@wairon/cli 5.1.1-dev.36 → 5.1.1-dev.38

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.36";
+    WAIRON_VERSION = "5.1.1-dev.38";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     SUPPORTED_ALIASES = ["wai"];
     SCAN_EXCLUDE_DIRS = /* @__PURE__ */ new Set([
@@ -1536,7 +1536,13 @@ var init_specs = __esm({
     GuaranteeSchema = import_zod7.z.string().min(1);
     MethodParamSchema = import_zod7.z.object({
       name: import_zod7.z.string(),
-      /** A primitive/builtin or a defined type id (qualified across subsystems, e.g. "billing.Invoice"). */
+      /**
+       * A primitive/builtin or a defined type id (qualified across subsystems, e.g.
+       * "billing.Invoice"), on its own or inside a generic, an array or a UNION:
+       * `Invoice | null`, `Promise<Invoice | null>`, `Invoice[] | null`. Every
+       * identifier the string names has to resolve — see the grammar on
+       * src/models/type-references.ts.
+       */
       type: import_zod7.z.string(),
       description: import_zod7.z.string().optional(),
       optional: import_zod7.z.boolean().optional()
@@ -1554,8 +1560,9 @@ var init_specs = __esm({
       description: import_zod7.z.string(),
       signature: import_zod7.z.string(),
       // e.g. "save(key: string, data: Buffer): Promise<void>"
+      // e.g. "Promise<void>", or a union: "Invoice | null" — the commonest shape in
+      // any real tree. See the grammar on src/models/type-references.ts.
       returns: import_zod7.z.string(),
-      // e.g. "Promise<void>"
       /** Structured parameters (authoritative for type checking when present). */
       params: import_zod7.z.array(MethodParamSchema).optional(),
       /** Concrete wire binding for this method when its component is a Portal (set via sdd_set_endpoints). */
@@ -1824,8 +1831,10 @@ var init_specs = __esm({
     TypeKindSchema = import_zod7.z.enum(["entity", "value-object"]);
     TypeFieldSchema = import_zod7.z.object({
       name: import_zod7.z.string(),
+      // A primitive, or another type id (qualified across subsystems, e.g.
+      // "billing.Invoice") — on its own or inside a generic, an array or a union
+      // ("Invoice[] | null"). See the grammar on src/models/type-references.ts.
       type: import_zod7.z.string(),
-      // a primitive, or another type id (qualified across subsystems, e.g. "billing.Invoice")
       description: import_zod7.z.string().optional(),
       optional: import_zod7.z.boolean().default(false),
       /**
@@ -23209,6 +23218,7 @@ __export(specs_exports, {
   getSubprojectPrefix: () => getSubprojectPrefix,
   getSubsystemPath: () => getSubsystemPath,
   getTypePath: () => getTypePath,
+  ineffectiveDeltaPaths: () => ineffectiveDeltaPaths,
   inspectChainedRoots: () => inspectChainedRoots,
   invalidateSpecCache: () => invalidateSpecCache,
   listChainedRoots: () => listChainedRoots,
@@ -23727,6 +23737,117 @@ function specChanges(before, after, prefix = "") {
   if (JSON.stringify(before) === JSON.stringify(after)) return [];
   return [{ path: prefix, change: "set", before: summarizeValue(before), after: summarizeValue(after) }];
 }
+function identityFieldsOf(field) {
+  switch (field) {
+    case "dispatch":
+      return ["capability"];
+    case "lifecycle":
+      return ["phase", "component", "method"];
+    case "emits":
+    case "subscribesTo":
+      return ["topic", "event"];
+    case "trustedLinks":
+      return ["subsystem"];
+    case "allow":
+    case "findings":
+      return ["code"];
+    case "invariants":
+    case "patterns":
+      return ["id"];
+    case "boundaries":
+      return ["name"];
+    case "globalRequirements":
+      return ["description"];
+    case "databases":
+      return ["id", "name"];
+    case "cases":
+      return ["value"];
+    case "catches":
+      return ["error"];
+    case "narrative":
+      return ["stepNumber"];
+    default:
+      return ["name", "id"];
+  }
+}
+function carriesEditMarker(item) {
+  if (item === null || typeof item !== "object") return false;
+  const o = item;
+  return o.action !== void 0 || o.remove !== void 0;
+}
+function ineffectiveDeltaPaths(delta, merged, stored) {
+  const out = [];
+  const isPlain = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+  const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
+  const at = (prefix, key) => prefix ? `${prefix}.${key}` : key;
+  const say = (path70, why) => {
+    out.push(`${path70} \u2014 ${why}`);
+  };
+  const walkValue = (d, m, s, path70, field) => {
+    if (Array.isArray(d)) {
+      if (!Array.isArray(m)) {
+        say(path70, "the level does not have this field, so the write dropped it");
+        return;
+      }
+      if (field === "narrative" && d.some(carriesEditMarker)) return;
+      for (const element of d) {
+        if (carriesEditMarker(element)) continue;
+        const key = reportIdentityOf(field, element);
+        if (key === null) {
+          if (!same(m, d)) say(path70, "the level does not keep this value, so the write dropped it");
+          else if (same(s, d)) say(path70, "the stored spec already held this value");
+          return;
+        }
+        const mMatch = m.find((i) => reportIdentityOf(field, i) === key);
+        const sMatch = Array.isArray(s) ? s.find((i) => reportIdentityOf(field, i) === key) : void 0;
+        if (mMatch === void 0) {
+          say(at(path70, key), "the write did not store this element");
+          continue;
+        }
+        walk2(element, mMatch, sMatch, at(path70, key), field);
+      }
+      return;
+    }
+    if (isPlain(d)) {
+      if (!isPlain(m)) {
+        say(path70, "the level does not have this field, so the write dropped it");
+        return;
+      }
+      walk2(d, m, s, path70, field);
+      return;
+    }
+    if (!same(m, d)) say(path70, "the write did not store it \u2014 the level's schema does not keep this value");
+    else if (same(s, d)) say(path70, "the stored spec already held this value");
+  };
+  function walk2(d, m, s, path70, container) {
+    for (const [key, value] of Object.entries(d)) {
+      if (DELTA_VERBS.has(key) || JUMP_LABEL_TWINS.has(key)) continue;
+      if (key === "label" && LABEL_TWIN_CONTAINERS.has(container)) continue;
+      if (identityFieldsOf(container).includes(key)) continue;
+      if (key === "unset") {
+        for (const name of Array.isArray(value) ? value : []) {
+          if (typeof name !== "string") continue;
+          const had = isPlain(s) && s[name] !== void 0;
+          const still = isPlain(m) && m[name] !== void 0;
+          if (!had) say(at(path70, name), "unset named a field the stored spec did not have");
+          else if (still) say(at(path70, name), "unset did not remove it");
+        }
+        continue;
+      }
+      if (value === void 0 || value === null) continue;
+      const here = at(path70, key);
+      const mValue = isPlain(m) ? m[key] : void 0;
+      const sValue = isPlain(s) ? s[key] : void 0;
+      if (mValue === void 0) {
+        say(here, "the level does not have this field, so the write dropped it");
+        continue;
+      }
+      walkValue(value, mValue, sValue, here, key);
+    }
+  }
+  walk2(delta, merged, stored, "", "");
+  return out;
+}
 function workspaceFor(rootDir) {
   const key = path23.resolve(rootDir);
   let ws = workspaces.get(key);
@@ -23952,10 +24073,10 @@ function restoreSpecFiles(snapshot) {
 function findLegacySpecFiles() {
   return current().findLegacySpecFiles();
 }
-function updateSpec(kind, id, delta, hooks) {
-  return current().updateSpec(kind, id, delta, hooks);
+function updateSpec(kind, id, delta, hooks, dryRun) {
+  return current().updateSpec(kind, id, delta, hooks, dryRun);
 }
-var fs17, path23, NO_ROOT_SUBSYSTEMS, SIGNATURE_TTL_MS, SpecWorkspace, workspaces;
+var fs17, path23, NO_ROOT_SUBSYSTEMS, SIGNATURE_TTL_MS, DELTA_VERBS, JUMP_LABEL_TWINS, LABEL_TWIN_CONTAINERS, SpecWorkspace, workspaces;
 var init_specs2 = __esm({
   "src/core/specs.ts"() {
     "use strict";
@@ -23973,6 +24094,16 @@ var init_specs2 = __esm({
     init_diagram();
     NO_ROOT_SUBSYSTEMS = /* @__PURE__ */ new Set();
     SIGNATURE_TTL_MS = 2e3;
+    DELTA_VERBS = /* @__PURE__ */ new Set(["action", "remove", "captureJumps"]);
+    JUMP_LABEL_TWINS = /* @__PURE__ */ new Set([
+      "onTrueLabel",
+      "onFalseLabel",
+      "defaultLabel",
+      "endLabel",
+      "finallyLabel",
+      "toLabel"
+    ]);
+    LABEL_TWIN_CONTAINERS = /* @__PURE__ */ new Set(["cases", "catches", "branches"]);
     SpecWorkspace = class {
       constructor(rootDir) {
         this.cachedIndex = null;
@@ -24688,6 +24819,9 @@ var init_specs2 = __esm({
         const existing = this.loadSubsystemSpec(spec.id);
         if (existing) {
           specToWrite.createdAt = existing.createdAt;
+          if (!opts?.allowStatusDemotion && existing.status && (!spec.status || spec.status === "draft")) {
+            specToWrite.status = existing.status;
+          }
         }
         specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
         writeYamlFile(p, parseOrThrow(SubsystemSpecSchema, specToWrite, "subsystem", spec.id));
@@ -25236,15 +25370,22 @@ var init_specs2 = __esm({
        *     carry, and a label in the delta retargets the stored numeric jump it
        *     twins. An unresolved reference aborts the whole update.
        *  7. COMPARE with what is stored, both read through the level's canonical
-       *     schema. Equal means nothing is written and `written` is false.
-       *  8. GATE the merged spec through the caller's hook, then SAVE.
+       *     schema. Equal means nothing is written and `written` is false. The same
+       *     comparison names every delta path the write did NOT act on — one the
+       *     schema drops at a depth the permissive delta cannot refuse, one the
+       *     stored spec already held, an `unset` that removed nothing.
+       *  8. GATE the merged spec through the caller's hook. A DRY RUN stops here
+       *     and answers with the report it would have produced — after the gate, so
+       *     it accounts for a write that would really be accepted, and before the
+       *     stamp, so not one byte of the stored file moves.
+       *  9. STAMP updatedAt and SAVE.
        *
        * Returns the change report, whose `notices` carry the non-fatal effects (an
        * insert whose position was a jump target, so the relocated jumps now bypass
        * the inserted step; the fields a retype dropped) — empty when the merge had
        * nothing to say.
        */
-      updateSpec(kind, id, delta, hooks) {
+      updateSpec(kind, id, delta, hooks, dryRun = false) {
         const notices = [];
         const result = (() => {
           switch (kind) {
@@ -25723,7 +25864,8 @@ var init_specs2 = __esm({
         const unsetFields = Array.isArray(delta.unset) ? delta.unset.filter((f) => typeof f === "string") : [];
         const { unset: _unset, ...mergeableDelta } = delta;
         const storedBefore = JSON.parse(JSON.stringify(result));
-        const mergedResult = mergeDelta(result, qualifyDeltaRefs(mergeableDelta));
+        const qualifiedDelta = qualifyDeltaRefs(mergeableDelta);
+        const mergedResult = mergeDelta(result, qualifiedDelta);
         for (const field of unsetFields) delete mergedResult[field];
         if (kind === "implementation" && Array.isArray(mergedResult.methods)) {
           const labelErrors = [];
@@ -25741,20 +25883,41 @@ var init_specs2 = __esm({
           delete value.updatedAt;
           return value;
         };
-        const changes = specChanges(canonical(storedBefore), canonical(mergedResult));
+        const canonicalStored = canonical(storedBefore);
+        const canonicalMerged = canonical(mergedResult);
+        const changes = specChanges(canonicalStored, canonicalMerged);
+        const ineffective = ineffectiveDeltaPaths(
+          { ...qualifiedDelta, ...unsetFields.length ? { unset: unsetFields } : {} },
+          canonicalMerged,
+          canonicalStored
+        );
         if (changes.length === 0) {
           return {
             kind,
             id,
             written: false,
+            dryRun,
             changes,
+            ineffective,
             notices,
-            summary: `No change to ${kind} "${id}" \u2014 the delta matches what is stored, so nothing was written.`
+            summary: `No change to ${kind} "${id}" \u2014 the delta matches what is stored, so nothing ${dryRun ? "would be" : "was"} written.`
           };
         }
-        mergedResult.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
         const gateNotices = hooks?.gate?.(kind, mergedResult);
         if (gateNotices?.length) notices.push(...gateNotices);
+        if (dryRun) {
+          return {
+            kind,
+            id,
+            written: false,
+            dryRun: true,
+            changes,
+            ineffective,
+            notices,
+            summary: `Dry run on ${kind} "${id}": ${changes.length} change${changes.length === 1 ? "" : "s"} would be made. Nothing was written.`
+          };
+        }
+        mergedResult.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
         const opts = {
           allowStatusDemotion: Object.prototype.hasOwnProperty.call(delta, "status")
         };
@@ -25763,7 +25926,7 @@ var init_specs2 = __esm({
             this.saveSystemSpec(mergedResult);
             break;
           case "subsystem":
-            this.saveSubsystemSpec(mergedResult);
+            this.saveSubsystemSpec(mergedResult, opts);
             break;
           case "component":
             notices.push(...this.saveComponentSpec(mergedResult, opts));
@@ -25782,7 +25945,9 @@ var init_specs2 = __esm({
           kind,
           id,
           written: true,
+          dryRun: false,
           changes,
+          ineffective,
           notices,
           summary: `Updated ${kind} "${id}": ${changes.length} change${changes.length === 1 ? "" : "s"}.`
         };
@@ -26652,8 +26817,8 @@ function addComponent(candidate) {
   if (verdict.errors.length) throw new Error(formatCandidateRefusal(verdict));
   return [...noticesFrom(verdict), ...saveComponentSpec(candidate)];
 }
-function updateSpecGated(kind, id, delta) {
-  return updateSpec(kind, id, delta, componentCandidateGate());
+function updateSpecGated(kind, id, delta, dryRun) {
+  return updateSpec(kind, id, delta, componentCandidateGate(), dryRun);
 }
 var init_authoring = __esm({
   "src/core/authoring.ts"() {
@@ -26671,6 +26836,7 @@ __export(server_exports, {
   captureBuildStamp: () => captureBuildStamp,
   createMcpServer: () => createMcpServer,
   isBuildStale: () => isBuildStale,
+  markStale: () => markStale,
   startMcpServer: () => startMcpServer,
   statusFamilyContext: () => statusFamilyContext
 });
@@ -26751,16 +26917,32 @@ function json(value) {
 function errText(message) {
   return { content: [{ type: "text", text: `Error: ${message}` }], isError: true };
 }
+function structured(content, data) {
+  return { content: [{ type: "text", text: content }], structuredContent: data };
+}
+function jsonStructured(value) {
+  return structured(JSON.stringify(value, null, 2), value);
+}
 function renderChangeReport(report2) {
-  const lines = [report2.summary];
+  const lines = [report2.dryRun ? `DRY RUN \u2014 nothing was written. ${report2.summary}` : report2.summary];
   for (const change of report2.changes) {
     const to = change.after === void 0 ? "" : `: ${JSON.stringify(change.after)}`;
     const from = change.before === void 0 ? "" : ` (was ${JSON.stringify(change.before)})`;
-    lines.push(`- ${change.path} ${change.change}${to}${from}`);
+    lines.push(`- ${change.path} ${report2.dryRun ? `would be ${change.change}` : change.change}${to}${from}`);
+  }
+  if (report2.ineffective.length) {
+    lines.push("", "NO EFFECT:", ...report2.ineffective.map((i) => `- ${i}`));
   }
   if (report2.notices.length) lines.push("", "NOTICE:", ...report2.notices.map((n) => `- ${n}`));
   return lines.join("\n");
 }
+function writeReceipt(sentence, receipt) {
+  const noticeBlock = receipt.notices.length ? `
+
+NOTICE:
+- ${receipt.notices.join("\n- ")}` : "";
+  return structured(`${sentence}${noticeBlock}`, receipt);
+}
 function captureBuildStamp(entryPath) {
   try {
     const s = fs20.statSync(entryPath);
@@ -26778,16 +26960,19 @@ function isBuildStale(stamp) {
     return false;
   }
 }
-function withStaleWarning(result) {
-  if (!isBuildStale(SERVER_BUILD_STAMP)) return result;
-  const first = result.content?.[0];
+function markStale(result) {
+  const marked = result.structuredContent ? { ...result, structuredContent: { ...result.structuredContent, staleServer: true } } : result;
+  const first = marked.content?.[0];
   if (first && first.type === "text") {
     return {
-      ...result,
-      content: [{ ...first, text: `${first.text}${STALE_SERVER_WARNING}` }, ...result.content.slice(1)]
+      ...marked,
+      content: [{ ...first, text: `${first.text}${STALE_SERVER_WARNING}` }, ...marked.content.slice(1)]
     };
   }
-  return result;
+  return marked;
+}
+function withStaleWarning(result) {
+  return isBuildStale(SERVER_BUILD_STAMP) ? markStale(result) : result;
 }
 function reg(server, name, config, cb) {
   const guarded = (args) => {
@@ -26798,6 +26983,19 @@ function reg(server, name, config, cb) {
   const strictConfig = config.inputSchema ? { ...config, inputSchema: import_zod11.z.object(config.inputSchema).strict() } : config;
   server.registerTool(name, strictConfig, guarded);
 }
+function statusForCreate(label, stated, existing) {
+  const stored = existing?.status;
+  const held = stored !== void 0 && STATUS_ORDER.includes(stored) ? stored : void 0;
+  if (stated === void 0) return { status: held ?? "draft" };
+  if (held === void 0) return { status: stated };
+  const rank = (s) => STATUS_ORDER.indexOf(s);
+  if (rank(stated) < rank(held)) {
+    return {
+      refusal: `Refusing to re-author ${label} at status "${stated}": it is stored at "${held}", and a create tool never lowers a spec's status \u2014 a restatement that reopened a frozen spec would undo a lock without saying so. Nothing was written. To reopen it deliberately, use sdd_update_spec with {"status": "${stated}"}; to keep the level it has, leave status out.`
+    };
+  }
+  return { status: stated };
+}
 function isEmptyValue(value) {
   if (value === void 0 || value === null) return true;
   if (Array.isArray(value)) return value.length === 0;
@@ -27095,8 +27293,8 @@ function createMcpServer(options = {}) {
   const systemInput = {
     name: import_zod11.z.string().describe("Overarching name of the project/system"),
     vision: import_zod11.z.string().describe("Vision, mission, and core goals of the system"),
-    boundaries: import_zod11.z.array(import_zod11.z.union([import_zod11.z.string(), import_zod11.z.object({ name: import_zod11.z.string(), description: import_zod11.z.string().optional() })])).optional().describe("System boundary rules or scope statements (strings or name/description objects)"),
-    globalRequirements: import_zod11.z.array(import_zod11.z.union([import_zod11.z.string(), import_zod11.z.object({ description: import_zod11.z.string() })])).optional().describe("Global functional and non-functional requirements (strings or description objects)"),
+    boundaries: import_zod11.z.array(import_zod11.z.union([import_zod11.z.string(), import_zod11.z.object({ name: import_zod11.z.string(), description: import_zod11.z.string().optional() }).strict()])).optional().describe("System boundary rules or scope statements (strings or name/description objects)"),
+    globalRequirements: import_zod11.z.array(import_zod11.z.union([import_zod11.z.string(), import_zod11.z.object({ description: import_zod11.z.string() }).strict()])).optional().describe("Global functional and non-functional requirements (strings or description objects)"),
     targetLanguage: import_zod11.z.string().optional().describe('Default implementation language for the system (e.g. "typescript", "rust", "python"). Subsystems may override. Enables language-aware validation.')
   };
   const systemInputFields = Object.keys(systemInput);
@@ -27104,8 +27302,9 @@ function createMcpServer(options = {}) {
     server,
     "sdd_initialize_system",
     {
-      description: "Initialize the L0 System Specification (system.yaml). Re-running it on an existing system RE-AUTHORS it: the fields above are replaced, and everything this tool cannot express (databases, the project gateway publicInterfaces, diagram defaults) is carried forward.",
-      inputSchema: systemInput
+      description: "Initialize the L0 System Specification (system.yaml). Re-running it on an existing system RE-AUTHORS it: the fields above are replaced, and everything this tool cannot express (databases, the project gateway publicInterfaces, diagram defaults) is carried forward. The answer carries a write receipt as structured content beside the sentence \u2014 what was written, and whether a system spec already existed \u2014 so a caller never has to read English to find out.",
+      inputSchema: systemInput,
+      outputSchema: specWriteReceiptOutput
     },
     ({ name, vision, boundaries, globalRequirements, targetLanguage }) => {
       try {
@@ -27127,11 +27326,10 @@ function createMcpServer(options = {}) {
         next.updatedAt = now;
         saveSystemSpec2(next);
         const notices = existing ? rewriteNotices({ label: `System spec "${existing.name}"`, carried, cleared, removed: [] }) : [];
-        const noticeBlock = notices.length ? `
-
-NOTICE:
-- ${notices.join("\n- ")}` : "";
-        return text(`Successfully ${existing ? "re-authored" : "initialized"} L0 System Spec for "${name}".${noticeBlock}`);
+        return writeReceipt(
+          `Successfully ${existing ? "re-authored" : "initialized"} L0 System Spec for "${name}".`,
+          { kind: "system", id: "system", name, replacedExisting: Boolean(existing), notices }
+        );
       } catch (e) {
         return errText(String(e));
       }
@@ -27146,7 +27344,7 @@ NOTICE:
       details: import_zod11.z.string(),
       component: import_zod11.z.string().optional().describe("The L2 component id that realizes this interface (this subsystem's published surface)"),
       interface: import_zod11.z.string().optional().describe("Optional L3 interface id on that component backing this entry")
-    })).optional().describe("Public entrypoints exposed by this subsystem, each bound to a realizing component"),
+    }).strict()).optional().describe("Public entrypoints exposed by this subsystem, each bound to a realizing component"),
     projectPath: import_zod11.z.string().optional().describe("Relative path to external project root for subsystem chaining"),
     targetLanguage: import_zod11.z.string().optional().describe("Override of the system-level targetLanguage for this subsystem"),
     profile: import_zod11.z.string().optional().describe("Architectural profile override for this subsystem (built-ins: backend, frontend-reactive, frontend-controller, lowlevel-os, game-ecs, realtime-embedded, plc-cyclic; extension packs may add more \u2014 unknown names get UNKNOWN_PROFILE)"),
@@ -27154,29 +27352,33 @@ NOTICE:
     trustedLinks: import_zod11.z.array(import_zod11.z.object({
       subsystem: import_zod11.z.string().describe("Peer subsystem id"),
       reason: import_zod11.z.string().describe('Why the coupling is sanctioned (e.g. "dispatch latency fast lane")')
-    })).optional().describe("Sanctioned tight couplings with peers \u2014 required to acknowledge a mutual subsystem dependency; the Adapter \u2192 published Portal shape still applies."),
+    }).strict()).optional().describe("Sanctioned tight couplings with peers \u2014 required to acknowledge a mutual subsystem dependency; the Adapter \u2192 published Portal shape still applies."),
     lifecycle: import_zod11.z.array(import_zod11.z.object({
       phase: import_zod11.z.enum(["init", "shutdown", "cyclic", "interrupt", "scheduled"]).describe("Which lifecycle/execution flow this roots (cyclic = every scan/tick, interrupt = hardware/OS interrupt, scheduled = timer/cron)"),
       component: import_zod11.z.string().describe("Component id whose method the runtime invokes at this phase"),
       method: import_zod11.z.string().describe("Method name on that component's interface"),
       description: import_zod11.z.string().optional()
-    })).optional().describe("Declared execution-flow roots \u2014 reachability entrypoints alongside Portals/Observers. Only init flows feed the durable-Store hydration check (MISSING_HYDRATION); cyclic/interrupt/scheduled root non-request/response execution models (PLC scan, ISR, cron).")
+    }).strict()).optional().describe("Declared execution-flow roots \u2014 reachability entrypoints alongside Portals/Observers. Only init flows feed the durable-Store hydration check (MISSING_HYDRATION); cyclic/interrupt/scheduled root non-request/response execution models (PLC scan, ISR, cron)."),
+    status: statusInput
   };
   const subsystemInputFields = [...Object.keys(subsystemInput), "parentSystem"];
   reg(
     server,
     "sdd_add_subsystem",
     {
-      description: "Add an L1 Subsystem / Service under the system boundary. publicInterfaces should bind each entry to the component that realizes it (the subsystem's published surface); if components do not exist yet, add them later with sdd_set_public_interfaces. Re-running it on an existing id RE-AUTHORS it: the fields above are replaced, lint/ext are carried forward.",
-      inputSchema: subsystemInput
+      description: "Add an L1 Subsystem / Service under the system boundary. publicInterfaces should bind each entry to the component that realizes it (the subsystem's published surface); if components do not exist yet, add them later with sdd_set_public_interfaces. Re-running it on an existing id RE-AUTHORS it: the fields above are replaced, lint/ext are carried forward, and the stored status is kept unless this input states a higher one. The answer carries a write receipt as structured content beside the sentence \u2014 the status written, whether a spec already held the id, and the child project directory a chained subsystem scaffolded.",
+      inputSchema: subsystemInput,
+      outputSchema: specWriteReceiptOutput
     },
-    ({ id, name, description, publicInterfaces, projectPath, targetLanguage, profile, designDepth, trustedLinks, lifecycle }) => {
+    ({ id, name, description, publicInterfaces, projectPath, targetLanguage, profile, designDepth, trustedLinks, lifecycle, status: status2 }) => {
       try {
         const { loadSystemSpec: loadSystemSpec3, loadSubsystemSpec: loadSubsystemSpec2, saveSubsystemSpec: saveSubsystemSpec2 } = requireSpecs();
         const system = loadSystemSpec3();
         if (!system) return errText("System spec must be initialized (sdd_initialize_system) first.");
         const now = (/* @__PURE__ */ new Date()).toISOString();
         const existing = loadSubsystemSpec2(id);
+        const resolved = statusForCreate(`subsystem "${id}"`, status2, existing);
+        if ("refusal" in resolved) return errText(resolved.refusal);
         const spec = {
           id,
           name,
@@ -27189,7 +27391,7 @@ NOTICE:
           ...designDepth ? { designDepth } : {},
           ...lifecycle ? { lifecycle } : {},
           trustedLinks: trustedLinks ?? [],
-          status: "draft",
+          status: resolved.status,
           createdAt: now,
           updatedAt: now
         };
@@ -27197,17 +27399,24 @@ NOTICE:
         const cleared = clearedByOmission(existing, spec, subsystemInputFields);
         if (existing) spec.createdAt = existing.createdAt;
         const notices = existing ? rewriteNotices({ label: `Subsystem "${id}"`, carried: ["createdAt", ...carried], cleared, removed: [] }) : [];
-        const noticeBlock = notices.length ? `
-
-NOTICE:
-- ${notices.join("\n- ")}` : "";
+        const receipt = {
+          kind: "subsystem",
+          id,
+          name,
+          replacedExisting: Boolean(existing),
+          status: resolved.status,
+          notices
+        };
         if (projectPath && projectPath.trim() !== "") {
           const { createChainedSubsystem: createChainedSubsystem3 } = requireProvision();
           createChainedSubsystem3(spec, name);
-          return text(`Successfully added external subsystem "${name}" (${id}) and scaffolded its child project at ${projectPath}.${noticeBlock}`);
+          return writeReceipt(
+            `Successfully added external subsystem "${name}" (${id}) and scaffolded its child project at ${projectPath}.`,
+            { ...receipt, scaffoldedProjectPath: projectPath }
+          );
         }
         saveSubsystemSpec2(spec);
-        return text(`Successfully added L1 Subsystem Spec "${name}" (${id}).${noticeBlock}`);
+        return writeReceipt(`Successfully added L1 Subsystem Spec "${name}" (${id}).`, receipt);
       } catch (e) {
         return errText(String(e));
       }
@@ -27225,7 +27434,7 @@ NOTICE:
           details: import_zod11.z.string(),
           component: import_zod11.z.string().optional().describe("The L2 component id that realizes this interface"),
           interface: import_zod11.z.string().optional().describe("Optional L3 interface id on that component")
-        })).describe("The full replacement list of public interfaces for this subsystem")
+        }).strict()).describe("The full replacement list of public interfaces for this subsystem")
       }
     },
     ({ subsystem, publicInterfaces }) => {
@@ -27382,35 +27591,40 @@ NOTICE:
       component: import_zod11.z.string().describe("Component id serving this capability (must also appear under dependsOn/owns)"),
       method: import_zod11.z.string().describe("Method name on the serving component's interface"),
       description: import_zod11.z.string().optional()
-    })).optional().describe("Portal-only: capability \u2192 component.method dispatch table for generic-handle portals. Gives the reachability walker real edges and is validated against target interfaces (UNSERVED_CAPABILITY)."),
+    }).strict()).optional().describe("Portal-only: capability \u2192 component.method dispatch table for generic-handle portals. Gives the reachability walker real edges and is validated against target interfaces (UNSERVED_CAPABILITY)."),
     durability: import_zod11.z.enum(["ram-projection", "durable", "read-through", "cache"]).optional().describe("Store-only \u2014 OMIT IT on any other componentType, where it is refused at the write (DURABILITY_ON_NON_STORE) and nothing is saved. Every Store should declare one (MISSING_DURABILITY): durable = persisted RAM projection (hydration read-back from a lifecycle init entrypoint required \u2014 MISSING_HYDRATION); read-through = persisted with no RAM copy (every read is the read-back, hydration exempt); ram-projection = rebuilt not restored; cache = evictable loss-safe memo state."),
     dependencyClass: import_zod11.z.enum(["pure", "read"]).optional().describe("Orchestrator-only \u2014 OMIT IT on any other componentType, where it is refused at the write (DEPENDENCY_CLASS_ON_NON_ORCHESTRATOR) and nothing is saved. Declares what logic may depend on, enforced as a Store's durability is (DEPENDENCY_CLASS_VIOLATION): pure = depends only on pure Orchestrators (a computation over the values it is handed, e.g. an arbiter or codec); read = also on read Orchestrators, Repositories, Indexes and Adapters, never calling their write methods; unset = a workflow."),
     emits: import_zod11.z.array(import_zod11.z.object({
       topic: import_zod11.z.string().describe("Topic/channel name exactly as used on the bus"),
       event: import_zod11.z.string().optional().describe("Optional event name within the topic (informational; pairing is by topic)"),
       description: import_zod11.z.string().optional()
-    })).optional().describe("Topics this component publishes \u2014 every emitted topic needs a subscriber somewhere in the tree (UNCONSUMED_TOPIC)."),
+    }).strict()).optional().describe("Topics this component publishes \u2014 every emitted topic needs a subscriber somewhere in the tree (UNCONSUMED_TOPIC)."),
     subscribesTo: import_zod11.z.array(import_zod11.z.object({
       topic: import_zod11.z.string().describe("Topic/channel name exactly as used on the bus"),
       event: import_zod11.z.string().optional(),
       description: import_zod11.z.string().optional()
-    })).optional().describe("Topics this component consumes (typical on Observers) \u2014 every subscription needs an emitter somewhere in the tree (UNSOURCED_SUBSCRIPTION)."),
-    ext: import_zod11.z.record(import_zod11.z.unknown()).optional().describe('Opaque pack/tool extension data (namespaced keys, e.g. "mypack:priority") \u2014 preserved verbatim, never validated or interpreted by the core')
+    }).strict()).optional().describe("Topics this component consumes (typical on Observers) \u2014 every subscription needs an emitter somewhere in the tree (UNSOURCED_SUBSCRIPTION)."),
+    ext: import_zod11.z.record(import_zod11.z.unknown()).optional().describe('Opaque pack/tool extension data (namespaced keys, e.g. "mypack:priority") \u2014 preserved verbatim, never validated or interpreted by the core'),
+    status: statusInput
   };
   const componentInputFields = Object.keys(componentInput);
   reg(
     server,
     "sdd_add_component",
     {
-      description: `Add an L2 Component under a subsystem. componentType is a building block (Portal, Orchestrator, Supervisor, Actor, Store, Index, Query, Registry, Adapter, Observer) or the pattern Repository. Specialist and Gateway are retired (STEREOTYPE_RETIRED) and cannot be authored: logic is an Orchestrator with a dependencyClass (pure | read; unset = a workflow), and a gateway is a Portal with the gateway variant (set variant with sdd_update_spec). Patterns set "owns" (their private member blocks); all components set "dependsOn" (collaborators \u2014 facades or standalone blocks). Held/persisted state (configs, permissions, sessions, caches): model the Repository recipe \u2014 a Store + Registry (write) + Index (read), plus a Query for computed reads over the Store, owned by a Repository facade consumers depend on; a deliberately standalone Store is the sanctioned lightweight form (workflow-layer consumers + lint.allow on UNOWNED_STORE). Never hold state as fields inside an Orchestrator because a Store link was refused. Re-running it on an existing id RE-AUTHORS it: the fields above are replaced (an omitted array is CLEARED), while lint.allow, a Portal's auth, variant, patterns and externalLinks are carried forward \u2014 edit those with sdd_update_spec.`,
-      inputSchema: componentInput
+      description: `Add an L2 Component under a subsystem. componentType is a building block (Portal, Orchestrator, Supervisor, Actor, Store, Index, Query, Registry, Adapter, Observer) or the pattern Repository. Specialist and Gateway are retired (STEREOTYPE_RETIRED) and cannot be authored: logic is an Orchestrator with a dependencyClass (pure | read; unset = a workflow), and a gateway is a Portal with the gateway variant (set variant with sdd_update_spec). Patterns set "owns" (their private member blocks); all components set "dependsOn" (collaborators \u2014 facades or standalone blocks). Held/persisted state (configs, permissions, sessions, caches): model the Repository recipe \u2014 a Store + Registry (write) + Index (read), plus a Query for computed reads over the Store, owned by a Repository facade consumers depend on; a deliberately standalone Store is the sanctioned lightweight form (workflow-layer consumers + lint.allow on UNOWNED_STORE). Never hold state as fields inside an Orchestrator because a Store link was refused. Re-running it on an existing id RE-AUTHORS it: the fields above are replaced (an omitted array is CLEARED), while lint.allow, a Portal's auth, variant, patterns and externalLinks are carried forward \u2014 edit those with sdd_update_spec. The stored status is kept unless this input states a higher one. The answer carries a write receipt as structured content beside the sentence \u2014 the status written, whether a spec already held the id, and every gate notice the write raised, each as its own entry.`,
+      inputSchema: componentInput,
+      outputSchema: specWriteReceiptOutput
     },
-    ({ id, name, description, subsystem, componentType, owns, dependsOn, portalType, basePath, dispatch, durability, dependencyClass, emits, subscribesTo, ext }) => {
+    ({ id, name, description, subsystem, componentType, owns, dependsOn, portalType, basePath, dispatch, durability, dependencyClass, emits, subscribesTo, ext, status: status2 }) => {
       try {
         const { loadSubsystemSpec: loadSubsystemSpec2, loadComponentSpec: loadComponentSpec2 } = requireSpecs();
         const sub = loadSubsystemSpec2(subsystem);
         if (!sub) return errText(`Parent subsystem "${subsystem}" does not exist.`);
         const now = (/* @__PURE__ */ new Date()).toISOString();
+        const existing = loadComponentSpec2(id);
+        const resolved = statusForCreate(`component "${id}"`, status2, existing);
+        if ("refusal" in resolved) return errText(resolved.refusal);
         const candidate = {
           id,
           name,
@@ -27427,11 +27641,10 @@ NOTICE:
           ...emits ? { emits } : {},
           ...subscribesTo ? { subscribesTo } : {},
           ...ext ? { ext } : {},
-          status: "draft",
+          status: resolved.status,
           createdAt: now,
           updatedAt: now
         };
-        const existing = loadComponentSpec2(id);
         const carried = carryUnexpressed(existing, candidate, componentInputFields);
         const cleared = clearedByOmission(existing, candidate, componentInputFields);
         if (existing) candidate.createdAt = existing.createdAt;
@@ -27444,11 +27657,10 @@ NOTICE:
             removed: []
           }));
         }
-        const noticeBlock = notices.length ? `
-
-NOTICE:
-- ${notices.join("\n- ")}` : "";
-        return text(`Successfully ${existing ? "re-authored" : "added"} L2 Component Spec "${name}" (${id}, ${componentType}).${noticeBlock}`);
+        return writeReceipt(
+          `Successfully ${existing ? "re-authored" : "added"} L2 Component Spec "${name}" (${id}, ${componentType}).`,
+          { kind: "component", id, name, replacedExisting: Boolean(existing), status: resolved.status, notices }
+        );
       } catch (e) {
         return errText(String(e));
       }
@@ -27458,24 +27670,26 @@ NOTICE:
     name: import_zod11.z.string(),
     description: import_zod11.z.string(),
     signature: import_zod11.z.string(),
-    returns: import_zod11.z.string(),
+    returns: import_zod11.z.string().describe(TYPE_REF_GRAMMAR("The type the method answers with")),
     params: import_zod11.z.array(import_zod11.z.object({
       name: import_zod11.z.string(),
-      type: import_zod11.z.string().describe('A primitive/builtin or a defined type id (e.g. "billing.Invoice")'),
+      type: import_zod11.z.string().describe(TYPE_REF_GRAMMAR("The parameter's type")),
       description: import_zod11.z.string().optional(),
-      optional: import_zod11.z.boolean().optional()
-    })).optional().describe("Structured parameters \u2014 authoritative for type checking (the prose signature becomes display-only). Strongly preferred."),
+      optional: import_zod11.z.boolean().optional().describe(
+        'Whether the parameter may be OMITTED by a caller. It is not nullability: a parameter that must be passed but may be passed as nothing is a required parameter whose type is a union \u2014 "ProjectConfig | null". Say whichever is true; they are different contracts.'
+      )
+    }).strict()).optional().describe("Structured parameters \u2014 authoritative for type checking (the prose signature becomes display-only). Strongly preferred."),
     guarantees: import_zod11.z.array(import_zod11.z.string().min(1)).optional().describe("Semantic guarantees the method promises (combinable); any guarantee a narrative step asserts must be declared here. Builtin tokens: idempotent | atomic | transactional | exactly-once; extension packs may declare more (any other token is UNKNOWN_GUARANTEE)"),
     effect: import_zod11.z.enum(["read", "write"]).optional().describe("State-effect direction on the component's held state \u2014 required on a durable Store's contract methods so the durability round-trip rule can pair writes with hydration read-backs"),
     invokedBy: import_zod11.z.object({
       kind: import_zod11.z.enum(["runtime", "external", "sibling-subsystem"]).describe("Who owns the out-of-graph invocation: runtime (timer/signal/shutdown hook), external (a system outside this project), sibling-subsystem (a modeled sibling whose edge is not narrated here)"),
       caller: import_zod11.z.string().optional().describe("WHO invokes it and when, as reviewable prose \u2014 missing or placeholder-thin prose is INVOKED_BY_UNDESCRIBED")
-    }).optional().describe("Typed acknowledgment of a real caller OUTSIDE the modeled narrative graph. Unused-detection seeds the method as an entrypoint so reachability propagates through its narrative (unlike lint.allow); a method the internal walk already reaches is flagged stale (INVOKED_BY_REDUNDANT). Prefer a `register` narrative step when the wiring is internal."),
+    }).strict().optional().describe("Typed acknowledgment of a real caller OUTSIDE the modeled narrative graph. Unused-detection seeds the method as an entrypoint so reachability propagates through its narrative (unlike lint.allow); a method the internal walk already reaches is flagged stale (INVOKED_BY_REDUNDANT). Prefer a `register` narrative step when the wiring is internal."),
     findings: import_zod11.z.array(import_zod11.z.object({
       code: import_zod11.z.string().describe("UPPER_SNAKE finding code, unique within the method; a pack's codes carry the pack prefix (<PACK>_<CODE>)"),
       severity: import_zod11.z.enum(["error", "warning"]).describe("Default severity, before project severity overrides and draft-context downgrades"),
       summary: import_zod11.z.string().describe("One line saying what the finding means")
-    })).optional().describe("The finding codes this method can report, each with its default severity and summary. Each declared code must be anchored in the method's source file, as a string literal or a property-access name (UNREALIZED_FINDING). A code is declared once per method; sdd_update_spec upserts and deletes findings by code."),
+    }).strict()).optional().describe("The finding codes this method can report, each with its default severity and summary. Each declared code must be anchored in the method's source file, as a string literal or a property-access name (UNREALIZED_FINDING). A code is declared once per method; sdd_update_spec upserts and deletes findings by code."),
     ext: import_zod11.z.record(import_zod11.z.unknown()).optional().describe("Opaque pack/tool extension data for this method (namespaced keys) \u2014 preserved verbatim")
   };
   const interfaceMethodInputFields = Object.keys(interfaceMethodShape);
@@ -27484,23 +27698,27 @@ NOTICE:
     name: import_zod11.z.string().describe("Human-readable contract name"),
     description: import_zod11.z.string().describe("Contract description and obligations"),
     component: import_zod11.z.string().describe("The L2 component ID this interface belongs to"),
-    methods: import_zod11.z.array(import_zod11.z.object(interfaceMethodShape)).optional().describe("List of method signature contracts")
+    methods: import_zod11.z.array(import_zod11.z.object(interfaceMethodShape).strict()).optional().describe("List of method signature contracts"),
+    status: statusInput
   };
   const interfaceInputFields = Object.keys(interfaceInput);
   reg(
     server,
     "sdd_define_interface",
     {
-      description: "Define an L3 Contract / Interface with method signatures for a component. Prefer supplying structured `params` per method \u2014 they are the authoritative source for type checking (the free-form signature string then becomes display-only and is never heuristically parsed). A method declares the finding codes it reports in `findings` ({code, severity, summary}); each code must be anchored in the method's source file, as a string literal or a property-access name (UNREALIZED_FINDING). Re-defining an existing id REPLACES the method list: a method left out of the input is REMOVED (and reported); spec-level lint/ext and each method's endpoint binding are carried forward.",
-      inputSchema: interfaceInput
+      description: "Define an L3 Contract / Interface with method signatures for a component. Prefer supplying structured `params` per method \u2014 they are the authoritative source for type checking (the free-form signature string then becomes display-only and is never heuristically parsed). A method declares the finding codes it reports in `findings` ({code, severity, summary}); each code must be anchored in the method's source file, as a string literal or a property-access name (UNREALIZED_FINDING). Re-defining an existing id REPLACES the method list: a method left out of the input is REMOVED (and reported); spec-level lint/ext and each method's endpoint binding are carried forward, and the stored status is kept unless this input states a higher one. The answer carries a write receipt as structured content beside the sentence \u2014 the status written, whether a spec already held the id, and the notices a restatement raised, each as its own entry.",
+      inputSchema: interfaceInput,
+      outputSchema: specWriteReceiptOutput
     },
-    ({ id, name, description, component, methods }) => {
+    ({ id, name, description, component, methods, status: status2 }) => {
       try {
         const { loadComponentSpec: loadComponentSpec2, loadInterfaceSpec: loadInterfaceSpec2, saveInterfaceSpec: saveInterfaceSpec2 } = requireSpecs();
         const comp = loadComponentSpec2(component);
         if (!comp) return errText(`Component "${component}" does not exist.`);
         const now = (/* @__PURE__ */ new Date()).toISOString();
         const existing = loadInterfaceSpec2(id);
+        const resolved = statusForCreate(`interface "${id}"`, status2, existing);
+        if ("refusal" in resolved) return errText(resolved.refusal);
         const carried = [];
         const specMethods = (methods ?? []).map((m) => {
           const prev = existing?.methods.find((p) => p.name === m.name);
@@ -27516,7 +27734,7 @@ NOTICE:
           description,
           component,
           methods: specMethods,
-          status: "draft",
+          status: resolved.status,
           createdAt: now,
           updatedAt: now
         };
@@ -27533,11 +27751,10 @@ NOTICE:
             removedSuffix: " (endpoint bindings included)"
           }));
         }
-        const noticeBlock = notices.length ? `
-
-NOTICE:
-- ${notices.join("\n- ")}` : "";
-        return text(`Successfully ${existing ? "re-authored" : "defined"} L3 Interface Contract "${name}" (${id}).${noticeBlock}`);
+        return writeReceipt(
+          `Successfully ${existing ? "re-authored" : "defined"} L3 Interface Contract "${name}" (${id}).`,
+          { kind: "interface", id, name, replacedExisting: Boolean(existing), status: resolved.status, notices }
+        );
       } catch (e) {
         return errText(String(e));
       }
@@ -27567,7 +27784,7 @@ NOTICE:
           channel: import_zod11.z.string().optional().describe("IPC: channel name"),
           command: import_zod11.z.string().optional().describe("CLI: command/subcommand"),
           address: import_zod11.z.string().optional().describe("Custom: free-form address")
-        })).describe("One binding per method")
+        }).strict()).describe("One binding per method")
       }
     },
     ({ interface: interfaceId, endpoints }) => {
@@ -27624,7 +27841,7 @@ NOTICE:
     type: import_zod11.z.enum(["local", "call", "dispatch", "register", "branch", "switch", "loop", "try", "parallel", "jump", "return", "throw"]),
     targetComponent: import_zod11.z.string().optional().describe("call/register/dispatch: L2 component id (for dispatch, the Portal routed through)"),
     targetMethod: import_zod11.z.string().optional().describe("call/register: method name on the target. A register step hands the target method to the runtime as a callback (timer, event listener, shutdown hook): reachability follows the edge, but it is never an invocation \u2014 exempt from call-graph conformance, call-cycle detection, and the durability boot walk"),
-    auth: import_zod11.z.object({ from: import_zod11.z.string(), note: import_zod11.z.string().optional() }).optional().describe("call/dispatch: the credential this step presents to an AUTHED callee Portal and WHERE it loads from (`from`). Opaque form (env:API_KEY, a config key, vault:path) = a design note wairon never resolves; modeled form `component:<id>` references the Adapter/Store that provides the secret and is validated (must resolve, be an Adapter/Store, and be wired to the presenter). Absence on a call into a Portal whose auth \u2260 none warns (PORTAL_AUTH_UNMET). The authenticated call itself should be made by an Adapter (AUTH_PRESENTER_NOT_ADAPTER)."),
+    auth: import_zod11.z.object({ from: import_zod11.z.string(), note: import_zod11.z.string().optional() }).strict().optional().describe("call/dispatch: the credential this step presents to an AUTHED callee Portal and WHERE it loads from (`from`). Opaque form (env:API_KEY, a config key, vault:path) = a design note wairon never resolves; modeled form `component:<id>` references the Adapter/Store that provides the secret and is validated (must resolve, be an Adapter/Store, and be wired to the presenter). Absence on a call into a Portal whose auth \u2260 none warns (PORTAL_AUTH_UNMET). The authenticated call itself should be made by an Adapter (AUTH_PRESENTER_NOT_ADAPTER)."),
     detach: import_zod11.z.boolean().optional().describe("call/dispatch: fire-and-forget \u2014 issue the call and continue without awaiting the result (no later step consumes it)"),
     capability: import_zod11.z.string().optional().describe("dispatch: the capability routed through the target Portal's dispatch table (validated against it \u2014 UNSERVED_CAPABILITY)"),
     assertsGuarantees: import_zod11.z.array(import_zod11.z.string().min(1)).optional().describe("Semantic guarantees this step relies on \u2014 each must be declared in the called method's L3 guarantees (NARRATIVE_SEMANTIC_UNBACKED otherwise). Builtin tokens: idempotent | atomic | transactional | exactly-once; extension packs may declare more (any other token is UNKNOWN_GUARANTEE)"),
@@ -27635,22 +27852,22 @@ NOTICE:
     onFalseStep: stepNo().optional().describe("branch: required (or onFalseLabel)"),
     onFalseLabel: labelRef().optional().describe("branch: symbolic alternative to onFalseStep"),
     on: import_zod11.z.string().optional().describe("switch: the dispatched value"),
-    cases: import_zod11.z.array(import_zod11.z.object({ value: import_zod11.z.string(), step: stepNo().optional(), label: labelRef().optional() })).optional().describe("switch: required; each case targets its region by step number or label"),
+    cases: import_zod11.z.array(import_zod11.z.object({ value: import_zod11.z.string(), step: stepNo().optional(), label: labelRef().optional() }).strict()).optional().describe("switch: required; each case targets its region by step number or label"),
     defaultStep: stepNo().optional().describe("switch: default = next step"),
     defaultLabel: labelRef().optional().describe("switch: symbolic alternative to defaultStep"),
     loopKind: import_zod11.z.enum(["forEach", "for", "while", "doWhile"]).optional().describe('loop: default forEach when "over" is set, else while'),
     over: import_zod11.z.string().optional().describe("loop forEach/for: iteration source"),
     endStep: stepNo().optional().describe("loop/try: last step of the body region (required, or endLabel)"),
     endLabel: labelRef().optional().describe("loop/try: symbolic alternative to endStep"),
-    catches: import_zod11.z.array(import_zod11.z.object({ error: import_zod11.z.string(), step: stepNo().optional(), label: labelRef().optional() })).optional().describe("try: handler regions, each targeted by step number or label"),
+    catches: import_zod11.z.array(import_zod11.z.object({ error: import_zod11.z.string(), step: stepNo().optional(), label: labelRef().optional() }).strict()).optional().describe("try: handler regions, each targeted by step number or label"),
     finallyStep: stepNo().optional().describe("try: first step of the always-runs region"),
     finallyLabel: labelRef().optional().describe("try: symbolic alternative to finallyStep"),
-    branches: import_zod11.z.array(import_zod11.z.object({ step: stepNo().optional(), label: labelRef().optional(), name: import_zod11.z.string().optional() })).optional().describe("parallel: >= 2 arm entries (step number or label), ascending, first = the step after the header; arms are contiguous sub-regions of body next..endStep, joining after endStep once ALL complete"),
+    branches: import_zod11.z.array(import_zod11.z.object({ step: stepNo().optional(), label: labelRef().optional(), name: import_zod11.z.string().optional() }).strict()).optional().describe("parallel: >= 2 arm entries (step number or label), ascending, first = the step after the header; arms are contiguous sub-regions of body next..endStep, joining after endStep once ALL complete"),
     toStep: stepNo().optional().describe("jump: required (break/continue/rejoin), or toLabel"),
     toLabel: labelRef().optional().describe("jump: symbolic alternative to toStep \u2014 resolves to the labeled step at write time"),
     outcome: import_zod11.z.string().optional().describe('return: e.g. "success", "not found"'),
     error: import_zod11.z.string().optional().describe("throw: the raised error")
-  });
+  }).strict();
   const detailEnum = import_zod11.z.enum(["full", "calls-only", "intent"]);
   const conformanceEnum = import_zod11.z.enum(["declared", "anchored", "off"]);
   const implMethodShape = {
@@ -27674,22 +27891,26 @@ NOTICE:
     technologies: import_zod11.z.array(import_zod11.z.string()).optional().describe(`External technologies this implementation binds to (e.g. ["mysql"]) \u2014 declares this component's ownership tree as the technology's home; references outside it are flagged (TECH_LEAKAGE) and contract identifiers must stay intent-language. Only for Adapter/Store/Registry/Index components.`),
     detail: detailEnum.optional().describe("Spec-level narrative detail default for all methods"),
     conformance: conformanceEnum.optional().describe("Spec-level conformance tier default: declared | anchored | off (omitted = stereotype default: Portal \u2192 anchored, else declared)"),
-    methods: import_zod11.z.array(import_zod11.z.object(implMethodShape)).optional().describe("Method implementations containing L5 narratives")
+    methods: import_zod11.z.array(import_zod11.z.object(implMethodShape).strict()).optional().describe("Method implementations containing L5 narratives"),
+    status: statusInput
   };
   const implInputFields = Object.keys(implInput);
   reg(
     server,
     "sdd_write_narrative",
     {
-      description: "Write L4 Concrete Implementation spec containing L5 method narratives. Narratives are a FLAT ordered step list; flow steps (branch/switch/loop/try/parallel/jump/return/throw) jump by step number \u2014 blocks are just skipped regions. Steps may declare a `label` anchor, and every jump field has a *Label twin (toLabel, onTrueLabel, endLabel, \u2026) resolved to step numbers at write time \u2014 prefer labels over hand-counted numbers; an unresolvable label rejects the write. Detail dial per method: full (narrative required) | calls-only (call choreography suffices) | intent (prose instead of steps); omitted = stereotype default (Portal/Observer/Adapter: calls-only, Store/Index/Registry: intent, else full). Conformance dial per method or spec: declared | anchored | off \u2014 how strictly structural conformance requires contract methods to be realized in their source file (omitted = Portal: anchored, else declared). A method whose body lives in its own file names it in the method's sourcePath; the implementation's sourcePath is the default for every method that names none. Re-authoring an existing id REPLACES the method list: a method left out of the input is REMOVED together with its narrative (and reported); spec-level lint/ext are carried forward.",
-      inputSchema: implInput
+      description: "Write L4 Concrete Implementation spec containing L5 method narratives. Narratives are a FLAT ordered step list; flow steps (branch/switch/loop/try/parallel/jump/return/throw) jump by step number \u2014 blocks are just skipped regions. Steps may declare a `label` anchor, and every jump field has a *Label twin (toLabel, onTrueLabel, endLabel, \u2026) resolved to step numbers at write time \u2014 prefer labels over hand-counted numbers; an unresolvable label rejects the write. Detail dial per method: full (narrative required) | calls-only (call choreography suffices) | intent (prose instead of steps); omitted = stereotype default (Portal/Observer/Adapter: calls-only, Store/Index/Registry: intent, else full). Conformance dial per method or spec: declared | anchored | off \u2014 how strictly structural conformance requires contract methods to be realized in their source file (omitted = Portal: anchored, else declared). A method whose body lives in its own file names it in the method's sourcePath; the implementation's sourcePath is the default for every method that names none. Re-authoring an existing id REPLACES the method list: a method left out of the input is REMOVED together with its narrative (and reported); spec-level lint/ext are carried forward, and the stored status is kept unless this input states a higher one. The answer carries a write receipt as structured content beside the sentence \u2014 the status written, whether a spec already held the id, and the notices a restatement raised, each as its own entry.",
+      inputSchema: implInput,
+      outputSchema: specWriteReceiptOutput
     },
-    ({ id, name, description, contract, sourcePath, simPath, technologies, detail, conformance, methods }) => {
+    ({ id, name, description, contract, sourcePath, simPath, technologies, detail, conformance, methods, status: status2 }) => {
       try {
         const { loadInterfaceSpec: loadInterfaceSpec2, loadImplementationSpec: loadImplementationSpec2, saveImplementationSpec: saveImplementationSpec2 } = requireSpecs();
         const intf = loadInterfaceSpec2(contract);
         if (!intf) return errText(`Interface contract "${contract}" does not exist.`);
         const existing = loadImplementationSpec2(id);
+        const resolved = statusForCreate(`implementation "${id}"`, status2, existing);
+        if ("refusal" in resolved) return errText(resolved.refusal);
         const carried = [];
         const resolvedMethods = (methods ?? []).map((m) => {
           const prev = existing?.methods.find((p) => p.name === m.name);
@@ -27719,7 +27940,7 @@ NOTICE:
           // Post-resolution every cases/catches entry has its numeric step —
           // the *Label twins exist only in the input type, not the spec's.
           methods: resolvedMethods,
-          status: "draft",
+          status: resolved.status,
           createdAt: now,
           updatedAt: now
         };
@@ -27736,11 +27957,10 @@ NOTICE:
             removedSuffix: " (L5 narratives included)"
           }));
         }
-        const noticeBlock = notices.length ? `
-
-NOTICE:
-- ${notices.join("\n- ")}` : "";
-        return text(`Successfully saved L4 Implementation Spec "${name}" (${id}) with method narratives.${noticeBlock}`);
+        return writeReceipt(
+          `Successfully saved L4 Implementation Spec "${name}" (${id}) with method narratives.`,
+          { kind: "implementation", id, name, replacedExisting: Boolean(existing), status: resolved.status, notices }
+        );
       } catch (e) {
         return errText(String(e));
       }
@@ -27755,18 +27975,23 @@ NOTICE:
     group: import_zod11.z.string().optional().describe("Optional logical group ID to organize this type in subfolders"),
     fields: import_zod11.z.array(import_zod11.z.object({
       name: import_zod11.z.string(),
-      type: import_zod11.z.string(),
+      type: import_zod11.z.string().describe(TYPE_REF_GRAMMAR("The field's type")),
       description: import_zod11.z.string().optional(),
       optional: import_zod11.z.boolean().optional(),
       key: import_zod11.z.enum(["primary", "unique", "foreign"]).optional().describe("Identity marker (PK/unique/FK) for ERD and database schema derivation"),
       references: import_zod11.z.string().optional().describe('For foreign keys, the referenced type/table id and optional field, e.g. "invoice.id"')
-    })).optional().describe('Data fields (type is a primitive or a qualified type id, e.g. "billing.Invoice")'),
-    methods: import_zod11.z.array(import_zod11.z.object({ name: import_zod11.z.string(), signature: import_zod11.z.string(), returns: import_zod11.z.string(), description: import_zod11.z.string().optional() })).optional().describe("Pure intrinsic methods only"),
+    }).strict()).optional().describe('Data fields (type is a primitive or a qualified type id, e.g. "billing.Invoice")'),
+    methods: import_zod11.z.array(import_zod11.z.object({
+      name: import_zod11.z.string(),
+      signature: import_zod11.z.string(),
+      returns: import_zod11.z.string().describe(TYPE_REF_GRAMMAR("The type the method answers with")),
+      description: import_zod11.z.string().optional()
+    }).strict()).optional().describe("Pure intrinsic methods only"),
     componentClass: import_zod11.z.string().optional().describe("Optional component id that implements or owns this logical entity"),
     invariants: import_zod11.z.array(import_zod11.z.object({
       id: import_zod11.z.string().describe("Stable invariant id, unique within the entity"),
       description: import_zod11.z.string().describe("The property that must hold, stated precisely")
-    })).optional().describe("Declared domain invariants (entities): every write-effect method of the componentClass must carry a narrative step asserting each (assertsInvariants) \u2014 declarations checked, enforcement never proven"),
+    }).strict()).optional().describe("Declared domain invariants (entities): every write-effect method of the componentClass must carry a narrative step asserting each (assertsInvariants) \u2014 declarations checked, enforcement never proven"),
     database: import_zod11.z.string().optional().describe("Optional database id for table-schema types"),
     table: import_zod11.z.string().optional().describe("Optional database table name for table-schema types"),
     linkedEntity: import_zod11.z.string().optional().describe("Optional logical entity id represented by this table-schema type")
@@ -27776,8 +28001,9 @@ NOTICE:
     server,
     "sdd_add_type",
     {
-      description: "Define an entity or value-object type (the data components operate on). Entities are owned by a subsystem; shared value objects omit subsystem (system-level). Fields are data; methods are PURE intrinsic behaviour only \u2014 anything needing a collaborator belongs on a component, taking the entity as an argument. Re-defining an existing id REPLACES fields/methods/invariants (an omitted list is CLEARED, and a dropped member is reported); lint/ext are carried forward.",
-      inputSchema: typeInput
+      description: "Define an entity or value-object type (the data components operate on). Entities are owned by a subsystem; shared value objects omit subsystem (system-level). Fields are data; methods are PURE intrinsic behaviour only \u2014 anything needing a collaborator belongs on a component, taking the entity as an argument. Re-defining an existing id REPLACES fields/methods/invariants (an omitted list is CLEARED, and a dropped member is reported); lint/ext are carried forward. The answer carries a write receipt as structured content beside the sentence \u2014 whether a spec already held the id, and the notices a restatement raised, each as its own entry. A type carries no lifecycle status, so the receipt states none.",
+      inputSchema: typeInput,
+      outputSchema: specWriteReceiptOutput
     },
     ({ kind, id, name, description, subsystem, group, fields, methods, componentClass, invariants, database, table, linkedEntity }) => {
       try {
@@ -27824,11 +28050,10 @@ NOTICE:
             removedNoun: "member"
           }));
         }
-        const noticeBlock = notices.length ? `
-
-NOTICE:
-- ${notices.join("\n- ")}` : "";
-        return text(`Successfully ${existing ? "re-authored" : "defined"} ${kind} type "${name}" (${id}).${noticeBlock}`);
+        return writeReceipt(
+          `Successfully ${existing ? "re-authored" : "defined"} ${kind} type "${name}" (${id}).`,
+          { kind: "type", id, name, replacedExisting: Boolean(existing), notices }
+        );
       } catch (e) {
         return errText(String(e));
       }
@@ -27838,11 +28063,12 @@ NOTICE:
     server,
     "sdd_validate_tree",
     {
-      description: "Validate the SDD spec tree, checking parent references, contract compatibility, narratives, and component type boundaries. Supports scoping and recursion controls.",
+      description: "Validate the SDD spec tree, checking parent references, contract compatibility, narratives, and component type boundaries. Supports scoping and recursion controls. Findings come back as structured content too, under the schema this tool declares \u2014 errors and warnings already split, each with its code, severity, message and the spec it concerns \u2014 so a caller filters them as objects instead of parsing the JSON text block and hoping its shape holds.",
       inputSchema: {
         subsystem: import_zod11.z.string().optional().describe("Only validate the specified subsystem (granular)"),
         recursive: import_zod11.z.boolean().optional().describe("Whether to recursively validate subprojects (default: true)")
-      }
+      },
+      outputSchema: validateTreeOutput
     },
     ({ subsystem, recursive }) => {
       try {
@@ -27855,7 +28081,7 @@ NOTICE:
           scopeSubsystem: subsystem,
           recursive: recursive ?? true
         });
-        return json({
+        return jsonStructured({
           valid: result.valid,
           errors: result.issues.filter((i) => i.severity === "error"),
           warnings: result.issues.filter((i) => i.severity === "warning"),
@@ -27870,16 +28096,19 @@ NOTICE:
     server,
     "sdd_get_spec",
     {
-      description: `Get/read the parsed JSON contents of a specific spec from the spec tree. Returns structural contents without file system path searching. For a variant-tagged COMPONENT the result also carries a derived, read-only "variantGuidance" (the variant's base, its implementation guidance, and the same-variant sibling components to implement alike) \u2014 it is resolved from the variant registry, not part of the spec, so never write it back.`,
+      description: `Get/read the parsed JSON contents of a specific spec from the spec tree. Returns structural contents without file system path searching. Pass "methods" to read only the named methods of a contract, an implementation or a type \u2014 a 45-method spec fetched whole to look at one of them is the read side of the same waste a restatement is on the write side; the answer then carries a "partialResult" marker naming what was left out, and must never be re-authored from. For a variant-tagged COMPONENT the result also carries a derived, read-only "variantGuidance" (the variant's base, its implementation guidance, and the same-variant sibling components to implement alike) \u2014 it is resolved from the variant registry, not part of the spec, so never write it back. The structured content carries the same answer with the two derived markers KEPT SEPARATE from the stored spec ({kind, id, spec, partialResult?, variantGuidance?}), so nothing derived can be mistaken for something stored; the text block folds them in as it always has.`,
       inputSchema: {
         kind: import_zod11.z.enum(["system", "subsystem", "component", "interface", "implementation", "type"]).describe("The kind of specification"),
-        id: import_zod11.z.string().describe('The identifier of the spec to fetch (the L0 system spec is a singleton \u2014 pass the system name or "system")')
-      }
+        id: import_zod11.z.string().describe('The identifier of the spec to fetch (the L0 system spec is a singleton \u2014 pass the system name or "system")'),
+        methods: import_zod11.z.array(import_zod11.z.string().min(1)).optional().describe("Return only these methods by name; every other field of the spec comes back unchanged. Only an interface, an implementation or a type declares methods \u2014 asking for one elsewhere is refused, as is a name the spec does not declare (the answer names the ones it does). Omit it for the whole spec.")
+      },
+      outputSchema: getSpecOutput
     },
-    ({ kind, id }) => {
+    ({ kind, id, methods }) => {
       try {
         const specs = requireSpecs();
         let result = null;
+        let partial = null;
         switch (kind) {
           case "system":
             result = specs.loadSystemSpec();
@@ -27901,11 +28130,41 @@ NOTICE:
             break;
         }
         if (!result) return errText(`Spec of kind "${kind}" with ID "${id}" does not exist.`);
-        if (kind === "component") {
-          const guidance = resolveComponentVariantGuidance(result);
-          if (guidance) return json({ ...result, variantGuidance: guidance });
+        if (methods !== void 0) {
+          const declared = result.methods;
+          if (!Array.isArray(declared)) {
+            return errText(
+              `A ${kind} spec declares no methods, so "methods" cannot filter it. Drop the argument to read "${id}" whole; methods live on an interface, an implementation and a type.`
+            );
+          }
+          const names = declared.map((m) => String(m?.name));
+          const unknown = methods.filter((n) => !names.includes(n));
+          if (unknown.length > 0) {
+            return errText(
+              `${kind} "${id}" does not declare ${unknown.map((n) => `"${n}"`).join(", ")}. It declares: ${names.join(", ")}. Nothing was returned, so a misspelled name never reads as a method with no content.`
+            );
+          }
+          const kept = declared.filter((m) => methods.includes(String(m?.name)));
+          partial = {
+            shown: kept.map((m) => String(m?.name)),
+            omitted: names.length - kept.length,
+            warning: `PARTIAL: ${names.length - kept.length} of this spec's ${names.length} methods are not in this answer. Never re-author from it \u2014 sdd_define_interface and sdd_write_narrative REPLACE the method list, so every method missing here would be removed from the spec.`
+          };
+          result = { ...result, methods: kept };
         }
-        return json(result);
+        const guidance = kind === "component" ? resolveComponentVariantGuidance(result) : null;
+        const folded = {
+          ...result,
+          ...partial ? { partialResult: partial } : {},
+          ...guidance ? { variantGuidance: guidance } : {}
+        };
+        return structured(JSON.stringify(folded, null, 2), {
+          kind,
+          id,
+          spec: result,
+          ...partial ? { partialResult: partial } : {},
+          ...guidance ? { variantGuidance: guidance } : {}
+        });
       } catch (e) {
         return errText(String(e));
       }
@@ -27953,16 +28212,19 @@ NOTICE:
     server,
     "sdd_update_spec",
     {
-      description: "Update/patch an existing SDD specification (subsystem, component, interface, implementation, or type) using a granular delta. Updates fields, appends/merges array elements, or inserts/deletes narrative steps.",
+      description: "Update/patch an existing SDD specification (subsystem, component, interface, implementation, or type) using a granular delta. Updates fields, appends/merges array elements, or inserts/deletes narrative steps. Answers with exactly what changed, and with every path the delta named that the write did not act on. Pass dryRun to be told what it would do without writing it.",
       inputSchema: {
         kind: import_zod11.z.enum(["system", "subsystem", "component", "interface", "implementation", "type"]).describe("The spec kind to update (system = the singleton L0 \u2014 vision, boundaries, globalRequirements, databases, and publicInterfaces: the project gateway surface, each entry {id, name, subsystem, component, type, details, audience: project|department|instance|partner|external}; id is informational)"),
         id: import_zod11.z.string().describe("The ID of the spec to update (namespaced if needed)"),
-        delta: import_zod11.z.record(import_zod11.z.any()).describe(`The partial fields to merge into the spec. ARRAYS UPSERT, they do not replace: an array whose elements carry an identity is merged element-by-element, so a delta naming ONE element leaves the others intact. Identity is "name" or "id" by default, and per field: dispatch by "capability", lifecycle by phase+component+method, emits/subscribesTo by topic+event, trustedLinks by "subsystem", invariants and patterns by "id", lint.allow by "code", an interface method's findings by "code", boundaries by "name", globalRequirements by "description", switch cases by "value", try catches by "error". Identity merging applies at EVERY depth, including an array INSIDE an element (a method's params, a step's catches). Add "action: 'delete'" (or "remove: true") alongside that identity to REMOVE an element \u2014 including a stale lint allow. Arrays of plain STRINGS (owns, dependsOn, guarantees) carry no per-element identity and are replaced wholesale; pass [] to clear any array outright. To REMOVE an optional field entirely, list it in "unset": e.g. {"unset": ["basePath", "variant"]} \u2014 passing null/undefined means "no change" (they are skipped), and writing "" would leave the field present but empty, which is a different and usually wrong spec. Unsetting a required field is refused by schema validation, which names it. For narrative steps, match by "stepNumber" and use "action: 'insert'" (shifts subsequent steps up) or "action: 'delete'" (shifts subsequent steps down and removes it). Step entries apply in ASCENDING stepNumber order, each against the numbering the earlier entries of the SAME delta left behind \u2014 delete step 3 and step 7 becomes step 6 \u2014 so prefer labels, and restate the step's "label" or "description" on a delete to have it checked against the step actually addressed. Renumbering RELOCATES every flow jump field (onTrueStep/onFalseStep/cases.step/defaultStep/endStep/catches.step/finallyStep/toStep) in the same narrative. A delete is REJECTED when the narrative has no such step, when a jump still targets it (retarget the referrers first), when a restated label/description does not match, or when it is a loop/try/parallel header whose body would be left standing (retype the header first to dissolve the region, then delete it). Changing a step's "type" REBUILDS it for the new type: its description and label are kept and every field the new type cannot carry is dropped (returned as a NOTICE); a delta that retypes AND sets such a field is refused. A step delta is also refused when it carries a marker the merge does not recognise: a non-boolean "remove", an "action" that is neither "insert" nor "delete", a "captureJumps" outside an insert, or no "stepNumber" to address. Inserting AT a jump target relocates those jumps past the inserted step by default (a NOTICE is returned) \u2014 add "captureJumps": true on the inserted step to retarget entry jumps onto it (loop/try endStep region tails always relocate with the body and are never captured). Every jump field has a "*Label" twin (toLabel, onFalseLabel, endLabel, \u2026, and "label" on a cases/catches entry) resolved against step labels AFTER the merge, so a delta may anchor on a label only pre-existing steps carry; a label the delta supplies REPLACES the stored number it twins, while setting the number and its label together in one delta is refused as a contradiction. Reference ids in deltas may use LOCAL names \u2014 they are qualified against the spec's namespace exactly as the loader would. Per-spec lint suppression: set "lint: { allow: [{ code, reason }] }" to silence a WARNING code on this spec only (errors always surface; stale allows are flagged).`)
-      }
+        delta: import_zod11.z.record(import_zod11.z.any()).describe(`The partial fields to merge into the spec. ARRAYS UPSERT, they do not replace: an array whose elements carry an identity is merged element-by-element, so a delta naming ONE element leaves the others intact. Identity is "name" or "id" by default, and per field: dispatch by "capability", lifecycle by phase+component+method, emits/subscribesTo by topic+event, trustedLinks by "subsystem", invariants and patterns by "id", lint.allow by "code", an interface method's findings by "code", boundaries by "name", globalRequirements by "description", switch cases by "value", try catches by "error". Identity merging applies at EVERY depth, including an array INSIDE an element (a method's params, a step's catches). Add "action: 'delete'" (or "remove: true") alongside that identity to REMOVE an element \u2014 including a stale lint allow. Arrays of plain STRINGS (owns, dependsOn, guarantees) carry no per-element identity and are replaced wholesale; pass [] to clear any array outright. To REMOVE an optional field entirely, list it in "unset": e.g. {"unset": ["basePath", "variant"]} \u2014 passing null/undefined means "no change" (they are skipped), and writing "" would leave the field present but empty, which is a different and usually wrong spec. Unsetting a required field is refused by schema validation, which names it. For narrative steps, match by "stepNumber" and use "action: 'insert'" (shifts subsequent steps up) or "action: 'delete'" (shifts subsequent steps down and removes it). Step entries apply in ASCENDING stepNumber order, each against the numbering the earlier entries of the SAME delta left behind \u2014 delete step 3 and step 7 becomes step 6 \u2014 so prefer labels, and restate the step's "label" or "description" on a delete to have it checked against the step actually addressed. Renumbering RELOCATES every flow jump field (onTrueStep/onFalseStep/cases.step/defaultStep/endStep/catches.step/finallyStep/toStep) in the same narrative. A delete is REJECTED when the narrative has no such step, when a jump still targets it (retarget the referrers first), when a restated label/description does not match, or when it is a loop/try/parallel header whose body would be left standing (retype the header first to dissolve the region, then delete it). Changing a step's "type" REBUILDS it for the new type: its description and label are kept and every field the new type cannot carry is dropped (returned as a NOTICE); a delta that retypes AND sets such a field is refused. A step delta is also refused when it carries a marker the merge does not recognise: a non-boolean "remove", an "action" that is neither "insert" nor "delete", a "captureJumps" outside an insert, or no "stepNumber" to address. Inserting AT a jump target relocates those jumps past the inserted step by default (a NOTICE is returned) \u2014 add "captureJumps": true on the inserted step to retarget entry jumps onto it (loop/try endStep region tails always relocate with the body and are never captured). Every jump field has a "*Label" twin (toLabel, onFalseLabel, endLabel, \u2026, and "label" on a cases/catches entry) resolved against step labels AFTER the merge, so a delta may anchor on a label only pre-existing steps carry; a label the delta supplies REPLACES the stored number it twins, while setting the number and its label together in one delta is refused as a contradiction. Reference ids in deltas may use LOCAL names \u2014 they are qualified against the spec's namespace exactly as the loader would. Per-spec lint suppression: set "lint: { allow: [{ code, reason }] }" to silence a WARNING code on this spec only (errors always surface; stale allows are flagged). This delta is deliberately OPEN below its top level \u2014 the shapes nest further than a schema here should restate \u2014 so a key that is not a field at its depth is not refused, it is NAMED BACK under NO EFFECT in the answer, together with any value the spec already held and any "unset" that removed nothing. Read that list: it is where a nested typo shows up.`),
+        dryRun: import_zod11.z.boolean().optional().describe("Ask what this delta WOULD do instead of doing it. The whole write runs, the candidate gate included, and the answer is the change report it would have produced \u2014 marked DRY RUN, with nothing stamped and not one byte of the stored file moved. Use it before a delta that renumbers a long narrative.")
+      },
+      outputSchema: specChangeReportOutput
     },
-    ({ kind, id, delta }) => {
+    ({ kind, id, delta, dryRun }) => {
       try {
-        return text(renderChangeReport(updateSpecGated(kind, id, delta)));
+        const report2 = updateSpecGated(kind, id, delta, dryRun);
+        return structured(renderChangeReport(report2), report2);
       } catch (e) {
         return errText(String(e));
       }
@@ -28166,7 +28428,7 @@ async function startMcpServer() {
   } catch {
   }
 }
-var import_mcp, import_stdio, import_zod11, import_types3, fs20, path27, import_url, SERVER_BUILD_STAMP, STALE_SERVER_WARNING, SPEC_WRITE_TOOLS, listChangedEmitters, STORE_MANAGED_FIELDS, ALWAYS_CARRIED_FIELDS, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
+var import_mcp, import_stdio, import_zod11, import_types3, fs20, path27, import_url, TYPE_REF_GRAMMAR, staleServerOutput, SPEC_KINDS, STATUS_ORDER, specWriteReceiptOutput, specChangeOutput, specChangeReportOutput, validationIssueOutput, validateTreeOutput, getSpecOutput, SERVER_BUILD_STAMP, STALE_SERVER_WARNING, SPEC_WRITE_TOOLS, listChangedEmitters, STORE_MANAGED_FIELDS, statusInput, ALWAYS_CARRIED_FIELDS, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
 var init_server = __esm({
   "src/mcp/server.ts"() {
     "use strict";
@@ -28197,6 +28459,105 @@ var init_server = __esm({
     init_agent_resolver();
     init_budget_policy();
     init_surfaces();
+    TYPE_REF_GRAMMAR = (what) => `${what}: a primitive/builtin or a defined type id (qualified across subsystems, e.g. "billing.Invoice" or "billing::Invoice"). Generics, arrays and UNIONS are all read, at any depth: "Invoice | null" (the commonest shape there is), "Invoice | undefined", "Invoice | Receipt", "Promise<Invoice | null>", "Map<string, Invoice | null>", "Invoice[] | null", "(Invoice | null)[]". Every identifier the string names must resolve \u2014 a union of two defined types means BOTH must exist. A union of string literals ("read" | "write") names no type and resolves to nothing.`;
+    staleServerOutput = {
+      staleServer: import_zod11.z.boolean().optional().describe(
+        "True when the wairon build on disk changed after this server started \u2014 the structured twin of the text answer's STALE SERVER banner. Writes through a stale process can silently drop fields a newer schema introduced: restart the MCP session before editing further."
+      )
+    };
+    SPEC_KINDS = ["system", "subsystem", "component", "interface", "implementation", "type"];
+    STATUS_ORDER = ["draft", "design", "complete"];
+    specWriteReceiptOutput = {
+      kind: import_zod11.z.enum(SPEC_KINDS).describe("The spec kind written."),
+      id: import_zod11.z.string().describe('The id the spec is stored under; "system" for the L0 singleton.'),
+      name: import_zod11.z.string().describe("The spec's display name as written."),
+      replacedExisting: import_zod11.z.boolean().describe(
+        "True when a spec already held this id and the call re-authored it in place rather than adding one. The notices then say what was carried forward, removed or cleared by the restatement."
+      ),
+      status: import_zod11.z.enum(STATUS_ORDER).optional().describe(
+        "The lifecycle status written. Absent for a type, which carries none."
+      ),
+      notices: import_zod11.z.array(import_zod11.z.string()).describe(
+        "The notice lines the text answer lists, one per entry: what was carried forward, what a restatement removed, what an omission cleared, and every gate warning the write raised. Empty for a clean create."
+      ),
+      scaffoldedProjectPath: import_zod11.z.string().optional().describe(
+        "The child project directory a chained subsystem's create scaffolded; absent for every other write."
+      ),
+      ...staleServerOutput
+    };
+    specChangeOutput = {
+      path: import_zod11.z.string().describe("The dotted path the change addresses, with names and indexes."),
+      change: import_zod11.z.enum(["set", "added", "removed", "cleared"]).describe("What happened at that path."),
+      before: import_zod11.z.string().optional().describe("The previous value, summarized; absent when there was none."),
+      after: import_zod11.z.string().optional().describe("The new value, summarized; absent when there is none.")
+    };
+    specChangeReportOutput = {
+      kind: import_zod11.z.enum(SPEC_KINDS).describe("The spec kind written."),
+      id: import_zod11.z.string().describe("The stored spec's id."),
+      written: import_zod11.z.boolean().describe("False when the merged spec equals what is stored: nothing reached disk."),
+      dryRun: import_zod11.z.boolean().describe(
+        "True when the caller asked what the delta WOULD do. `written` is false for a dry run exactly as it is for a delta that changed nothing, and only this field tells the two apart."
+      ),
+      changes: import_zod11.z.array(import_zod11.z.object(specChangeOutput)).describe(
+        "Every change the write made; empty exactly when `written` is false."
+      ),
+      ineffective: import_zod11.z.array(import_zod11.z.string()).describe(
+        "Every path the delta named that the write did not act on, each with why. Read it: a nested typo the permissive delta cannot refuse shows up here and nowhere else."
+      ),
+      notices: import_zod11.z.array(import_zod11.z.string()).describe("Store placement notices, gate warnings and delta notices."),
+      summary: import_zod11.z.string().describe("One line for people."),
+      ...staleServerOutput
+    };
+    validationIssueOutput = {
+      severity: import_zod11.z.enum(["error", "warning"]).describe("The finding's severity after project overrides."),
+      code: import_zod11.z.string().describe("The rule code, UPPER_SNAKE \u2014 the stable handle to filter and suppress by."),
+      message: import_zod11.z.string().describe("What is wrong, named."),
+      agentId: import_zod11.z.string().optional().describe("The agent the finding concerns, when it concerns one."),
+      specId: import_zod11.z.string().optional().describe("The spec the finding concerns, when it concerns one."),
+      draftContext: import_zod11.z.boolean().optional().describe(
+        "True when the finding was raised against a draft/design spec \u2014 what the --ci gate waives."
+      ),
+      surfaceResolved: import_zod11.z.boolean().optional().describe(
+        "True when the finding was verified against a vendored surface snapshot, so it is a contract verdict rather than a resolution failure."
+      )
+    };
+    validateTreeOutput = {
+      valid: import_zod11.z.boolean().describe("False when the tree holds at least one error."),
+      errors: import_zod11.z.array(import_zod11.z.object(validationIssueOutput)).describe("Every finding of severity error."),
+      warnings: import_zod11.z.array(import_zod11.z.object(validationIssueOutput)).describe("Every finding of severity warning."),
+      resolvedThrough: import_zod11.z.object({
+        root: import_zod11.z.string().describe("The top root that was validated."),
+        scope: import_zod11.z.string().describe("The mount chain the verdict was scoped to.")
+      }).optional().describe(
+        "Present when a chained subproject's verdict was resolved through its parent; absent when the tree was validated on its own."
+      ),
+      ...staleServerOutput
+    };
+    getSpecOutput = {
+      kind: import_zod11.z.enum(SPEC_KINDS).describe("The kind of spec read."),
+      id: import_zod11.z.string().describe("The id it was read by."),
+      spec: import_zod11.z.record(import_zod11.z.unknown()).describe(
+        "The stored spec, exactly as the text block renders it \u2014 minus the two derived markers below, which the text folds in and this answer keeps separate so nothing derived can be mistaken for stored."
+      ),
+      partialResult: import_zod11.z.object({
+        shown: import_zod11.z.array(import_zod11.z.string()).describe("The method names this answer carries."),
+        omitted: import_zod11.z.number().describe("How many of the spec's methods are NOT in it."),
+        warning: import_zod11.z.string().describe("Why it must never be re-authored from.")
+      }).optional().describe(
+        "Present only when `methods` filtered the read. A filtered spec is a partial one: sdd_define_interface and sdd_write_narrative REPLACE the method list, so re-authoring from it would delete every method left out."
+      ),
+      variantGuidance: import_zod11.z.object({
+        variant: import_zod11.z.string().describe("The variant id the component declares."),
+        base: import_zod11.z.string().describe("The core stereotype it specializes."),
+        guidance: import_zod11.z.string().describe("How to implement a component of this variant."),
+        siblings: import_zod11.z.array(import_zod11.z.string()).describe("Other components of the same variant, to implement alike."),
+        target: import_zod11.z.string().optional().describe("The target language the variant scopes itself to, if any."),
+        profile: import_zod11.z.string().optional().describe("The architectural profile it scopes itself to, if any.")
+      }).optional().describe(
+        "Derived, read-only guidance for a variant-tagged component \u2014 resolved from the variant registry, not part of the spec. Never write it back."
+      ),
+      ...staleServerOutput
+    };
     SERVER_BUILD_STAMP = captureBuildStamp(__filename);
     STALE_SERVER_WARNING = "\n\n\u26A0 STALE SERVER: the wairon build on disk changed after this MCP server started. Restart the MCP session (e.g. /mcp reconnect) before further spec edits \u2014 writes through a stale server can silently drop fields introduced by newer schemas.";
     SPEC_WRITE_TOOLS = /* @__PURE__ */ new Set([
@@ -28219,6 +28580,9 @@ var init_server = __esm({
     ]);
     listChangedEmitters = /* @__PURE__ */ new WeakMap();
     STORE_MANAGED_FIELDS = /* @__PURE__ */ new Set(["status", "updatedAt"]);
+    statusInput = import_zod11.z.enum(STATUS_ORDER).optional().describe(
+      "The spec's lifecycle status. Omitted means draft for a NEW spec and the status already stored for a re-authoring, so a restatement never reopens a frozen spec. State it to author straight at design or complete instead of promoting afterwards. A status that would LOWER the stored one is refused \u2014 reopening a spec for revision is sdd_update_spec's job, which sets the demotion deliberately."
+    );
     ALWAYS_CARRIED_FIELDS = /* @__PURE__ */ new Set(["ext"]);
     SKILL_RESOURCE_MIME = "text/markdown";
     AGENT_BRIEF_SCHEME = "wairon-agent://";