part of the spec, so never write it back.`,
       inputSchema: {
         kind: import_zod11.z.enum(["system", "subsystem", "component", "interface", "implementation", "type"]).describe("The kind of specification"),
-        id: import_zod11.z.string().describe('The identifier of the spec to fetch (the L0 system spec is a singleton \u2014 pass the system name or "system")')
+        id: import_zod11.z.string().describe('The identifier of the spec to fetch (the L0 system spec is a singleton \u2014 pass the system name or "system")'),
+        methods: import_zod11.z.array(import_zod11.z.string().min(1)).optional().describe("Return only these methods by name; every other field of the spec comes back unchanged. Only an interface, an implementation or a type declares methods \u2014 asking for one elsewhere is refused, as is a name the spec does not declare (the answer names the ones it does). Omit it for the whole spec.")
       }
     },
-    ({ kind, id }) => {
+    ({ kind, id, methods }) => {
       try {
         const specs = requireSpecs();
         let result = null;
@@ -27901,6 +28085,31 @@ NOTICE:
             break;
         }
         if (!result) return errText(`Spec of kind "${kind}" with ID "${id}" does not exist.`);
+        if (methods !== void 0) {
+          const declared = result.methods;
+          if (!Array.isArray(declared)) {
+            return errText(
+              `A ${kind} spec declares no methods, so "methods" cannot filter it. Drop the argument to read "${id}" whole; methods live on an interface, an implementation and a type.`
+            );
+          }
+          const names = declared.map((m) => String(m?.name));
+          const unknown = methods.filter((n) => !names.includes(n));
+          if (unknown.length > 0) {
+            return errText(
+              `${kind} "${id}" does not declare ${unknown.map((n) => `"${n}"`).join(", ")}. It declares: ${names.join(", ")}. Nothing was returned, so a misspelled name never reads as a method with no content.`
+            );
+          }
+          const kept = declared.filter((m) => methods.includes(String(m?.name)));
+          result = {
+            ...result,
+            methods: kept,
+            partialResult: {
+              shown: kept.map((m) => String(m?.name)),
+              omitted: names.length - kept.length,
+              warning: `PARTIAL: ${names.length - kept.length} of this spec's ${names.length} methods are not in this answer. Never re-author from it \u2014 sdd_define_interface and sdd_write_narrative REPLACE the method list, so every method missing here would be removed from the spec.`
+            }
+          };
+        }
         if (kind === "component") {
           const guidance = resolveComponentVariantGuidance(result);
           if (guidance) return json({ ...result, variantGuidance: guidance });
@@ -27953,16 +28162,17 @@ NOTICE:
     server,
     "sdd_update_spec",
     {
-      description: "Update/patch an existing SDD specification (subsystem, component, interface, implementation, or type) using a granular delta. Updates fields, appends/merges array elements, or inserts/deletes narrative steps.",
+      description: "Update/patch an existing SDD specification (subsystem, component, interface, implementation, or type) using a granular delta. Updates fields, appends/merges array elements, or inserts/deletes narrative steps. Answers with exactly what changed, and with every path the delta named that the write did not act on. Pass dryRun to be told what it would do without writing it.",
       inputSchema: {
         kind: import_zod11.z.enum(["system", "subsystem", "component", "interface", "implementation", "type"]).describe("The spec kind to update (system = the singleton L0 \u2014 vision, boundaries, globalRequirements, databases, and publicInterfaces: the project gateway surface, each entry {id, name, subsystem, component, type, details, audience: project|department|instance|partner|external}; id is informational)"),
         id: import_zod11.z.string().describe("The ID of the spec to update (namespaced if needed)"),
-        delta: import_zod11.z.record(import_zod11.z.any()).describe(`The partial fields to merge into the spec. ARRAYS UPSERT, they do not replace: an array whose elements carry an identity is merged element-by-element, so a delta naming ONE element leaves the others intact. Identity is "name" or "id" by default, and per field: dispatch by "capability", lifecycle by phase+component+method, emits/subscribesTo by topic+event, trustedLinks by "subsystem", invariants and patterns by "id", lint.allow by "code", an interface method's findings by "code", boundaries by "name", globalRequirements by "description", switch cases by "value", try catches by "error". Identity merging applies at EVERY depth, including an array INSIDE an element (a method's params, a step's catches). Add "action: 'delete'" (or "remove: true") alongside that identity to REMOVE an element \u2014 including a stale lint allow. Arrays of plain STRINGS (owns, dependsOn, guarantees) carry no per-element identity and are replaced wholesale; pass [] to clear any array outright. To REMOVE an optional field entirely, list it in "unset": e.g. {"unset": ["basePath", "variant"]} \u2014 passing null/undefined means "no change" (they are skipped), and writing "" would leave the field present but empty, which is a different and usually wrong spec. Unsetting a required field is refused by schema validation, which names it. For narrative steps, match by "stepNumber" and use "action: 'insert'" (shifts subsequent steps up) or "action: 'delete'" (shifts subsequent steps down and removes it). Step entries apply in ASCENDING stepNumber order, each against the numbering the earlier entries of the SAME delta left behind \u2014 delete step 3 and step 7 becomes step 6 \u2014 so prefer labels, and restate the step's "label" or "description" on a delete to have it checked against the step actually addressed. Renumbering RELOCATES every flow jump field (onTrueStep/onFalseStep/cases.step/defaultStep/endStep/catches.step/finallyStep/toStep) in the same narrative. A delete is REJECTED when the narrative has no such step, when a jump still targets it (retarget the referrers first), when a restated label/description does not match, or when it is a loop/try/parallel header whose body would be left standing (retype the header first to dissolve the region, then delete it). Changing a step's "type" REBUILDS it for the new type: its description and label are kept and every field the new type cannot carry is dropped (returned as a NOTICE); a delta that retypes AND sets such a field is refused. A step delta is also refused when it carries a marker the merge does not recognise: a non-boolean "remove", an "action" that is neither "insert" nor "delete", a "captureJumps" outside an insert, or no "stepNumber" to address. Inserting AT a jump target relocates those jumps past the inserted step by default (a NOTICE is returned) \u2014 add "captureJumps": true on the inserted step to retarget entry jumps onto it (loop/try endStep region tails always relocate with the body and are never captured). Every jump field has a "*Label" twin (toLabel, onFalseLabel, endLabel, \u2026, and "label" on a cases/catches entry) resolved against step labels AFTER the merge, so a delta may anchor on a label only pre-existing steps carry; a label the delta supplies REPLACES the stored number it twins, while setting the number and its label together in one delta is refused as a contradiction. Reference ids in deltas may use LOCAL names \u2014 they are qualified against the spec's namespace exactly as the loader would. Per-spec lint suppression: set "lint: { allow: [{ code, reason }] }" to silence a WARNING code on this spec only (errors always surface; stale allows are flagged).`)
+        delta: import_zod11.z.record(import_zod11.z.any()).describe(`The partial fields to merge into the spec. ARRAYS UPSERT, they do not replace: an array whose elements carry an identity is merged element-by-element, so a delta naming ONE element leaves the others intact. Identity is "name" or "id" by default, and per field: dispatch by "capability", lifecycle by phase+component+method, emits/subscribesTo by topic+event, trustedLinks by "subsystem", invariants and patterns by "id", lint.allow by "code", an interface method's findings by "code", boundaries by "name", globalRequirements by "description", switch cases by "value", try catches by "error". Identity merging applies at EVERY depth, including an array INSIDE an element (a method's params, a step's catches). Add "action: 'delete'" (or "remove: true") alongside that identity to REMOVE an element \u2014 including a stale lint allow. Arrays of plain STRINGS (owns, dependsOn, guarantees) carry no per-element identity and are replaced wholesale; pass [] to clear any array outright. To REMOVE an optional field entirely, list it in "unset": e.g. {"unset": ["basePath", "variant"]} \u2014 passing null/undefined means "no change" (they are skipped), and writing "" would leave the field present but empty, which is a different and usually wrong spec. Unsetting a required field is refused by schema validation, which names it. For narrative steps, match by "stepNumber" and use "action: 'insert'" (shifts subsequent steps up) or "action: 'delete'" (shifts subsequent steps down and removes it). Step entries apply in ASCENDING stepNumber order, each against the numbering the earlier entries of the SAME delta left behind \u2014 delete step 3 and step 7 becomes step 6 \u2014 so prefer labels, and restate the step's "label" or "description" on a delete to have it checked against the step actually addressed. Renumbering RELOCATES every flow jump field (onTrueStep/onFalseStep/cases.step/defaultStep/endStep/catches.step/finallyStep/toStep) in the same narrative. A delete is REJECTED when the narrative has no such step, when a jump still targets it (retarget the referrers first), when a restated label/description does not match, or when it is a loop/try/parallel header whose body would be left standing (retype the header first to dissolve the region, then delete it). Changing a step's "type" REBUILDS it for the new type: its description and label are kept and every field the new type cannot carry is dropped (returned as a NOTICE); a delta that retypes AND sets such a field is refused. A step delta is also refused when it carries a marker the merge does not recognise: a non-boolean "remove", an "action" that is neither "insert" nor "delete", a "captureJumps" outside an insert, or no "stepNumber" to address. Inserting AT a jump target relocates those jumps past the inserted step by default (a NOTICE is returned) \u2014 add "captureJumps": true on the inserted step to retarget entry jumps onto it (loop/try endStep region tails always relocate with the body and are never captured). Every jump field has a "*Label" twin (toLabel, onFalseLabel, endLabel, \u2026, and "label" on a cases/catches entry) resolved against step labels AFTER the merge, so a delta may anchor on a label only pre-existing steps carry; a label the delta supplies REPLACES the stored number it twins, while setting the number and its label together in one delta is refused as a contradiction. Reference ids in deltas may use LOCAL names \u2014 they are qualified against the spec's namespace exactly as the loader would. Per-spec lint suppression: set "lint: { allow: [{ code, reason }] }" to silence a WARNING code on this spec only (errors always surface; stale allows are flagged). This delta is deliberately OPEN below its top level \u2014 the shapes nest further than a schema here should restate \u2014 so a key that is not a field at its depth is not refused, it is NAMED BACK under NO EFFECT in the answer, together with any value the spec already held and any "unset" that removed nothing. Read that list: it is where a nested typo shows up.`),
+        dryRun: import_zod11.z.boolean().optional().describe("Ask what this delta WOULD do instead of doing it. The whole write runs, the candidate gate included, and the answer is the change report it would have produced \u2014 marked DRY RUN, with nothing stamped and not one byte of the stored file moved. Use it before a delta that renumbers a long narrative.")
       }
     },
-    ({ kind, id, delta }) => {
+    ({ kind, id, delta, dryRun }) => {
       try {
-        return text(renderChangeReport(updateSpecGated(kind, id, delta)));
+        return text(renderChangeReport(updateSpecGated(kind, id, delta, dryRun)));
       } catch (e) {
         return errText(String(e));
       }
@@ -28166,7 +28376,7 @@ async function startMcpServer() {
   } catch {
   }
 }
-var import_mcp, import_stdio, import_zod11, import_types3, fs20, path27, import_url, SERVER_BUILD_STAMP, STALE_SERVER_WARNING, SPEC_WRITE_TOOLS, listChangedEmitters, STORE_MANAGED_FIELDS, ALWAYS_CARRIED_FIELDS, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
+var import_mcp, import_stdio, import_zod11, import_types3, fs20, path27, import_url, SERVER_BUILD_STAMP, STALE_SERVER_WARNING, SPEC_WRITE_TOOLS, listChangedEmitters, STORE_MANAGED_FIELDS, STATUS_ORDER, statusInput, ALWAYS_CARRIED_FIELDS, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
 var init_server = __esm({
   "src/mcp/server.ts"() {
     "use strict";
@@ -28219,6 +28429,10 @@ var init_server = __esm({
     ]);
     listChangedEmitters = /* @__PURE__ */ new WeakMap();
     STORE_MANAGED_FIELDS = /* @__PURE__ */ new Set(["status", "updatedAt"]);
+    STATUS_ORDER = ["draft", "design", "complete"];
+    statusInput = import_zod11.z.enum(STATUS_ORDER).optional().describe(
+      "The spec's lifecycle status. Omitted means draft for a NEW spec and the status already stored for a re-authoring, so a restatement never reopens a frozen spec. State it to author straight at design or complete instead of promoting afterwards. A status that would LOWER the stored one is refused \u2014 reopening a spec for revision is sdd_update_spec's job, which sets the demotion deliberately."
+    );
     ALWAYS_CARRIED_FIELDS = /* @__PURE__ */ new Set(["ext"]);
     SKILL_RESOURCE_MIME = "text/markdown";
     AGENT_BRIEF_SCHEME = "wairon-agent://";