@wairon/cli 5.1.1-dev.41 → 5.1.1-dev.43

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.41";
+    WAIRON_VERSION = "5.1.1-dev.43";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     SUPPORTED_ALIASES = ["wai"];
     SCAN_EXCLUDE_DIRS = /* @__PURE__ */ new Set([
@@ -770,7 +770,7 @@ function activeTargetTypes(config) {
   const targets = config.targets;
   return targets.filter((t) => typeof t === "string" || t.enabled !== false).map((t) => typeof t === "string" ? t : t.type);
 }
-var import_zod4, BuiltinTargetConfigSchema, CustomTargetConfigSchema, TargetConfigSchema, NamingRuleConfigSchema, DocumentationRuleConfigSchema, ComplexityRuleConfigSchema, ConformanceRuleConfigSchema, DesignDepthSchema, RulesConfigSchema, PathsConfigSchema, PackSelectionSchema, ProfileSelectionSubjectSchema, ProjectProfileSelectionSchema, ProjectConfigSchema;
+var import_zod4, BuiltinTargetConfigSchema, CustomTargetConfigSchema, TargetConfigSchema, NamingRuleConfigSchema, DocumentationRuleConfigSchema, ComplexityRuleConfigSchema, CarriedDebtKindSchema, CarriedFindingSchema, CarriedDebtSchema, ConformanceRuleConfigSchema, DesignDepthSchema, RulesConfigSchema, PathsConfigSchema, PackSelectionSchema, ProfileSelectionSubjectSchema, ProjectProfileSelectionSchema, ProjectConfigSchema;
 var init_project = __esm({
   "src/models/project.ts"() {
     "use strict";
@@ -867,6 +867,57 @@ var init_project = __esm({
        */
       maxCognitiveLevel: import_zod4.z.string().optional()
     });
+    CarriedDebtKindSchema = import_zod4.z.enum(["drift", "undecided", "unreadable"]);
+    CarriedFindingSchema = import_zod4.z.object({
+      /** The issue code, which must be one a rule declares CARRYABLE — anything else is UNCARRYABLE_FINDING, an error. */
+      code: import_zod4.z.string(),
+      /** The spec the finding is anchored to. */
+      spec: import_zod4.z.string(),
+      /** The site inside that spec the finding names — for the code-vs-spec call checks, the contract method. */
+      at: import_zod4.z.string(),
+      /**
+       * The units an aggregating finding covers: the crossings of one
+       * UNDECLARED_COLOCATED_CALL, the steps of one CALL_STEP_UNREALIZED. Keyed by
+       * code + spec + site ALONE, a 24th crossing added to a finding that already
+       * lists 23 would be carried by an entry nobody wrote for it — so a live
+       * finding is carried only when every unit it reports is listed here, and a
+       * unit that appears is reported as new.
+       */
+      covers: import_zod4.z.array(import_zod4.z.string()).optional()
+    });
+    CarriedDebtSchema = import_zod4.z.object({
+      /** Which of the three kinds this reason is (see CarriedDebtKindSchema). */
+      kind: CarriedDebtKindSchema,
+      /** The reason itself, in the author's own words — what is true here, and what paying it would take. */
+      why: import_zod4.z.string().min(1),
+      /**
+       * This classification is PROVISIONAL, and this is what would settle it.
+       *
+       * A confident-sounding `why` that is wrong is worse than a missing one: it
+       * reads as settled, so nobody looks again, and the register keeps counting
+       * the finding under a kind that was never true. Nothing can check a reason
+       * for truth — `kind` and `why` are prose, and STALE_CARRIED_FINDING only
+       * ever catches "this stopped applying", never "this still applies for a
+       * reason that has become false". What a register CAN do is let an author say
+       * out loud that they are not sure yet, and then keep saying it: every run
+       * counts the groups marked here beside the kind totals, so the uncertainty
+       * is as loud as the debt.
+       *
+       * It is deliberately a SENTENCE and not a flag, and deliberately on the
+       * reason GROUP rather than the finding: what is provisional is the reason,
+       * and a reader deciding whether to pick this up needs to know what to
+       * measure — "is the adapter really realized by the file that consumes it, or
+       * is that a modelling error?" — not merely that somebody once hesitated. A
+       * finding whose own classification is uncertain while its neighbours' is not
+       * is a different reason, and belongs in its own group.
+       *
+       * There is no counterpart on `lint.allow`, and that is a decision, not an
+       * omission: see the note on ConformanceRuleConfig.carried.
+       */
+      revisit: import_zod4.z.string().min(1).optional(),
+      /** The findings this reason explains. */
+      findings: import_zod4.z.array(CarriedFindingSchema)
+    });
     ConformanceRuleConfigSchema = import_zod4.z.object({
       /**
        * Project-relative paths holding this project's own source code; a
@@ -889,7 +940,39 @@ var init_project = __esm({
        * that is now claimed, proven a barrel, or no longer found is
        * STALE_UNCLAIMED_ENTRY.
        */
-      unclaimed: import_zod4.z.array(import_zod4.z.string()).optional()
+      unclaimed: import_zod4.z.array(import_zod4.z.string()).optional(),
+      /**
+       * The conformance findings this tree carries as declared debt, grouped by
+       * the reason that explains them — `unclaimed`'s shape, for findings about
+       * code a spec DOES claim.
+       *
+       * It is not a second lint.allow, and the difference is the claim each makes.
+       * An allow says "this finding is wrong here, by design", and is meant to
+       * live forever; an entry here says "this finding is RIGHT, and it is not
+       * paid yet". A mechanism that cannot tell those apart can never be asked how
+       * much the tree owes. Four properties keep it a register:
+       *   • only a code a rule declares CARRYABLE may appear (UNCARRYABLE_FINDING,
+       *     an error, which no allow and no --ci waiver can reach);
+       *   • an entry carries a finding only when it lists EVERY unit that finding
+       *     reports, so an aggregating finding cannot grow behind it;
+       *   • an entry that stops applying — gone, or listing a unit no longer
+       *     reported — is STALE_CARRIED_FINDING, so the register only shrinks;
+       *   • every entry states its kind and its reason, and `wairon validate`
+       *     prints the running total, so the debt is loud where a suppression is
+       *     silent.
+       *
+       * A reason group may also declare itself PROVISIONAL (`revisit`), and the
+       * total says how many did. There is no such marker on a `lint.allow`, and
+       * the asymmetry is the point: an entry here does not silence anything — the
+       * finding is counted out loud on every run — so marking one uncertain adds a
+       * second dial to something already visible. An allow DOES silence, and a
+       * "provisional allow" would buy the silence and defer the decision, which is
+       * the one combination that cannot be reviewed: the finding is gone and the
+       * doubt is in a field nobody opens. The mechanism for a decision nobody has
+       * taken is to not take it — leave the warning firing — or, where the code is
+       * carryable, an entry of kind `undecided`, which is exactly that sentence.
+       */
+      carried: import_zod4.z.array(CarriedDebtSchema).optional()
     });
     DesignDepthSchema = import_zod4.z.enum(["components", "interfaces", "implementations", "narratives"]);
     RulesConfigSchema = import_zod4.z.object({
@@ -1364,8 +1447,28 @@ var init_specs = __esm({
     LintAllowSchema = import_zod7.z.object({
       /** The issue code being allowed (see `wairon rules list`). */
       code: import_zod7.z.string(),
+      /**
+       * The SITE inside this spec the allow covers, named exactly as the finding
+       * names it (a contract method, an import edge "from -> to", a declared edge
+       * "component -> target"). A finding that names a site is covered ONLY by an
+       * allow naming that same site; a finding that names none is covered only by
+       * an allow that names none either.
+       */
+      at: import_zod7.z.string().min(1).optional(),
+      /**
+       * The units of an AGGREGATING finding this allow covers — the steps of one
+       * CALL_STEP_UNREALIZED, the crossings of one UNDECLARED_COLOCATED_CALL —
+       * each named the way the finding's own message names it. The allow silences
+       * the finding only when it lists EVERY unit reported, so a unit nobody
+       * decided on surfaces on the day it appears instead of inheriting a decision
+       * taken about its neighbours. Meaningless without `at`, and refused there.
+       */
+      covers: import_zod7.z.array(import_zod7.z.string()).optional(),
       /** Why this finding is acceptable here (e.g. "dispatcher — fan-out is the point"). */
       reason: import_zod7.z.string().min(1)
+    }).refine((a) => !a.covers?.length || !!a.at, {
+      message: "`covers` names the units of ONE finding, so it needs the `at` that says which finding \u2014 add the site, or drop covers.",
+      path: ["covers"]
     });
     LintConfigSchema = import_zod7.z.object({
       allow: import_zod7.z.array(LintAllowSchema).default([])
@@ -2518,6 +2621,24 @@ var init_step_config = __esm({
 function pathKey(sourcePath) {
   return sourcePath.replace(/\\/g, "/").replace(/^\.\//, "");
 }
+function ownEntry(record2, key) {
+  return record2 && Object.prototype.hasOwnProperty.call(record2, key) ? record2[key] : void 0;
+}
+function importBindingOf(facts, name) {
+  return ownEntry(facts.importBindings, name);
+}
+function fieldTypesOf(facts, field) {
+  return ownEntry(facts.fieldTypes, field) ?? NO_FIELD_TYPES;
+}
+function typeBindingOf(facts, name) {
+  return ownEntry(facts.typeOnlyBindings, name) ?? ownEntry(facts.importBindings, name)?.from;
+}
+function callSitesOf(facts, fn) {
+  return ownEntry(facts.functionCallSites, fn);
+}
+function hasFunctionBody(facts, symbol) {
+  return callSitesOf(facts, symbol) !== void 0;
+}
 function resolveImport(fromFile, specifier, knownPaths) {
   if (!specifier.startsWith(".")) return void 0;
   const joined = pathKey(path6.posix.normalize(path6.posix.join(path6.posix.dirname(fromFile), specifier)));
@@ -2536,11 +2657,12 @@ function resolveImport(fromFile, specifier, knownPaths) {
   }
   return void 0;
 }
-var path6;
+var path6, NO_FIELD_TYPES;
 var init_code_model = __esm({
   "src/models/code-model.ts"() {
     "use strict";
     path6 = __toESM(require("path"));
+    NO_FIELD_TYPES = [];
   }
 });
 
@@ -3255,6 +3377,26 @@ var init_lockfile = __esm({
   }
 });
 
+// src/core/spec-files.ts
+function readSpecFile(filePath) {
+  return readYamlFile(filePath);
+}
+function writeSpecFile(filePath, document) {
+  writeYamlFile(filePath, document);
+}
+function listSpecFiles(specsDir) {
+  return listFilesRecursive(specsDir, SPEC_FILE_EXTENSION);
+}
+var SPEC_FILE_EXTENSION;
+var init_spec_files = __esm({
+  "src/core/spec-files.ts"() {
+    "use strict";
+    init_fs();
+    init_yaml();
+    SPEC_FILE_EXTENSION = ".yaml";
+  }
+});
+
 // src/core/narrative-labels.ts
 function resolveNarrativeLabels(methodName, steps) {
   const errors = [];
@@ -8917,13 +9059,84 @@ function buildCodeIndex(model) {
     cache2.set(path70, built);
     return built;
   };
+  const republished = /* @__PURE__ */ new Map();
+  const republishedFrom = (path70) => {
+    const cached = republished.get(path70);
+    if (cached) return cached;
+    const out = /* @__PURE__ */ new Set([path70]);
+    const queue = [path70];
+    while (queue.length) {
+      const from = queue.pop();
+      const f = facts.get(from);
+      if (f?.status !== "analyzed") continue;
+      for (const specifier of f.reexports) {
+        const to = resolveImport(from, specifier, paths);
+        if (to && !out.has(to)) {
+          out.add(to);
+          queue.push(to);
+        }
+      }
+    }
+    republished.set(path70, out);
+    return out;
+  };
+  const NO_ORIGIN = /* @__PURE__ */ new Set();
+  const landingFrom = (scope, specifier) => {
+    const to = resolveImport(scope, specifier, paths);
+    return to ? republishedFrom(to) : NO_ORIGIN;
+  };
+  const scopeOf2 = (site, from) => {
+    const path70 = pathKey(site.from ?? from);
+    const f = facts.get(path70);
+    return f?.status === "analyzed" && f.analysisGrade === "exact" ? { path: path70, facts: f } : void 0;
+  };
+  const originOf = (site, from) => {
+    const resolved = scopeOf2(site, from);
+    if (!resolved) return NO_ORIGIN;
+    const { path: scope, facts: f } = resolved;
+    const landing = (specifier) => landingFrom(scope, specifier);
+    if (!site.member) {
+      const binding = importBindingOf(f, site.name);
+      if (binding) return landing(binding.from);
+      return declarationsAt(scope).has(site.name) ? republishedFrom(scope) : NO_ORIGIN;
+    }
+    if (!site.via) return NO_ORIGIN;
+    const receiver = importBindingOf(f, site.via);
+    if (!receiver) return NO_ORIGIN;
+    if (receiver.namespace) return landing(receiver.from);
+    const through = landing(receiver.from);
+    for (const candidate of through) {
+      if (declarationsAt(candidate).has(site.name)) return through;
+    }
+    return NO_ORIGIN;
+  };
+  const possibleOriginsOf = (site, from) => {
+    const proven = originOf(site, from);
+    if (!site.field && !site.constructed) return proven;
+    const resolved = scopeOf2(site, from);
+    if (!resolved) return proven;
+    const { path: scope, facts: f } = resolved;
+    const out = new Set(proven);
+    const widenThrough = (name, specifier) => {
+      const landings = specifier !== void 0 ? landingFrom(scope, specifier) : declarationsAt(scope).has(name) ? republishedFrom(scope) : NO_ORIGIN;
+      for (const candidate of landings) out.add(candidate);
+    };
+    if (site.field) {
+      for (const typeName of fieldTypesOf(f, site.field)) widenThrough(typeName, typeBindingOf(f, typeName));
+    }
+    if (site.constructed) widenThrough(site.constructed, importBindingOf(f, site.constructed)?.from);
+    return out;
+  };
+  const declarationsAt = (path70) => namesAt(declarations, pathKey(path70), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames]));
   return {
     paths,
     exactPaths,
     factsAt: (path70) => facts.get(pathKey(path70)),
-    declarationsAt: (path70) => namesAt(declarations, pathKey(path70), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames])),
+    declarationsAt,
     anchorsAt: (path70) => namesAt(anchors, pathKey(path70), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames, ...f.anchoredNames])),
-    findingAnchorsAt: (path70) => namesAt(findingAnchors, pathKey(path70), (f) => new Set(f.anchoredNames))
+    findingAnchorsAt: (path70) => namesAt(findingAnchors, pathKey(path70), (f) => new Set(f.anchoredNames)),
+    originOf,
+    possibleOriginsOf
   };
 }
 function buildRealizationIndex(ctx) {
@@ -9537,10 +9750,10 @@ var init_lint_allows = __esm({
     "use strict";
     lintAllowsRule = {
       name: "lint-allows",
-      description: "Per-spec lint suppressions (lint.allow) must name real issue codes and actually suppress a finding \u2014 unknown codes and stale allows are flagged. Allows silence warnings only; errors always surface.",
+      description: "Per-spec lint suppressions (lint.allow) must name real issue codes and actually suppress a finding \u2014 unknown codes and stale allows are flagged. An allow covers exactly the occurrence it names: a finding that reports a site is silenced only by an allow whose `at` is that site, a finding that reports none only by an allow that names none, and an aggregating finding only by an allow whose `covers` lists every unit it reports \u2014 a unit nobody listed is named back as new instead of inheriting a decision taken about its neighbours. So a coarse allow left on a rule that names sites, and an allow whose site the run no longer reports, are both UNUSED_LINT_ALLOW, and the finding names the sites that did fire. Allows silence warnings only; errors always surface.",
       codes: [
         { code: "UNKNOWN_LINT_ALLOW_CODE", defaultSeverity: "warning", summary: "lint.allow names an issue code no registered rule emits" },
-        { code: "UNUSED_LINT_ALLOW", defaultSeverity: "warning", summary: "lint.allow entry matched no finding this run \u2014 remove the stale allow" }
+        { code: "UNUSED_LINT_ALLOW", defaultSeverity: "warning", summary: "lint.allow entry matched no finding this run \u2014 the code never fired, or it fired at sites this allow does not name" }
       ],
       check(ctx) {
         for (const a of ctx.lintAllows) {
@@ -9553,14 +9766,24 @@ var init_lint_allows = __esm({
             );
             continue;
           }
-          if (!a.used) {
-            ctx.addIssue(
-              "warning",
-              "UNUSED_LINT_ALLOW",
-              `Spec "${a.specId}" allows "${a.code}" (reason: ${a.reason}) but no such finding fired this run \u2014 remove the stale allow.`,
-              a.specId
-            );
+          if (a.used) continue;
+          const reported = ctx.sitesReported(a.specId, a.code);
+          const at = a.at ? ` at "${a.at}"` : "";
+          let why;
+          if (a.at && reported.unsited && reported.sites.length === 0) {
+            why = `findings of "${a.code}" on this spec name no site at all, so this allow must not name one \u2014 drop the \`at\``;
+          } else if (reported.sites.length > 0) {
+            const sites = reported.sites.map((s) => `"${s}"`).join("; ");
+            why = a.at ? `that code fired at ${sites} instead \u2014 retarget the allow, or remove it` : `that code fired at ${sites}, and a sited finding is covered only by an allow naming its site \u2014 give this allow an \`at\` (one per site, each with its own reason), or remove it`;
+          } else {
+            why = "no such finding fired this run \u2014 remove the stale allow";
           }
+          ctx.addIssue(
+            "warning",
+            "UNUSED_LINT_ALLOW",
+            `Spec "${a.specId}" allows "${a.code}"${at} (reason: ${a.reason}), but ${why}.`,
+            a.specId
+          );
         }
       }
     };
@@ -13152,6 +13375,21 @@ var init_source_file_linkage = __esm({
 });
 
 // src/core/rules/conformance/method-realization.ts
+function bodyReachable(code, file, symbol) {
+  const facts = code.factsAt(file);
+  if (!facts) return true;
+  const names = /* @__PURE__ */ new Set([symbol]);
+  const binding = importBindingOf(facts, symbol);
+  if (binding?.imported) names.add(binding.imported);
+  const origins = code.originOf({ name: symbol, member: false }, file);
+  if (origins.size === 0) return true;
+  for (const origin of origins) {
+    const at = code.factsAt(origin);
+    if (!at || at.status !== "analyzed" || at.analysisGrade !== "exact") return true;
+    for (const name of names) if (hasFunctionBody(at, name)) return true;
+  }
+  return false;
+}
 var methodRealizationRule;
 var init_method_realization = __esm({
   "src/core/rules/conformance/method-realization.ts"() {
@@ -13159,9 +13397,10 @@ var init_method_realization = __esm({
     init_models();
     methodRealizationRule = {
       name: "method-realization",
-      description: "Code\u2194spec Level 1: every L3 contract method must be realized in its own source file (the method's sourcePath, else the implementation's) at its conformance tier \u2014 declared | anchored | off; Portals default to anchored, everything else to declared, and a per-method `symbol` maps an intent-language name onto the code name. Findings carry the analysis grade (exact AST | pattern table | generic scan) so weaker analysis is visible. Methods whose file escapes the root, is missing or could not be analyzed are left to source-file-linkage, and implementations under chained subsystems (projectPath) validate standalone in their own project run.",
+      description: "Code\u2194spec Level 1: every L3 contract method must be realized in its own source file (the method's sourcePath, else the implementation's) at its conformance tier \u2014 declared | anchored | off; Portals default to anchored, everything else to declared, and a per-method `symbol` maps an intent-language name onto the code name. A method realized by a DECLARATION owes a function BODY as well: at exact grade one must be reachable under the symbol, here or through the imports and republications this file forwards it by, so a signature, an ambient or interface declaration or a plain value binding stops reading as an implementation (METHOD_BODY_NOT_FOUND). Findings carry the analysis grade (exact AST | pattern table | generic scan) so weaker analysis is visible. Methods whose file escapes the root, is missing or could not be analyzed are left to source-file-linkage, and implementations under chained subsystems (projectPath) validate standalone in their own project run.",
       codes: [
-        { code: "UNREALIZED_METHOD", defaultSeverity: "warning", summary: "An L3 contract method has no anchor in its own source file (the method's sourcePath, else the implementation's) at the required conformance tier" }
+        { code: "UNREALIZED_METHOD", defaultSeverity: "warning", summary: "An L3 contract method has no anchor in its own source file (the method's sourcePath, else the implementation's) at the required conformance tier" },
+        { code: "METHOD_BODY_NOT_FOUND", defaultSeverity: "warning", summary: "The method symbol IS declared in its own source file, but the file holds no function-like body under it \u2014 a signature, an ambient or interface declaration, a value binding, an imported or re-exported name", carryable: true }
       ],
       check(ctx) {
         const code = ctx.codeIndex();
@@ -13185,7 +13424,22 @@ var init_method_realization = __esm({
             const inDeclared = code.declarationsAt(file).has(symbol);
             const inAnchored = inDeclared || code.anchorsAt(file).has(symbol);
             const realized = tier === "declared" ? inDeclared : inAnchored;
-            if (realized) continue;
+            if (realized) {
+              if (!inDeclared || facts.analysisGrade !== "exact" || bodyReachable(code, file, symbol)) continue;
+              const bodyLabel = methodImpl?.symbol ? `"${method2.name}" (symbol "${symbol}")` : `"${method2.name}"`;
+              ctx.addIssue(
+                "warning",
+                "METHOD_BODY_NOT_FOUND",
+                `Method ${bodyLabel} of contract "${impl.contract}" is declared in "${file}" but has no function body there \u2014 a signature, an ambient or interface declaration, a value binding, or a name this file only imports or re-exports. Every deeper check reads a body (the realized calls of Level 3, the measured complexity of the detail dial), so this method is judged on its name alone. Point the sourcePath at the file that implements it, map the code name via a per-method SYMBOL, or dial this method to "off".`,
+                impl.id,
+                draft,
+                void 0,
+                // One method, one indivisible fact: nothing here aggregates, so
+                // the site alone is the whole identity.
+                { at: method2.name }
+              );
+              continue;
+            }
             const label = methodImpl?.symbol ? `"${method2.name}" (symbol "${symbol}")` : `"${method2.name}"`;
             const weakHint = tier === "declared" && inAnchored ? " Only a weak string/word anchor exists \u2014 declare the symbol, map it via a per-method `symbol`, or dial this method to `anchored`." : "";
             ctx.addIssue(
@@ -13252,24 +13506,54 @@ var init_finding_realization = __esm({
 });
 
 // src/core/rules/conformance/call-conformance.ts
-function ownEntry(record2, key) {
-  return record2 && Object.prototype.hasOwnProperty.call(record2, key) ? record2[key] : void 0;
-}
-function closedCallees(facts, fn) {
-  const direct = ownEntry(facts.functionCalls, fn);
+function closedCallSites(code, file, fn, stopAt) {
+  const facts = code.factsAt(file);
+  const direct = facts && callSitesOf(facts, fn);
   if (!direct) return void 0;
-  const closed = new Set(direct);
-  const queue = [...direct];
+  const here = pathKey(file);
+  const out = [];
+  const descended = /* @__PURE__ */ new Set([`${here}|${fn}`]);
+  const queue = direct.map((s) => ({ ...s, from: s.from ?? here }));
   while (queue.length) {
-    const name = queue.pop();
-    for (const next of ownEntry(facts.functionCalls, name) ?? []) {
-      if (!closed.has(next)) {
-        closed.add(next);
-        queue.push(next);
-      }
-    }
+    const site = queue.pop();
+    out.push(site);
+    if (stopAt?.has(site.name)) continue;
+    const key = `${site.from}|${site.name}`;
+    if (descended.has(key)) continue;
+    descended.add(key);
+    const scope = code.factsAt(site.from);
+    const next = scope && callSitesOf(scope, site.name);
+    if (!next) continue;
+    queue.push(...next.map((s) => ({ ...s, from: s.from ?? site.from })));
   }
-  return closed;
+  return out;
+}
+function resolveCallTarget(ctx, componentId, methodName) {
+  const accepted = /* @__PURE__ */ new Set([methodName]);
+  const files = /* @__PURE__ */ new Set();
+  for (const intf of ctx.interfacesByComponent.get(componentId) ?? []) {
+    for (const impl of ctx.implementationsByContract.get(intf.id) ?? []) {
+      const method2 = impl.methods.find((m) => m.name === methodName);
+      if (!method2 && !intf.methods.some((m) => m.name === methodName)) continue;
+      if (method2?.symbol) accepted.add(method2.symbol);
+      const file = methodSourceFile(method2 ?? {}, impl.sourcePath);
+      if (file) files.add(pathKey(file));
+    }
+  }
+  return { accepted, files };
+}
+function describeSite(site) {
+  if (!site.member) return `${site.name}(\u2026)`;
+  if (site.via) return `${site.via}.${site.name}(\u2026)`;
+  if (site.field) return `this.${site.field}.${site.name}(\u2026)`;
+  if (site.constructed) return `new ${site.constructed}(\u2026).${site.name}(\u2026)`;
+  return `<receiver>.${site.name}(\u2026)`;
+}
+function describeMiss(m) {
+  const head = `step ${m.step} \u2192 ${m.target} (looked for ${m.accepted.map((a) => `"${a}"`).join(" / ")}`;
+  if (m.miss.kind === "elsewhere") return `${head}, called but resolved to ${m.miss.landed.map((p) => `"${p}"`).join(", ")})`;
+  if (m.miss.kind === "unresolved") return `${head}, written as ${m.miss.shapes.map((s) => `\`${s}\``).join(" / ")})`;
+  return `${head})`;
 }
 var callConformanceRule;
 var init_call_conformance = __esm({
@@ -13278,13 +13562,24 @@ var init_call_conformance = __esm({
     init_models();
     callConformanceRule = {
       name: "call-conformance",
-      description: "Code\u2194spec Level 3 (opener): every narrative `call` step of an exactly-analyzed method must be realized as a call in the realized function, read from the method's own source file (its sourcePath, else the implementation's) \u2014 the target method's contract name or its per-method symbol override must appear among the function's callees, closed transitively over same-file named helpers. Set membership only: order, arguments, and conditions are deliberately unverified, and dispatch steps (runtime-table routed) are skipped. Respects the conformance dial (off skips) and fires only at exact analysis grade \u2014 weaker grades never guess.",
+      description: "Code\u2194spec Level 3: the narrative `call` step \u2194 realized call relation, judged both ways against the method's own source file (its sourcePath, else the implementation's), at exact analysis grade only. Forward: every `call` step must be realized by a call whose callee RESOLVES TO one of the target method's own source files \u2014 the target's contract name or a per-method `symbol` override, closed transitively over the named helpers the realized function calls, and resolved against every file the call CAN have reached: a `this.<field>.<method>()` receiver followed through the field's DECLARED TYPE, a `new Class(...).<method>()` receiver through the module its CLASS NAME came from. A matching call whose origin a pure model cannot resolve is reported apart as CALL_ORIGIN_UNRESOLVED, which NAMES the shape it could not follow and asks for nothing \u2014 a coverage hole in the reader, reported for the reason CONFORMANCE_DEGRADED is: a silently degraded gate is worse than a degraded one. A finding names a landing only from the PROVEN tier so that widening what a call reached can accept a step but never accuse one, and a target that names no file of its own falls back to name membership. Converse: a call that resolves to a modelled method of ANOTHER component in the SAME file crosses a component boundary while looking local, so the narrative must declare it (UNDECLARED_COLOCATED_CALL) \u2014 judged on the proven tier alone, and a same-file private helper is no modelled method and is never reported. Order, arguments and conditions stay unverified, dispatch steps (runtime-table routed) are skipped, the conformance dial (off) skips, and weaker analysis grades never guess.",
       codes: [
-        { code: "CALL_STEP_UNREALIZED", defaultSeverity: "warning", summary: "Narrative call step whose target method name (or symbol) never appears among the realized function's callees in the method's source file (exact grade, set membership)" }
+        { code: "CALL_STEP_UNREALIZED", defaultSeverity: "warning", summary: "Narrative call step realized by no call that resolves to the target method's own source file \u2014 the call is absent, or it lands in another module", carryable: true },
+        { code: "CALL_ORIGIN_UNRESOLVED", defaultSeverity: "warning", summary: "Narrative call step whose target name IS called, but only from call sites written in a shape this analysis cannot resolve to a file \u2014 the step was not checked, and is neither proven realized nor accused", carryable: true },
+        { code: "UNDECLARED_COLOCATED_CALL", defaultSeverity: "warning", summary: "The realized function calls a modelled method of another component living in the same source file, and no narrative step declares that call", carryable: true }
       ],
       check(ctx) {
         const code = ctx.codeIndex();
-        for (const entry of ctx.implementationMethods()) {
+        const methods = ctx.implementationMethods();
+        const modelledAt = /* @__PURE__ */ new Map();
+        for (const entry of methods) {
+          if (!entry.sourceFile) continue;
+          const file = pathKey(entry.sourceFile);
+          const byName = modelledAt.get(file) ?? /* @__PURE__ */ new Map();
+          byName.set(entry.method.symbol ?? entry.method.name, { component: entry.component.id, method: entry.method.name });
+          modelledAt.set(file, byName);
+        }
+        for (const entry of methods) {
           const { implementation: impl, method: implMethod, component, sourceFile: file } = entry;
           const tier = implMethod.conformance ?? impl.conformance ?? defaultConformanceTier(component);
           if (tier === "off") continue;
@@ -13292,37 +13587,91 @@ var init_call_conformance = __esm({
           if (!file) continue;
           const facts = code.factsAt(file);
           if (!facts || facts.status !== "analyzed" || facts.analysisGrade !== "exact") continue;
+          const here = pathKey(file);
           const fnSymbol = implMethod.symbol ?? implMethod.name;
-          const callees = closedCallees(facts, fnSymbol);
-          if (!callees) continue;
-          const missing = [];
+          const colocated = modelledAt.get(here) ?? /* @__PURE__ */ new Map();
+          const sites = closedCallSites(code, file, fnSymbol);
+          if (!sites) continue;
+          const missed = [];
           for (const step of implMethod.narrative) {
             if (step.type !== "call" || !step.targetComponent || !step.targetMethod) continue;
             if (!ctx.componentMap.has(step.targetComponent)) continue;
-            const accepted = /* @__PURE__ */ new Set([step.targetMethod]);
-            for (const targetIntf of ctx.interfacesByComponent.get(step.targetComponent) ?? []) {
-              for (const targetImpl of ctx.implementationsByContract.get(targetIntf.id) ?? []) {
-                const targetMethod = targetImpl.methods.find((m) => m.name === step.targetMethod);
-                if (targetMethod?.symbol) accepted.add(targetMethod.symbol);
+            const target = resolveCallTarget(ctx, step.targetComponent, step.targetMethod);
+            if (target.accepted.has(fnSymbol)) continue;
+            const matching = sites.filter((s) => target.accepted.has(s.name));
+            const ref = `${step.targetComponent}.${step.targetMethod}`;
+            if (target.files.size === 0) {
+              if (matching.length === 0) {
+                missed.push({ step: step.stepNumber, target: ref, accepted: [...target.accepted], miss: { kind: "absent" } });
               }
+              continue;
             }
-            if (accepted.has(fnSymbol)) continue;
-            if ([...accepted].some((name) => callees.has(name))) continue;
-            missing.push({
-              step: step.stepNumber,
-              target: `${step.targetComponent}.${step.targetMethod}`,
-              accepted: [...accepted]
-            });
+            const landed = /* @__PURE__ */ new Set();
+            let realized = false;
+            for (const site of matching) {
+              for (const origin of code.originOf(site, file)) landed.add(origin);
+              for (const origin of code.possibleOriginsOf(site, file)) {
+                if (target.files.has(origin)) realized = true;
+              }
+            }
+            if (realized) continue;
+            const miss = matching.length === 0 ? { kind: "absent" } : landed.size === 0 ? { kind: "unresolved", shapes: [...new Set(matching.map(describeSite))].sort() } : { kind: "elsewhere", landed: [...landed].sort() };
+            missed.push({ step: step.stepNumber, target: ref, accepted: [...target.accepted], miss });
+          }
+          const unrealized = missed.filter((m) => m.miss.kind !== "unresolved");
+          const unresolved = missed.filter((m) => m.miss.kind === "unresolved");
+          if (unrealized.length) {
+            ctx.addIssue(
+              "warning",
+              "CALL_STEP_UNREALIZED",
+              `Method "${implMethod.name}" in implementation "${impl.id}": ${unrealized.length} narrative call step(s) are realized by no call of the function "${fnSymbol}" in "${file}" that resolves to the target's own source file \u2014 ${unrealized.map(describeMiss).join("; ")}. Callees are closed over the named helpers the function calls, and each call site is resolved through this file's import bindings (order, arguments and conditions are not checked). Realize the calls, fix the narrative, or map code names via per-method symbols on the targets.`,
+              impl.id,
+              entry.draftContext,
+              void 0,
+              // A step, named by its number and its target: what the register
+              // carries is ONE unresolved step, never "this method's call steps".
+              { at: implMethod.name, covers: unrealized.map((m) => `${m.step}:${m.target}`) }
+            );
+          }
+          if (unresolved.length) {
+            ctx.addIssue(
+              "warning",
+              "CALL_ORIGIN_UNRESOLVED",
+              `Method "${implMethod.name}" in implementation "${impl.id}": ${unresolved.length} narrative call step(s) ARE called by name inside the function "${fnSymbol}" in "${file}", but every site calling them is written in a shape this analysis cannot resolve to a file \u2014 ${unresolved.map(describeMiss).join("; ")}. What resolves is a name bound to a module of THIS project: a bare or namespaced call through such an import binding, a \`this.<field>\` receiver whose declared type names one, a \`new Class(\u2026)\` receiver whose class does. What does not: an import from a PACKAGE specifier, a receiver holding a value the module assembled, a receiver this model records no name for. This reports what was not checked, not what is wrong \u2014 the step is neither proven realized nor accused of being missing, and no working call is asked to be rewritten to suit the reader.`,
+              impl.id,
+              entry.draftContext,
+              void 0,
+              { at: implMethod.name, covers: unresolved.map((m) => `${m.step}:${m.target}`) }
+            );
+          }
+          const declared = /* @__PURE__ */ new Set();
+          for (const step of implMethod.narrative) {
+            if (step.targetComponent && step.targetMethod) declared.add(`${step.targetComponent}.${step.targetMethod}`);
+          }
+          const crossings = /* @__PURE__ */ new Map();
+          for (const site of closedCallSites(code, file, fnSymbol, new Set(colocated.keys())) ?? []) {
+            const owner = colocated.get(site.name);
+            if (!owner || owner.component === component.id) continue;
+            const ref = `${owner.component}.${owner.method}`;
+            if (declared.has(ref) || crossings.has(ref)) continue;
+            if (!code.originOf(site, file).has(here)) continue;
+            crossings.set(ref, site.name);
+          }
+          if (crossings.size) {
+            const detail = [...crossings].map(([ref, name]) => `"${name}" (${ref})`).join("; ");
+            ctx.addIssue(
+              "warning",
+              "UNDECLARED_COLOCATED_CALL",
+              `Method "${implMethod.name}" in implementation "${impl.id}": the function "${fnSymbol}" in "${file}" calls ${crossings.size} modelled method(s) of OTHER components living in that same file, and no narrative step declares the call \u2014 ${detail}. Sharing a file does not make the hop internal: it crosses a component boundary nothing imports, so no file-level check can see it. Narrate the call, or move the code so the boundary is real.`,
+              impl.id,
+              entry.draftContext,
+              void 0,
+              // The crossings themselves. Keyed by method alone, a 24th crossing
+              // would ride into a register entry written for 23 - so each one is
+              // named, and one nobody carried fires on the day it appears.
+              { at: implMethod.name, covers: [...crossings.keys()] }
+            );
           }
-          if (missing.length === 0) continue;
-          const detail = missing.map((m) => `step ${m.step} \u2192 ${m.target} (looked for ${m.accepted.map((a) => `"${a}"`).join(" / ")})`).join("; ");
-          ctx.addIssue(
-            "warning",
-            "CALL_STEP_UNREALIZED",
-            `Method "${implMethod.name}" in implementation "${impl.id}": ${missing.length} narrative call step(s) are not realized as calls of the function "${fnSymbol}" in "${file}" \u2014 ${detail}. Callees are matched by name, closed over same-file helpers (exact grade, set membership \u2014 order and arguments are not checked). Realize the calls, fix the narrative, or map code names via per-method symbols on the targets.`,
-            impl.id,
-            entry.draftContext
-          );
         }
       }
     };
@@ -13453,7 +13802,13 @@ var init_dependency_conformance = __esm({
               "UNDECLARED_DEPENDENCY",
               `"${fromPath}" (realizing ${fromComponents.map((c) => c.id).join(", ")}) imports "${toPath}" (realizing ${toComponents.map((c) => c.id).join(", ")}) but no declared dependsOn/owns edge justifies it \u2014 declare the collaboration on the component that actually uses it, or route the cross-subsystem hop through the target's published surface.`,
               realization.implementationsAt(fromPath)[0]?.id,
-              draftAt(fromPath) || draftAt(toPath)
+              draftAt(fromPath) || draftAt(toPath),
+              void 0,
+              // One import edge, one indivisible fact — but one implementation
+              // maps many files and many edges, so the EDGE is the site, not the
+              // spec. Without it a single allow on the spec covers every crossing
+              // that file ever grows.
+              { at: `${fromPath} -> ${toPath}` }
             );
           }
         }
@@ -13480,7 +13835,12 @@ var init_dependency_conformance = __esm({
               "UNREALIZED_DEPENDENCY",
               `Component "${component.id}" declares ${relation} "${targetId}", but no runtime import connects their source files (${fromFiles.join(", ")} \u219B ${crossSubsystem ? `subsystem ${target.subsystem}` : filesOf(targetId).join(", ")}) \u2014 either the collaboration is wired indirectly (DI) or the declared edge is stale.`,
               impls[0]?.id ?? component.id,
-              draft
+              draft,
+              void 0,
+              // One declared edge, one indivisible fact. A component declares many,
+              // and they all anchor on its one implementation spec, so the EDGE is
+              // the site.
+              { at: `${component.id} -> ${targetId}` }
             );
           }
         }
@@ -13832,6 +14192,69 @@ var init_unclaimed_source = __esm({
   }
 });
 
+// src/core/rules/conformance/carried-debt.ts
+var carriedDebtRule;
+var init_carried_debt = __esm({
+  "src/core/rules/conformance/carried-debt.ts"() {
+    "use strict";
+    carriedDebtRule = {
+      name: "carried-debt",
+      description: "The conformance debt register (`rules.conformance.carried`) holds the code\u2194spec findings this tree carries as declared, classified debt \u2014 `unclaimed`'s one-way shape, for findings about code a spec does name. It is not a second lint.allow: an allow says a finding is wrong here by design, an entry here says the finding is right and unpaid, and each entry states which of the three kinds it is (drift: spec and code disagree; undecided: the fix waits on a modelling decision nobody has taken; unreadable: the analysis cannot follow the shape the code is written in) and why. Only a code a rule declares CARRYABLE may appear, and naming any other is an error, so the register can never widen into general-purpose suppression. An entry carries a finding only when it lists EVERY unit that finding reports, so an aggregating finding cannot grow behind it; an entry that matched nothing, that duplicates another, that names a spec the tree does not hold, or that lists a unit no longer reported is STALE_CARRIED_FINDING, so the register only shrinks. The audit is silent in a run that could not have fired the findings at all: one that built no code model, the specs outside a scoped run, and a code the project switched off. Nothing can check a reason for TRUTH \u2014 a stale entry is one that stopped applying, never one that still applies for a reason that has become false \u2014 so a reason group may declare its own classification provisional (`revisit`: what would settle it), and every run counts those findings beside the kind totals.",
+      codes: [
+        { code: "UNCARRYABLE_FINDING", defaultSeverity: "error", summary: "The conformance debt register names an issue code no rule emits, or one no rule declares carryable \u2014 the register holds measured code\u2194spec debt, never a design rule somebody wants quiet" },
+        { code: "STALE_CARRIED_FINDING", defaultSeverity: "warning", summary: "An entry of the conformance debt register carries a finding that no longer fires, or lists a unit that finding no longer reports \u2014 delete it, the register only shrinks" }
+      ],
+      check(ctx) {
+        const carried = ctx.carriedFindings;
+        if (carried.length === 0) return;
+        for (const entry of carried) {
+          if (ctx.carryableIssueCodes.has(entry.code)) continue;
+          const why = ctx.knownIssueCodes.has(entry.code) ? "that code is not CARRYABLE \u2014 the register holds measured code\u2194spec debt, and a doctrine, soundness or configuration finding says the design is illegal rather than unfinished" : "no registered rule emits that code";
+          ctx.addIssue(
+            "error",
+            "UNCARRYABLE_FINDING",
+            `The conformance debt register carries "${entry.code}" on "${entry.spec}" (at "${entry.at}"), but ${why}. Remove the entry; if the code belongs in the register, declare it carryable on the rule that emits it.`
+          );
+        }
+        if (ctx.codeModel.files.length === 0) return;
+        const known = new Set(ctx.specIds().map((s) => s.id));
+        const addressed = /* @__PURE__ */ new Set();
+        for (const entry of carried) {
+          if (!ctx.carryableIssueCodes.has(entry.code)) continue;
+          if (ctx.rules?.sddRuleSeverity?.[entry.code] === "off") continue;
+          if (!ctx.isSpecInScope(entry.spec)) continue;
+          const key = `${entry.spec}|${entry.code}|${entry.at}`;
+          if (addressed.has(key)) {
+            ctx.addIssue(
+              "warning",
+              "STALE_CARRIED_FINDING",
+              `The conformance debt register carries "${entry.code}" on "${entry.spec}" (at "${entry.at}") more than once. Only the first entry can ever match, so the rest carry nothing \u2014 delete them and merge their units into the one entry.`
+            );
+            continue;
+          }
+          addressed.add(key);
+          if (!entry.fired) {
+            const why = known.has(entry.spec) ? "no such finding fired this run \u2014 the debt is paid, or the spec no longer reaches that site" : `the tree holds no spec "${entry.spec}"`;
+            ctx.addIssue(
+              "warning",
+              "STALE_CARRIED_FINDING",
+              `The conformance debt register carries "${entry.code}" on "${entry.spec}" (at "${entry.at}" \u2014 ${entry.kind}: ${entry.why}), but ${why}. Delete the entry; the register only shrinks.`
+            );
+            continue;
+          }
+          const paid = entry.covers.filter((unit) => !entry.seen.has(unit));
+          if (paid.length === 0) continue;
+          ctx.addIssue(
+            "warning",
+            "STALE_CARRIED_FINDING",
+            `The conformance debt register carries "${entry.code}" on "${entry.spec}" (at "${entry.at}") together with ${paid.length} unit(s) the finding no longer reports \u2014 ${paid.map((u) => `"${u}"`).join("; ")}. That much of the debt is paid: delete those lines from the entry's \`covers\`; the register only shrinks.`
+          );
+        }
+      }
+    };
+  }
+});
+
 // src/core/rules/heuristic/coupling-health.ts
 var DEFAULT_GOD_COMPONENT_THRESHOLD, couplingRule;
 var init_coupling_health = __esm({
@@ -14986,8 +15409,8 @@ function registerPackRules(packRules) {
   for (const rule of packRules) addRule(rule);
 }
 function ruleSequence() {
-  const base = ruleSet.filter((r) => r !== lintAllowsRule);
-  return ruleSet.includes(lintAllowsRule) ? [...base, lintAllowsRule] : base;
+  const audits = [carriedDebtRule, lintAllowsRule].filter((r) => ruleSet.includes(r));
+  return [...ruleSet.filter((r) => !audits.includes(r)), ...audits];
 }
 function specScopedRules() {
   return ruleSequence().filter((r) => r.scope === "spec");
@@ -15077,6 +15500,7 @@ var init_repository = __esm({
     init_integration_sim_coverage();
     init_type_realization();
     init_unclaimed_source();
+    init_carried_debt();
     init_coupling_health();
     init_signature_language_builtins();
     init_narrative_language_constructs();
@@ -15268,8 +15692,11 @@ var init_repository = __esm({
       // elsewhere?) rather than spec content.
       packResolutionRule,
       reproducibilityRule,
-      // MUST run last: it audits which lint.allow entries the earlier rules
-      // actually consumed (stale/unknown allows).
+      // MUST run last, in this order: each audits what the earlier rules did
+      // with a declared exception. The debt register first (which carried
+      // findings the conformance family actually matched), then the allows
+      // (which suppressions any rule actually consumed).
+      carriedDebtRule,
       lintAllowsRule
     ];
     ruleSet = [];
@@ -15392,9 +15819,15 @@ function walkExact(ts, sourceText, fileName) {
   const imports = /* @__PURE__ */ new Set();
   const reexports = /* @__PURE__ */ new Set();
   const starExports = [];
+  const namedReexports = [];
   const complexity = /* @__PURE__ */ new Map();
   const calls = /* @__PURE__ */ new Map();
+  const importBindings = /* @__PURE__ */ new Map();
+  const typeOnlyBindings = /* @__PURE__ */ new Map();
+  const fieldTypes = /* @__PURE__ */ new Map();
   const mutableBindings = /* @__PURE__ */ new Set();
+  const receiverKey = (site) => site.via ?? (site.field ? `this.${site.field}` : site.constructed ? `new ${site.constructed}` : "");
+  const siteKey = (site) => `${site.member ? "m" : "b"}:${receiverKey(site)}:${site.name}`;
   const addBindingNames = (name) => {
     if (ts.isIdentifier(name)) declared.add(name.text);
     else if (ts.isObjectBindingPattern(name) || ts.isArrayBindingPattern(name)) {
@@ -15408,6 +15841,17 @@ function walkExact(ts, sourceText, fileName) {
     if (ts.isPrivateIdentifier(name)) return name.text;
     return void 0;
   };
+  const typeReferenceName = (type) => type && ts.isTypeReferenceNode(type) && ts.isIdentifier(type.typeName) ? type.typeName.text : void 0;
+  const isParameterProperty = (node) => !!node.modifiers?.some((m) => m.kind === ts.SyntaxKind.PublicKeyword || m.kind === ts.SyntaxKind.PrivateKeyword || m.kind === ts.SyntaxKind.ProtectedKeyword || m.kind === ts.SyntaxKind.ReadonlyKeyword);
+  const recordFieldType = (name, type) => {
+    const typeName = typeReferenceName(type);
+    if (!typeName) return;
+    const field = propertyNameText(name);
+    if (!field) return;
+    const named = fieldTypes.get(field) ?? /* @__PURE__ */ new Set();
+    named.add(typeName);
+    fieldTypes.set(field, named);
+  };
   const hasExportModifier = (node) => {
     const mods = node.modifiers;
     return !!mods?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword);
@@ -15430,7 +15874,10 @@ function walkExact(ts, sourceText, fileName) {
   };
   const collectFunctionFacts = (fn) => {
     let score = 1;
-    const callees = /* @__PURE__ */ new Set();
+    const callees = /* @__PURE__ */ new Map();
+    const addSite = (site) => {
+      callees.set(siteKey(site), site);
+    };
     const count = (node) => {
       if (namedFunctionName(node) !== void 0) return;
       if (ts.isIfStatement(node) || ts.isConditionalExpression(node) || ts.isForStatement(node) || ts.isForInStatement(node) || ts.isForOfStatement(node) || ts.isWhileStatement(node) || ts.isDoStatement(node) || ts.isCaseClause(node) || ts.isCatchClause(node)) {
@@ -15442,8 +15889,17 @@ function walkExact(ts, sourceText, fileName) {
         }
       } else if (ts.isCallExpression(node)) {
         const callee = node.expression;
-        if (ts.isIdentifier(callee)) callees.add(callee.text);
-        else if (ts.isPropertyAccessExpression(callee)) callees.add(callee.name.text);
+        if (ts.isIdentifier(callee)) addSite({ name: callee.text, member: false });
+        else if (ts.isPropertyAccessExpression(callee)) {
+          const receiver = callee.expression;
+          const name = callee.name.text;
+          if (ts.isIdentifier(receiver)) addSite({ name, member: true, via: receiver.text });
+          else if (ts.isPropertyAccessExpression(receiver) && receiver.expression.kind === ts.SyntaxKind.ThisKeyword) {
+            addSite({ name, member: true, field: receiver.name.text });
+          } else if (ts.isNewExpression(receiver) && ts.isIdentifier(receiver.expression)) {
+            addSite({ name, member: true, constructed: receiver.expression.text });
+          } else addSite({ name, member: true });
+        }
       }
       ts.forEachChild(node, count);
     };
@@ -15455,9 +15911,13 @@ function walkExact(ts, sourceText, fileName) {
     if (fnName && node.body) {
       const facts = collectFunctionFacts(node);
       complexity.set(fnName, Math.max(complexity.get(fnName) ?? 0, facts.score));
-      const set = calls.get(fnName) ?? /* @__PURE__ */ new Set();
-      for (const c of facts.callees) set.add(c);
-      calls.set(fnName, set);
+      const sites = calls.get(fnName) ?? /* @__PURE__ */ new Map();
+      for (const [key, site] of facts.callees) sites.set(key, site);
+      calls.set(fnName, sites);
+    }
+    if (ts.isPropertyDeclaration(node)) recordFieldType(node.name, node.type);
+    else if (ts.isParameter(node) && node.parent && ts.isConstructorDeclaration(node.parent) && isParameterProperty(node)) {
+      recordFieldType(node.name, node.type);
     }
     if (ts.isFunctionDeclaration(node) || ts.isClassDeclaration(node) || ts.isInterfaceDeclaration(node) || ts.isTypeAliasDeclaration(node) || ts.isEnumDeclaration(node) || ts.isModuleDeclaration(node)) {
       const name = node.name && ts.isIdentifier(node.name) ? node.name.text : void 0;
@@ -15484,11 +15944,24 @@ function walkExact(ts, sourceText, fileName) {
     } else if (ts.isImportDeclaration(node)) {
       const clause = node.importClause;
       const typeOnly = clause?.isTypeOnly ?? false;
-      if (!typeOnly && ts.isStringLiteral(node.moduleSpecifier)) imports.add(node.moduleSpecifier.text);
-      if (clause?.name) declared.add(clause.name.text);
+      const spec = ts.isStringLiteral(node.moduleSpecifier) ? node.moduleSpecifier.text : void 0;
+      if (!typeOnly && spec) imports.add(spec);
+      const bind = (name, namespace, imported, elementTypeOnly = false) => {
+        declared.add(name);
+        if (!spec) return;
+        if (typeOnly || elementTypeOnly) {
+          typeOnlyBindings.set(name, spec);
+          return;
+        }
+        const fact = { from: spec };
+        if (namespace) fact.namespace = true;
+        if (imported && imported !== name) fact.imported = imported;
+        importBindings.set(name, fact);
+      };
+      if (clause?.name) bind(clause.name.text, false);
       if (clause?.namedBindings) {
-        if (ts.isNamespaceImport(clause.namedBindings)) declared.add(clause.namedBindings.name.text);
-        else for (const el of clause.namedBindings.elements) declared.add(el.name.text);
+        if (ts.isNamespaceImport(clause.namedBindings)) bind(clause.namedBindings.name.text, true);
+        else for (const el of clause.namedBindings.elements) bind(el.name.text, false, el.propertyName?.text, el.isTypeOnly);
       }
     } else if (ts.isExportDeclaration(node)) {
       const spec = node.moduleSpecifier && ts.isStringLiteral(node.moduleSpecifier) ? node.moduleSpecifier.text : void 0;
@@ -15497,6 +15970,9 @@ function walkExact(ts, sourceText, fileName) {
         for (const el of node.exportClause.elements) {
           declared.add(el.name.text);
           exported.add(el.name.text);
+          if (spec && !node.isTypeOnly && !el.isTypeOnly) {
+            namedReexports.push({ exported: el.name.text, local: (el.propertyName ?? el.name).text, from: spec });
+          }
         }
       } else if (!node.exportClause && spec) {
         starExports.push(spec);
@@ -15519,7 +15995,7 @@ function walkExact(ts, sourceText, fileName) {
   };
   visit(sf);
   const reexportOnly = sf.statements.length > 0 && sf.statements.every((st) => ts.isExportDeclaration(st) && !!st.moduleSpecifier);
-  return { declared, anchors, exported, imports, reexports, starExports, complexity, calls, mutableBindings, reexportOnly };
+  return { declared, anchors, exported, imports, reexports, starExports, namedReexports, complexity, calls, importBindings, typeOnlyBindings, fieldTypes, mutableBindings, reexportOnly };
 }
 function resolveRelativeModule(fromFile, specifier) {
   if (!specifier.startsWith(".")) return null;
@@ -15542,34 +16018,47 @@ function resolveRelativeModule(fromFile, specifier) {
   }
   return null;
 }
-function chaseStarExports(ts, facts, filePath, projectRoot2, visited, exactCache) {
-  for (const spec of facts.starExports) {
-    const target = resolveRelativeModule(filePath, spec);
-    if (!target || visited.has(target)) continue;
-    if (path13.relative(projectRoot2, target).startsWith("..")) continue;
-    visited.add(target);
-    let targetFacts = exactCache.get(target);
-    if (targetFacts === void 0) {
-      try {
-        targetFacts = walkExact(ts, fs10.readFileSync(target, "utf8"), target);
-      } catch {
-        targetFacts = null;
-      }
-      exactCache.set(target, targetFacts);
+function reexportTarget(ts, filePath, specifier, projectRoot2, visited, exactCache) {
+  const target = resolveRelativeModule(filePath, specifier);
+  if (!target || path13.relative(projectRoot2, target).startsWith("..")) return null;
+  let targetFacts = exactCache.get(target);
+  if (targetFacts === void 0) {
+    try {
+      targetFacts = walkExact(ts, fs10.readFileSync(target, "utf8"), target);
+    } catch {
+      targetFacts = null;
     }
-    if (!targetFacts) continue;
-    chaseStarExports(ts, targetFacts, target, projectRoot2, visited, exactCache);
-    for (const name of targetFacts.exported) {
+    exactCache.set(target, targetFacts);
+  }
+  if (!targetFacts) return null;
+  if (!visited.has(target)) {
+    visited.add(target);
+    chaseReexports(ts, targetFacts, target, projectRoot2, visited, exactCache);
+  }
+  return { path: target, facts: targetFacts };
+}
+function carryBody(facts, target, targetPath, local, exported, projectRoot2) {
+  const score = target.complexity.get(local);
+  if (score !== void 0) facts.complexity.set(exported, Math.max(facts.complexity.get(exported) ?? 0, score));
+  const targetCalls = target.calls.get(local);
+  if (!targetCalls) return;
+  const carriedFrom = pathKey(path13.relative(projectRoot2, targetPath));
+  const sites = facts.calls.get(exported) ?? /* @__PURE__ */ new Map();
+  for (const [key, site] of targetCalls) sites.set(carriedFrom + "|" + key, { ...site, from: site.from ?? carriedFrom });
+  facts.calls.set(exported, sites);
+}
+function chaseReexports(ts, facts, filePath, projectRoot2, visited, exactCache) {
+  for (const re of facts.namedReexports) {
+    const target = reexportTarget(ts, filePath, re.from, projectRoot2, visited, exactCache);
+    if (target) carryBody(facts, target.facts, target.path, re.local, re.exported, projectRoot2);
+  }
+  for (const spec of facts.starExports) {
+    const target = reexportTarget(ts, filePath, spec, projectRoot2, visited, exactCache);
+    if (!target) continue;
+    for (const name of target.facts.exported) {
       facts.exported.add(name);
       facts.declared.add(name);
-      const c = targetFacts.complexity.get(name);
-      if (c !== void 0) facts.complexity.set(name, Math.max(facts.complexity.get(name) ?? 0, c));
-      const targetCalls = targetFacts.calls.get(name);
-      if (targetCalls) {
-        const set = facts.calls.get(name) ?? /* @__PURE__ */ new Set();
-        for (const callee of targetCalls) set.add(callee);
-        facts.calls.set(name, set);
-      }
+      carryBody(facts, target.facts, target.path, name, name, projectRoot2);
     }
   }
 }
@@ -15674,7 +16163,7 @@ function buildCodeModel(implementations, types, projectRoot2, sourceRoots = [],
       if (ts) {
         try {
           const facts = walkExact(ts, text2, absolute);
-          chaseStarExports(ts, facts, absolute, projectRoot2, /* @__PURE__ */ new Set([absolute]), exactCache);
+          chaseReexports(ts, facts, absolute, projectRoot2, /* @__PURE__ */ new Set([absolute]), exactCache);
           analyzed = {
             analysisGrade: "exact",
             declaredNames: [...facts.declared],
@@ -15683,7 +16172,10 @@ function buildCodeModel(implementations, types, projectRoot2, sourceRoots = [],
             imports: [...facts.imports],
             reexports: [...facts.reexports],
             functionComplexity: Object.fromEntries(facts.complexity),
-            functionCalls: Object.fromEntries([...facts.calls].map(([k, v]) => [k, [...v]])),
+            functionCallSites: Object.fromEntries([...facts.calls].map(([k, v]) => [k, [...v.values()]])),
+            importBindings: Object.fromEntries(facts.importBindings),
+            typeOnlyBindings: Object.fromEntries(facts.typeOnlyBindings),
+            fieldTypes: Object.fromEntries([...facts.fieldTypes].map(([k, v]) => [k, [...v]])),
             topLevelMutableBindings: [...facts.mutableBindings],
             reexportOnly: facts.reexportOnly
           };
@@ -16081,18 +16573,46 @@ function buildRuleContext(opts) {
   const allowLookup = /* @__PURE__ */ new Map();
   const collectAllows = (specId, lint) => {
     for (const a of lint?.allow ?? []) {
-      const entry = { specId, code: a.code, reason: a.reason, used: false };
+      const entry = { specId, code: a.code, at: a.at, covers: a.covers, reason: a.reason, used: false };
       lintAllows.push(entry);
       if (!allowLookup.has(specId)) allowLookup.set(specId, /* @__PURE__ */ new Map());
-      allowLookup.get(specId).set(a.code, entry);
+      const forSpec = allowLookup.get(specId);
+      const forCode = forSpec.get(a.code) ?? [];
+      forCode.push(entry);
+      forSpec.set(a.code, forCode);
     }
   };
+  const sitesSeen = /* @__PURE__ */ new Map();
+  const sitesReported = (specId, code) => {
+    const seen = sitesSeen.get(`${specId}\0${code}`);
+    return { sites: [...seen?.sites ?? []], unsited: seen?.unsited ?? false };
+  };
   for (const s of subsystems) collectAllows(s.id, s.lint);
   for (const c of components) collectAllows(c.id, c.lint);
   for (const i of interfaces) collectAllows(i.id, i.lint);
   for (const im of implementations) collectAllows(im.id, im.lint);
   for (const t of types) collectAllows(t.id, t.lint);
-  const addIssue = (defaultSeverity, code, message, specId, isDraftContext, surfaceResolved) => {
+  const carriedFindings = [];
+  const carriedLookup = /* @__PURE__ */ new Map();
+  const carriedKey = (spec, code, at) => `${spec}\0${code}\0${at}`;
+  for (const group of rules?.conformance?.carried ?? []) {
+    for (const f of group.findings ?? []) {
+      const entry = {
+        kind: group.kind,
+        why: group.why,
+        code: f.code,
+        spec: f.spec,
+        at: f.at,
+        covers: f.covers ?? [],
+        fired: false,
+        seen: /* @__PURE__ */ new Set()
+      };
+      carriedFindings.push(entry);
+      const key = carriedKey(f.spec, f.code, f.at);
+      if (!carriedLookup.has(key)) carriedLookup.set(key, entry);
+    }
+  }
+  const addIssue = (defaultSeverity, code, message, specId, isDraftContext, surfaceResolved, parts) => {
     if (scopeSubsystem && specId && !isSpecInScope(specId)) {
       return;
     }
@@ -16103,17 +16623,46 @@ function buildRuleContext(opts) {
     }
     const severity = getRuleSeverity(code, defaultSeverity, isDraftContext, owner);
     if (severity === "off") return;
+    let text2 = message;
+    if (specId) {
+      const key = `${specId}\0${code}`;
+      let seen = sitesSeen.get(key);
+      if (!seen) sitesSeen.set(key, seen = { sites: /* @__PURE__ */ new Set(), unsited: false });
+      if (parts) seen.sites.add(parts.at);
+      else seen.unsited = true;
+    }
+    let allowClaimed = false;
     if (specId) {
-      const allow = allowLookup.get(specId)?.get(code);
+      const allow = (allowLookup.get(specId)?.get(code) ?? []).find((a) => parts ? a.at === parts.at : a.at === void 0);
       if (allow) {
         allow.used = true;
-        if (severity === "warning") return;
+        allowClaimed = true;
+        const grew = (parts?.covers ?? []).filter((unit) => !(allow.covers ?? []).includes(unit));
+        if (grew.length === 0) {
+          if (severity === "warning") return;
+        } else {
+          text2 = `${text2} A lint.allow covers this site, but not ${grew.length} part(s) of it \u2014 ${grew.map((u) => `"${u}"`).join("; ")} ${grew.length === 1 ? "is" : "are"} new. Decide on them: add them to the allow's \`covers\` with a reason that is actually true, or fix them.`;
+        }
+      }
+    }
+    if (specId && parts && severity === "warning" && !allowClaimed) {
+      const entry = carriedLookup.get(carriedKey(specId, code, parts.at));
+      if (entry) {
+        entry.fired = true;
+        const listed = new Set(entry.covers);
+        const grew = [];
+        for (const unit of parts.covers ?? []) {
+          if (listed.has(unit)) entry.seen.add(unit);
+          else grew.push(unit);
+        }
+        if (grew.length === 0) return;
+        text2 = `${text2} The conformance debt register carries this finding, but not ${grew.length} part(s) of it \u2014 ${grew.map((u) => `"${u}"`).join("; ")} ${grew.length === 1 ? "is" : "are"} new. Fix them, or add them to the entry's \`covers\` with a reason that is actually true.`;
       }
     }
     issues.push({
       severity,
       code,
-      message,
+      message: text2,
       specId,
       ...isDraftContext ? { draftContext: true } : {},
       ...surfaceResolved ? { surfaceResolved: true } : {}
@@ -16189,7 +16738,10 @@ function buildRuleContext(opts) {
     codeModel: opts.codeModel ?? emptyCodeModel(),
     roundTripIssues: opts.roundTripIssues,
     lintAllows,
+    sitesReported,
     knownIssueCodes: opts.knownIssueCodes,
+    carriedFindings,
+    carryableIssueCodes: opts.carryableIssueCodes ?? /* @__PURE__ */ new Set(),
     addIssue
   };
   return ctx;
@@ -22740,6 +23292,9 @@ function validateSddTree(rulesOrOptions, projectType = "backend") {
       ...knownIssueCodes().map((rc) => rc.code),
       ...extensions.assertions.map((a) => a.fullCode)
     ]);
+    const carryableCodes = new Set(
+      knownIssueCodes().filter((rc) => rc.carryable).map((rc) => rc.code)
+    );
     const ctx = buildRuleContext({
       system,
       subsystems,
@@ -22759,6 +23314,7 @@ function validateSddTree(rulesOrOptions, projectType = "backend") {
       codeModel,
       roundTripIssues,
       knownIssueCodes: knownCodes,
+      carryableIssueCodes: carryableCodes,
       issues
     });
     for (const rule of sequence) {
@@ -23692,10 +24248,10 @@ function findChainingParent(childRoot, ceiling) {
     if (bound2 && !isWithin(bound2, dir)) break;
     const specsDir = aiPathsAt(dir).specsDir();
     if (pathExists(specsDir)) {
-      for (const file of listFilesRecursive(specsDir, ".yaml")) {
+      for (const file of listSpecFiles(specsDir)) {
         let raw;
         try {
-          raw = readYamlFile(file);
+          raw = readSpecFile(file);
         } catch {
           continue;
         }
@@ -23727,10 +24283,10 @@ function inspectChainedRoots(rootDir = getProjectRoot()) {
   const walk2 = (projectDir, prefix, ancestors, depth) => {
     const specsDir = aiPathsAt(projectDir).specsDir();
     if (!pathExists(specsDir)) return;
-    for (const file of listFilesRecursive(specsDir, ".yaml")) {
+    for (const file of listSpecFiles(specsDir)) {
       let raw;
       try {
-        raw = readYamlFile(file);
+        raw = readSpecFile(file);
       } catch {
         continue;
       }
@@ -23914,7 +24470,7 @@ function computeSpecTreeSignature(dirs) {
       parts.push(`${dir}:missing`);
       continue;
     }
-    for (const f of listFilesRecursive(dir, ".yaml")) {
+    for (const f of listSpecFiles(dir)) {
       try {
         const st = fs17.statSync(f);
         parts.push(`${f}:${st.mtimeMs}:${st.size}`);
@@ -23944,9 +24500,11 @@ function identityKeyOf(field, item) {
       return `${String(o.topic)} ${o.event === void 0 ? "" : String(o.event)}`;
     case "trustedLinks":
       return str(o.subsystem);
+    // lint.allow: an allow is one decision about one OCCURRENCE, so several
+    // may share a code on one spec, each naming its own site. Keyed by code
+    // alone a delta for one site would overwrite its neighbours.
     case "allow":
-      return str(o.code);
-    // lint.allow
+      return `${String(o.code)} ${o.at === void 0 ? "" : String(o.at)}`;
     case "findings":
       return str(o.code);
     // an interface method's findings
@@ -24034,6 +24592,7 @@ function identityFieldsOf(field) {
     case "trustedLinks":
       return ["subsystem"];
     case "allow":
+      return ["code", "at"];
     case "findings":
       return ["code"];
     case "invariants":
@@ -24374,6 +24933,7 @@ var init_specs2 = __esm({
     init_canonical_json();
     init_lockfile();
     init_yaml();
+    init_spec_files();
     init_models();
     init_narrative_labels();
     init_diagram();
@@ -24452,7 +25012,7 @@ var init_specs2 = __esm({
         const specsDir = projectPaths.specsDir();
         this.scanVisitedSpecDirs.push(specsDir);
         if (!pathExists(specsDir)) return index;
-        const files = listFilesRecursive(specsDir, ".yaml");
+        const files = listSpecFiles(specsDir);
         const systemYaml = path23.normalize(projectPaths.specsSystem());
         const localSubprojects = [];
         for (const file of files) {
@@ -24461,7 +25021,7 @@ var init_specs2 = __esm({
           let detectedType = "spec";
           let rawId;
           try {
-            const raw = readYamlFile(file);
+            const raw = readSpecFile(file);
             if (raw === null || typeof raw !== "object") {
               this.loaderIssues.push({
                 severity: "error",
@@ -24944,7 +25504,7 @@ var init_specs2 = __esm({
         const p = this.paths.specsSystem();
         if (!pathExists(p)) return null;
         try {
-          const raw = readYamlFile(p);
+          const raw = readSpecFile(p);
           return SystemSpecSchema.parse(raw);
         } catch (e) {
           this.loaderIssues.push({
@@ -24959,7 +25519,7 @@ var init_specs2 = __esm({
       saveSystemSpec(spec) {
         const p = this.paths.specsSystem();
         ensureDir(path23.dirname(p));
-        writeYamlFile(p, parseOrThrow(SystemSpecSchema, spec, "system", spec.name));
+        writeSpecFile(p, parseOrThrow(SystemSpecSchema, spec, "system", spec.name));
         invalidateSpecCache();
       }
       // -------------------------------------------------------------------------
@@ -24975,7 +25535,7 @@ var init_specs2 = __esm({
         const p = this.getSubsystemPath(id);
         if (!pathExists(p)) return null;
         try {
-          const raw = readYamlFile(p);
+          const raw = readSpecFile(p);
           return SubsystemSpecSchema.parse(raw);
         } catch (e) {
           this.loaderIssues.push({
@@ -25109,7 +25669,7 @@ var init_specs2 = __esm({
           }
         }
         specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-        writeYamlFile(p, parseOrThrow(SubsystemSpecSchema, specToWrite, "subsystem", spec.id));
+        writeSpecFile(p, parseOrThrow(SubsystemSpecSchema, specToWrite, "subsystem", spec.id));
         invalidateSpecCache();
       }
       deleteSubsystemSpec(id) {
@@ -25133,7 +25693,7 @@ var init_specs2 = __esm({
         const p = this.getComponentPath(id);
         if (!pathExists(p)) return null;
         try {
-          const raw = readYamlFile(p);
+          const raw = readSpecFile(p);
           return ComponentSpecSchema.parse(raw);
         } catch (e) {
           this.loaderIssues.push({
@@ -25170,7 +25730,7 @@ var init_specs2 = __esm({
           );
         }
         specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-        writeYamlFile(p, parseOrThrow(ComponentSpecSchema, specToWrite, "component", spec.id));
+        writeSpecFile(p, parseOrThrow(ComponentSpecSchema, specToWrite, "component", spec.id));
         invalidateSpecCache();
         this.normalizeComponentLayout();
         return notices;
@@ -25231,7 +25791,7 @@ var init_specs2 = __esm({
         const p = this.getInterfacePath(id);
         if (!pathExists(p)) return null;
         try {
-          const raw = readYamlFile(p);
+          const raw = readSpecFile(p);
           return InterfaceSpecSchema.parse(raw);
         } catch (e) {
           this.loaderIssues.push({
@@ -25262,7 +25822,7 @@ var init_specs2 = __esm({
         if (!pathExists(p)) return;
         let occupantId;
         try {
-          occupantId = readYamlFile(p)?.id;
+          occupantId = readSpecFile(p)?.id;
         } catch {
           return;
         }
@@ -25299,7 +25859,7 @@ var init_specs2 = __esm({
           }
         }
         specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-        writeYamlFile(p, parseOrThrow(InterfaceSpecSchema, specToWrite, "interface", spec.id));
+        writeSpecFile(p, parseOrThrow(InterfaceSpecSchema, specToWrite, "interface", spec.id));
         invalidateSpecCache();
         return notices;
       }
@@ -25324,7 +25884,7 @@ var init_specs2 = __esm({
         const p = this.getImplementationPath(id);
         if (!pathExists(p)) return null;
         try {
-          const raw = readYamlFile(p);
+          const raw = readSpecFile(p);
           return ImplementationSpecSchema.parse(raw);
         } catch (e) {
           this.loaderIssues.push({
@@ -25356,7 +25916,7 @@ var init_specs2 = __esm({
           }
         }
         specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-        writeYamlFile(p, parseOrThrow(ImplementationSpecSchema, specToWrite, "implementation", spec.id));
+        writeSpecFile(p, parseOrThrow(ImplementationSpecSchema, specToWrite, "implementation", spec.id));
         invalidateSpecCache();
         return notices;
       }
@@ -25409,7 +25969,7 @@ var init_specs2 = __esm({
           }
         }
         specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-        writeYamlFile(p, parseOrThrow(TypeSpecSchema, specToWrite, "type", spec.id));
+        writeSpecFile(p, parseOrThrow(TypeSpecSchema, specToWrite, "type", spec.id));
         invalidateSpecCache();
         return notices;
       }
@@ -25440,7 +26000,7 @@ var init_specs2 = __esm({
           specToWrite.createdAt = existing.createdAt;
         }
         specToWrite.updatedAt = opts?.preserveUpdatedAt && existing?.updatedAt ? existing.updatedAt : (/* @__PURE__ */ new Date()).toISOString();
-        writeYamlFile(p, parseOrThrow(GroupSpecSchema, specToWrite, "group", spec.id));
+        writeSpecFile(p, parseOrThrow(GroupSpecSchema, specToWrite, "group", spec.id));
         invalidateSpecCache();
       }
       deleteGroupSpec(id) {
@@ -25604,7 +26164,7 @@ var init_specs2 = __esm({
       findLegacySpecFiles() {
         const specsDir = this.paths.specsDir();
         if (!pathExists(specsDir)) return [];
-        const files = listFilesRecursive(specsDir, ".yaml");
+        const files = listSpecFiles(specsDir);
         const legacy = [];
         for (const f of files) {
           const base = path23.basename(f);
@@ -28507,7 +29067,7 @@ function createMcpServer(options = {}) {
       inputSchema: {
         kind: import_zod11.z.enum(["system", "subsystem", "component", "interface", "implementation", "type"]).describe("The spec kind to update (system = the singleton L0 \u2014 vision, boundaries, globalRequirements, databases, and publicInterfaces: the project gateway surface, each entry {id, name, subsystem, component, type, details, audience: project|department|instance|partner|external}; id is informational)"),
         id: import_zod11.z.string().describe("The ID of the spec to update (namespaced if needed)"),
-        delta: import_zod11.z.record(import_zod11.z.any()).describe(`The partial fields to merge into the spec. ARRAYS UPSERT, they do not replace: an array whose elements carry an identity is merged element-by-element, so a delta naming ONE element leaves the others intact. Identity is "name" or "id" by default, and per field: dispatch by "capability", lifecycle by phase+component+method, emits/subscribesTo by topic+event, trustedLinks by "subsystem", invariants and patterns by "id", lint.allow by "code", an interface method's findings by "code", boundaries by "name", globalRequirements by "description", switch cases by "value", try catches by "error". Identity merging applies at EVERY depth, including an array INSIDE an element (a method's params, a step's catches). Add "action: 'delete'" (or "remove: true") alongside that identity to REMOVE an element \u2014 including a stale lint allow. Arrays of plain STRINGS (owns, dependsOn, guarantees) carry no per-element identity and are replaced wholesale; pass [] to clear any array outright. To REMOVE an optional field entirely, list it in "unset": e.g. {"unset": ["basePath", "variant"]} \u2014 passing null/undefined means "no change" (they are skipped), and writing "" would leave the field present but empty, which is a different and usually wrong spec. Unsetting a required field is refused by schema validation, which names it. For narrative steps, match by "stepNumber" and use "action: 'insert'" (shifts subsequent steps up) or "action: 'delete'" (shifts subsequent steps down and removes it). Step entries apply in ASCENDING stepNumber order, each against the numbering the earlier entries of the SAME delta left behind \u2014 delete step 3 and step 7 becomes step 6 \u2014 so prefer labels, and restate the step's "label" or "description" on a delete to have it checked against the step actually addressed. Renumbering RELOCATES every flow jump field (onTrueStep/onFalseStep/cases.step/defaultStep/endStep/catches.step/finallyStep/toStep) in the same narrative. A delete is REJECTED when the narrative has no such step, when a jump still targets it (retarget the referrers first), when a restated label/description does not match, or when it is a loop/try/parallel header whose body would be left standing (retype the header first to dissolve the region, then delete it). Changing a step's "type" REBUILDS it for the new type: its description and label are kept and every field the new type cannot carry is dropped (returned as a NOTICE); a delta that retypes AND sets such a field is refused. A step delta is also refused when it carries a marker the merge does not recognise: a non-boolean "remove", an "action" that is neither "insert" nor "delete", a "captureJumps" outside an insert, or no "stepNumber" to address. Inserting AT a jump target relocates those jumps past the inserted step by default (a NOTICE is returned) \u2014 add "captureJumps": true on the inserted step to retarget entry jumps onto it (loop/try endStep region tails always relocate with the body and are never captured). Every jump field has a "*Label" twin (toLabel, onFalseLabel, endLabel, \u2026, and "label" on a cases/catches entry) resolved against step labels AFTER the merge, so a delta may anchor on a label only pre-existing steps carry; a label the delta supplies REPLACES the stored number it twins, while setting the number and its label together in one delta is refused as a contradiction. Reference ids in deltas may use LOCAL names \u2014 they are qualified against the spec's namespace exactly as the loader would. Per-spec lint suppression: set "lint: { allow: [{ code, reason }] }" to silence a WARNING code on this spec only (errors always surface; stale allows are flagged). This delta is deliberately OPEN below its top level \u2014 the shapes nest further than a schema here should restate \u2014 so a key that is not a field at its depth is not refused, it is NAMED BACK under NO EFFECT in the answer, together with any value the spec already held and any "unset" that removed nothing. Read that list: it is where a nested typo shows up.`),
+        delta: import_zod11.z.record(import_zod11.z.any()).describe(`The partial fields to merge into the spec. ARRAYS UPSERT, they do not replace: an array whose elements carry an identity is merged element-by-element, so a delta naming ONE element leaves the others intact. Identity is "name" or "id" by default, and per field: dispatch by "capability", lifecycle by phase+component+method, emits/subscribesTo by topic+event, trustedLinks by "subsystem", invariants and patterns by "id", lint.allow by "code" AND "at" (an allow covers one occurrence, so several may share a code on one spec), an interface method's findings by "code", boundaries by "name", globalRequirements by "description", switch cases by "value", try catches by "error". Identity merging applies at EVERY depth, including an array INSIDE an element (a method's params, a step's catches). Add "action: 'delete'" (or "remove: true") alongside that identity to REMOVE an element \u2014 including a stale lint allow. Arrays of plain STRINGS (owns, dependsOn, guarantees) carry no per-element identity and are replaced wholesale; pass [] to clear any array outright. To REMOVE an optional field entirely, list it in "unset": e.g. {"unset": ["basePath", "variant"]} \u2014 passing null/undefined means "no change" (they are skipped), and writing "" would leave the field present but empty, which is a different and usually wrong spec. Unsetting a required field is refused by schema validation, which names it. For narrative steps, match by "stepNumber" and use "action: 'insert'" (shifts subsequent steps up) or "action: 'delete'" (shifts subsequent steps down and removes it). Step entries apply in ASCENDING stepNumber order, each against the numbering the earlier entries of the SAME delta left behind \u2014 delete step 3 and step 7 becomes step 6 \u2014 so prefer labels, and restate the step's "label" or "description" on a delete to have it checked against the step actually addressed. Renumbering RELOCATES every flow jump field (onTrueStep/onFalseStep/cases.step/defaultStep/endStep/catches.step/finallyStep/toStep) in the same narrative. A delete is REJECTED when the narrative has no such step, when a jump still targets it (retarget the referrers first), when a restated label/description does not match, or when it is a loop/try/parallel header whose body would be left standing (retype the header first to dissolve the region, then delete it). Changing a step's "type" REBUILDS it for the new type: its description and label are kept and every field the new type cannot carry is dropped (returned as a NOTICE); a delta that retypes AND sets such a field is refused. A step delta is also refused when it carries a marker the merge does not recognise: a non-boolean "remove", an "action" that is neither "insert" nor "delete", a "captureJumps" outside an insert, or no "stepNumber" to address. Inserting AT a jump target relocates those jumps past the inserted step by default (a NOTICE is returned) \u2014 add "captureJumps": true on the inserted step to retarget entry jumps onto it (loop/try endStep region tails always relocate with the body and are never captured). Every jump field has a "*Label" twin (toLabel, onFalseLabel, endLabel, \u2026, and "label" on a cases/catches entry) resolved against step labels AFTER the merge, so a delta may anchor on a label only pre-existing steps carry; a label the delta supplies REPLACES the stored number it twins, while setting the number and its label together in one delta is refused as a contradiction. Reference ids in deltas may use LOCAL names \u2014 they are qualified against the spec's namespace exactly as the loader would. Per-spec lint suppression: set "lint: { allow: [{ code, at, covers, reason }] }" to silence a WARNING code on this spec only (errors always surface; stale allows are flagged). An allow covers EXACTLY the occurrence it names: "at" is the site the finding names (a contract method, an import edge "from -> to", a declared edge "component -> target") and is REQUIRED for a code whose findings report one, while a finding that reports no site is covered only by an allow that names none; "covers" lists the units an aggregating finding reports, and the allow silences it only when every one is listed. This delta is deliberately OPEN below its top level \u2014 the shapes nest further than a schema here should restate \u2014 so a key that is not a field at its depth is not refused, it is NAMED BACK under NO EFFECT in the answer, together with any value the spec already held and any "unset" that removed nothing. Read that list: it is where a nested typo shows up.`),
         dryRun: import_zod11.z.boolean().optional().describe("Ask what this delta WOULD do instead of doing it. The whole write runs, the candidate gate included, and the answer is the change report it would have produced \u2014 marked DRY RUN, with nothing stamped and not one byte of the stored file moved. Use it before a delta that renumbers a long narrative.")
       },
       outputSchema: specChangeReportOutput
@@ -30551,6 +31111,20 @@ init_loader();
 init_errors();
 init_core();
 init_validation();
+function carriedDebtSummary(carried) {
+  if (!carried || carried.length === 0) return null;
+  const findings = carried.flatMap((g) => g.findings ?? []);
+  const units = findings.reduce((n, f) => n + (f.covers?.length ?? 1), 0);
+  const perKind = (kind) => carried.filter((g) => g.kind === kind).reduce((n, g) => n + (g.findings?.length ?? 0), 0);
+  const provisional = carried.filter((g) => g.revisit);
+  const unsettled = provisional.reduce((n, g) => n + (g.findings?.length ?? 0), 0);
+  return {
+    line: `Conformance debt register: ${findings.length} finding(s) over ${units} unit(s) carried \u2014 ${perKind("drift")} drift, ${perKind("undecided")} undecided, ${perKind("unreadable")} unreadable (\`rules.conformance.carried\`). Drift and undecided are owed; unreadable is what the analysis cannot follow.` + (unsettled > 0 ? ` ${unsettled} finding(s) in ${provisional.length} group(s) are marked for re-evaluation \u2014 the classification is provisional, not the debt.` : ""),
+    revisits: provisional.map(
+      (g) => `  re-evaluate (${g.kind}, ${g.findings?.length ?? 0} finding(s)): ${g.revisit}`
+    )
+  };
+}
 function isCiDraftWaivable(issue2) {
   if (issue2.severity !== "warning") return false;
   if (issue2.code === "DRAFT_SUBSYSTEM_WARNING") return true;
@@ -30666,6 +31240,12 @@ async function runValidate(options = {}) {
       }
     }
   }
+  const summary = carriedDebtSummary(projectConfig.rules?.conformance?.carried);
+  if (summary) {
+    logger.blank();
+    logger.info(import_chalk7.default.yellow(summary.line));
+    for (const note of summary.revisits) logger.info(import_chalk7.default.gray(note));
+  }
   logger.blank();
   if (options.ci && waivedWarnings > 0) {
     logger.info(import_chalk7.default.gray(`${waivedWarnings} draft-related warning(s) (non-fatal in --ci): excluded from the failure decision because the referenced specs are in draft/design status.`));