@wairon/cli 5.1.1-dev.42 → 5.1.1-dev.44

package/dist/index.js

@@ -556,6 +556,31 @@ var init_project = __esm({
       kind: CarriedDebtKindSchema,
       /** The reason itself, in the author's own words — what is true here, and what paying it would take. */
       why: import_zod3.z.string().min(1),
+      /**
+       * This classification is PROVISIONAL, and this is what would settle it.
+       *
+       * A confident-sounding `why` that is wrong is worse than a missing one: it
+       * reads as settled, so nobody looks again, and the register keeps counting
+       * the finding under a kind that was never true. Nothing can check a reason
+       * for truth — `kind` and `why` are prose, and STALE_CARRIED_FINDING only
+       * ever catches "this stopped applying", never "this still applies for a
+       * reason that has become false". What a register CAN do is let an author say
+       * out loud that they are not sure yet, and then keep saying it: every run
+       * counts the groups marked here beside the kind totals, so the uncertainty
+       * is as loud as the debt.
+       *
+       * It is deliberately a SENTENCE and not a flag, and deliberately on the
+       * reason GROUP rather than the finding: what is provisional is the reason,
+       * and a reader deciding whether to pick this up needs to know what to
+       * measure — "is the adapter really realized by the file that consumes it, or
+       * is that a modelling error?" — not merely that somebody once hesitated. A
+       * finding whose own classification is uncertain while its neighbours' is not
+       * is a different reason, and belongs in its own group.
+       *
+       * There is no counterpart on `lint.allow`, and that is a decision, not an
+       * omission: see the note on ConformanceRuleConfig.carried.
+       */
+      revisit: import_zod3.z.string().min(1).optional(),
       /** The findings this reason explains. */
       findings: import_zod3.z.array(CarriedFindingSchema)
     });
@@ -601,6 +626,17 @@ var init_project = __esm({
        *   • every entry states its kind and its reason, and `wairon validate`
        *     prints the running total, so the debt is loud where a suppression is
        *     silent.
+       *
+       * A reason group may also declare itself PROVISIONAL (`revisit`), and the
+       * total says how many did. There is no such marker on a `lint.allow`, and
+       * the asymmetry is the point: an entry here does not silence anything — the
+       * finding is counted out loud on every run — so marking one uncertain adds a
+       * second dial to something already visible. An allow DOES silence, and a
+       * "provisional allow" would buy the silence and defer the decision, which is
+       * the one combination that cannot be reviewed: the finding is gone and the
+       * doubt is in a field nobody opens. The mechanism for a decision nobody has
+       * taken is to not take it — leave the warning firing — or, where the code is
+       * carryable, an entry of kind `undecided`, which is exactly that sentence.
        */
       carried: import_zod3.z.array(CarriedDebtSchema).optional()
     });
@@ -1186,7 +1222,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.42";
+    WAIRON_VERSION = "5.1.1-dev.44";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     ARCHITECT_AGENT_ID = "agent-architect";
     ARCHITECT_TEMPLATE_ID = "architect";
@@ -1538,6 +1574,11 @@ function passesIntentFloor(text, methodName) {
   if (norm(t) === norm(methodName)) return false;
   return true;
 }
+function parseDeclaredCall(ref) {
+  const at = ref.lastIndexOf(".");
+  if (at <= 0 || at === ref.length - 1) return null;
+  return { compId: ref.slice(0, at), methodName: ref.slice(at + 1) };
+}
 function methodSourceFile(method, implementationSourcePath) {
   return method.sourcePath || implementationSourcePath || void 0;
 }
@@ -1698,8 +1739,28 @@ var init_specs = __esm({
     LintAllowSchema = import_zod8.z.object({
       /** The issue code being allowed (see `wairon rules list`). */
       code: import_zod8.z.string(),
+      /**
+       * The SITE inside this spec the allow covers, named exactly as the finding
+       * names it (a contract method, an import edge "from -> to", a declared edge
+       * "component -> target"). A finding that names a site is covered ONLY by an
+       * allow naming that same site; a finding that names none is covered only by
+       * an allow that names none either.
+       */
+      at: import_zod8.z.string().min(1).optional(),
+      /**
+       * The units of an AGGREGATING finding this allow covers — the steps of one
+       * CALL_STEP_UNREALIZED, the crossings of one UNDECLARED_COLOCATED_CALL —
+       * each named the way the finding's own message names it. The allow silences
+       * the finding only when it lists EVERY unit reported, so a unit nobody
+       * decided on surfaces on the day it appears instead of inheriting a decision
+       * taken about its neighbours. Meaningless without `at`, and refused there.
+       */
+      covers: import_zod8.z.array(import_zod8.z.string()).optional(),
       /** Why this finding is acceptable here (e.g. "dispatcher — fan-out is the point"). */
       reason: import_zod8.z.string().min(1)
+    }).refine((a) => !a.covers?.length || !!a.at, {
+      message: "`covers` names the units of ONE finding, so it needs the `at` that says which finding \u2014 add the site, or drop covers.",
+      path: ["covers"]
     });
     LintConfigSchema = import_zod8.z.object({
       allow: import_zod8.z.array(LintAllowSchema).default([])
@@ -2148,6 +2209,31 @@ var init_specs = __esm({
       intent: import_zod8.z.string().optional(),
       /** Conformance tier for THIS method (overrides the spec-level default). */
       conformance: ConformanceTierSchema.optional(),
+      /**
+       * The calls this method makes, when its narrative does not show them.
+       *
+       * The mirror of the contract's `invokedBy`: that declares the caller
+       * OUTSIDE the modeled graph, this declares the callees INSIDE it. It lives
+       * here and not on the L3 method because what a method CALLS is a property
+       * of the realization — the detail dial that hides the steps is here, and two
+       * implementations of one contract may reach different collaborators —
+       * whereas an external caller is a fact about the contract's role that must
+       * hold for every realization.
+       *
+       * Each entry names one target the way the debt register and a lint allow
+       * name a unit: `<component>.<method>` (a `covers` entry is the same
+       * spelling with the step number a declaration has no equivalent of). A
+       * third vocabulary for "which method" would be the worse outcome.
+       *
+       * The narrative graph walk takes exactly these edges for a method with no
+       * narrative, and NOTHING else: an undeclared collaborator is not reached,
+       * so a lower detail dial no longer vouches for everything the component
+       * declares. Each entry gets the same target validation a `call` step gets
+       * (the component resolves, the caller declares it, the method is on its
+       * contract). Refused beside a non-empty narrative, where the steps already
+       * say what is called and a second spelling could only disagree.
+       */
+      calls: import_zod8.z.array(import_zod8.z.string().min(1)).optional(),
       /**
        * The code-level name realizing this contract method in the sourcePath
        * file, when it legitimately differs from the intent-language contract
@@ -2184,7 +2270,16 @@ var init_specs = __esm({
        * stereotypes should bind tech directly (TECH_ON_LOGIC_COMPONENT).
        */
       technologies: import_zod8.z.array(import_zod8.z.string()).optional(),
-      methods: import_zod8.z.array(MethodImplementationSchema).default([]),
+      methods: import_zod8.z.array(MethodImplementationSchema).default([]).superRefine((methods, ctx) => {
+        methods.forEach((m, i) => {
+          if (!m.calls?.length || m.narrative.length === 0) return;
+          ctx.addIssue({
+            code: import_zod8.z.ZodIssueCode.custom,
+            path: [i, "calls"],
+            message: `Method "${m.name}" declares calls AND a narrative \u2014 \`calls\` says what a method calls when its narrative does not show it, and this one has ${m.narrative.length} step(s) that already do. Add the call step, or drop the declaration.`
+          });
+        });
+      }),
       /** Spec-level narrative detail default for all methods (each may override). */
       detail: NarrativeDetailSchema.optional(),
       /** Spec-level conformance tier default (each method may override). */
@@ -9640,10 +9735,10 @@ var init_lint_allows = __esm({
     "use strict";
     lintAllowsRule = {
       name: "lint-allows",
-      description: "Per-spec lint suppressions (lint.allow) must name real issue codes and actually suppress a finding \u2014 unknown codes and stale allows are flagged. Allows silence warnings only; errors always surface.",
+      description: "Per-spec lint suppressions (lint.allow) must name real issue codes and actually suppress a finding \u2014 unknown codes and stale allows are flagged. An allow covers exactly the occurrence it names: a finding that reports a site is silenced only by an allow whose `at` is that site, a finding that reports none only by an allow that names none, and an aggregating finding only by an allow whose `covers` lists every unit it reports \u2014 a unit nobody listed is named back as new instead of inheriting a decision taken about its neighbours. So a coarse allow left on a rule that names sites, and an allow whose site the run no longer reports, are both UNUSED_LINT_ALLOW, and the finding names the sites that did fire. Allows silence warnings only; errors always surface.",
       codes: [
         { code: "UNKNOWN_LINT_ALLOW_CODE", defaultSeverity: "warning", summary: "lint.allow names an issue code no registered rule emits" },
-        { code: "UNUSED_LINT_ALLOW", defaultSeverity: "warning", summary: "lint.allow entry matched no finding this run \u2014 remove the stale allow" }
+        { code: "UNUSED_LINT_ALLOW", defaultSeverity: "warning", summary: "lint.allow entry matched no finding this run \u2014 the code never fired, or it fired at sites this allow does not name" }
       ],
       check(ctx) {
         for (const a of ctx.lintAllows) {
@@ -9656,14 +9751,24 @@ var init_lint_allows = __esm({
             );
             continue;
           }
-          if (!a.used) {
-            ctx.addIssue(
-              "warning",
-              "UNUSED_LINT_ALLOW",
-              `Spec "${a.specId}" allows "${a.code}" (reason: ${a.reason}) but no such finding fired this run \u2014 remove the stale allow.`,
-              a.specId
-            );
+          if (a.used) continue;
+          const reported = ctx.sitesReported(a.specId, a.code);
+          const at = a.at ? ` at "${a.at}"` : "";
+          let why;
+          if (a.at && reported.unsited && reported.sites.length === 0) {
+            why = `findings of "${a.code}" on this spec name no site at all, so this allow must not name one \u2014 drop the \`at\``;
+          } else if (reported.sites.length > 0) {
+            const sites = reported.sites.map((s) => `"${s}"`).join("; ");
+            why = a.at ? `that code fired at ${sites} instead \u2014 retarget the allow, or remove it` : `that code fired at ${sites}, and a sited finding is covered only by an allow naming its site \u2014 give this allow an \`at\` (one per site, each with its own reason), or remove it`;
+          } else {
+            why = "no such finding fired this run \u2014 remove the stale allow";
           }
+          ctx.addIssue(
+            "warning",
+            "UNUSED_LINT_ALLOW",
+            `Spec "${a.specId}" allows "${a.code}"${at} (reason: ${a.reason}), but ${why}.`,
+            a.specId
+          );
         }
       }
     };
@@ -9718,16 +9823,36 @@ var init_contract_symmetry = __esm({
 });
 
 // src/core/rules/narrative/narrative-target-references.ts
-var narrativeTargetReferencesRule;
+var targetsOf, narrativeTargetReferencesRule;
 var init_narrative_target_references = __esm({
   "src/core/rules/narrative/narrative-target-references.ts"() {
     "use strict";
+    init_models();
+    targetsOf = (implMethod) => {
+      const entries = [];
+      for (const step of implMethod.narrative) {
+        if (step.type !== "call" && step.type !== "dispatch" && step.type !== "register") continue;
+        entries.push({
+          kind: step.type,
+          stepNumber: step.stepNumber,
+          targetComponent: step.targetComponent,
+          targetMethod: step.targetMethod,
+          assertsGuarantees: step.assertsGuarantees
+        });
+      }
+      for (const ref of implMethod.calls ?? []) {
+        const parsed = parseDeclaredCall(ref);
+        entries.push(parsed ? { kind: "declared", targetComponent: parsed.compId, targetMethod: parsed.methodName } : { kind: "declared", unparsed: ref });
+      }
+      return entries;
+    };
     narrativeTargetReferencesRule = {
       name: "narrative-target-references",
-      description: "A narrative call, dispatch or register step must name a target component, and a target method unless it dispatches. A target this tree contains must be a collaborator the calling component declares, must carry the named method on one of its interfaces, and that method must declare every semantic guarantee the step asserts.",
+      description: `A narrative call, dispatch or register step must name a target component, and a target method unless it dispatches; a method's declared calls name the same pair as one "<component>.<method>" reference, the spelling the conformance debt register and a lint allow name a unit with. A target this tree contains must be a collaborator the calling component declares, must carry the named method on one of its interfaces, and that method must declare every semantic guarantee the entry asserts.`,
       codes: [
         { code: "MISSING_TARGET_COMPONENT", defaultSeverity: "error", summary: "Call/register step missing targetComponent" },
         { code: "MISSING_TARGET_METHOD", defaultSeverity: "error", summary: "Call/register step missing targetMethod" },
+        { code: "MALFORMED_DECLARED_CALL", defaultSeverity: "error", summary: 'Declared call that is not a "<component>.<method>" reference' },
         { code: "UNDECLARED_DEPENDENCY_CALL", defaultSeverity: "error", summary: "Call step targets a component the caller does not depend on or own" },
         { code: "INVALID_TARGET_METHOD_REFERENCE", defaultSeverity: "error", summary: "Call step targets a method not on any target interface" },
         { code: "NARRATIVE_SEMANTIC_UNBACKED", defaultSeverity: "warning", summary: "Narrative asserts a guarantee the called contract does not declare" }
@@ -9739,25 +9864,35 @@ var init_narrative_target_references = __esm({
           const isDraftCtx = ctx.isImplementationDraft(impl);
           const caller = ctx.componentMap.get(contract.component);
           for (const implMethod of impl.methods) {
-            for (const step of implMethod.narrative) {
-              if (step.type !== "call" && step.type !== "dispatch" && step.type !== "register") continue;
-              if (!step.targetComponent) {
+            for (const entry of targetsOf(implMethod)) {
+              const where = entry.stepNumber === void 0 ? "" : ` (step ${entry.stepNumber})`;
+              if (entry.unparsed !== void 0) {
+                ctx.addIssue(
+                  "error",
+                  "MALFORMED_DECLARED_CALL",
+                  `Method "${implMethod.name}" in implementation "${impl.id}" declares the call "${entry.unparsed}", which is not a "<component>.<method>" reference \u2014 the spelling the conformance debt register and a lint allow name a unit with.`,
+                  impl.id,
+                  isDraftCtx
+                );
+                continue;
+              }
+              if (!entry.targetComponent) {
                 ctx.addIssue(
                   "error",
                   "MISSING_TARGET_COMPONENT",
-                  `Method "${implMethod.name}" in implementation "${impl.id}" has a ${step.type} step (${step.stepNumber}) missing "targetComponent".`,
+                  `Method "${implMethod.name}" in implementation "${impl.id}" has a ${entry.kind} step (${entry.stepNumber}) missing "targetComponent".`,
                   impl.id,
                   isDraftCtx
                 );
                 continue;
               }
-              const target = step.targetComponent;
-              const verb = step.type === "dispatch" ? "dispatches through" : step.type === "register" ? "registers callback" : "calls";
-              if (step.type !== "dispatch" && !step.targetMethod) {
+              const target = entry.targetComponent;
+              const verb = entry.kind === "dispatch" ? "dispatches through" : entry.kind === "register" ? "registers callback" : entry.kind === "declared" ? "declares a call to" : "calls";
+              if (entry.kind !== "dispatch" && !entry.targetMethod) {
                 ctx.addIssue(
                   "error",
                   "MISSING_TARGET_METHOD",
-                  `Method "${implMethod.name}" in implementation "${impl.id}" has a ${step.type} step (${step.stepNumber}) missing "targetMethod".`,
+                  `Method "${implMethod.name}" in implementation "${impl.id}" has a ${entry.kind} step (${entry.stepNumber}) missing "targetMethod".`,
                   impl.id,
                   isDraftCtx
                 );
@@ -9768,16 +9903,16 @@ var init_narrative_target_references = __esm({
                 ctx.addIssue(
                   "error",
                   "UNDECLARED_DEPENDENCY_CALL",
-                  `Method "${implMethod.name}" in implementation "${impl.id}" (component "${caller.id}") ${verb} component "${target}" (step ${step.stepNumber}) but component "${caller.id}" does not list "${target}" as a dependency.`,
+                  `Method "${implMethod.name}" in implementation "${impl.id}" (component "${caller.id}") ${verb} component "${target}"${where} but component "${caller.id}" does not list "${target}" as a dependency.`,
                   impl.id,
                   isDraftCtx || ctx.isComponentDraft(caller.id)
                 );
               }
-              if (step.type === "dispatch") continue;
+              if (entry.kind === "dispatch") continue;
               const targetInterfaces = ctx.interfacesByComponent.get(target) ?? [];
               let targetMethodSpec;
               for (const targetIntf of targetInterfaces) {
-                const found = targetIntf.methods.find((m) => m.name === step.targetMethod);
+                const found = targetIntf.methods.find((m) => m.name === entry.targetMethod);
                 if (found) {
                   targetMethodSpec = found;
                   break;
@@ -9787,19 +9922,19 @@ var init_narrative_target_references = __esm({
                 ctx.addIssue(
                   "error",
                   "INVALID_TARGET_METHOD_REFERENCE",
-                  `Method "${implMethod.name}" in implementation "${impl.id}" ${verb} method "${step.targetMethod}" on component "${target}" which is not defined on any of its interfaces (step ${step.stepNumber}).`,
+                  `Method "${implMethod.name}" in implementation "${impl.id}" ${verb} method "${entry.targetMethod}" on component "${target}" which is not defined on any of its interfaces${where}.`,
                   impl.id,
                   isDraftCtx || ctx.isComponentDraft(target)
                 );
                 continue;
               }
               const declared = new Set(targetMethodSpec.guarantees ?? []);
-              for (const g of step.assertsGuarantees ?? []) {
+              for (const g of entry.assertsGuarantees ?? []) {
                 if (!declared.has(g)) {
                   ctx.addIssue(
                     "warning",
                     "NARRATIVE_SEMANTIC_UNBACKED",
-                    `Step ${step.stepNumber} of "${implMethod.name}" in implementation "${impl.id}" explicitly asserts guarantee "${g}", but the method it calls \u2014 "${step.targetMethod}" on "${target}" \u2014 does not list "${g}" among its L3 contract guarantees. Declare it on that method (and ensure its shape can deliver it), or revise the narrative.`,
+                    `Step ${entry.stepNumber} of "${implMethod.name}" in implementation "${impl.id}" explicitly asserts guarantee "${g}", but the method it calls \u2014 "${entry.targetMethod}" on "${target}" \u2014 does not list "${g}" among its L3 contract guarantees. Declare it on that method (and ensure its shape can deliver it), or revise the narrative.`,
                     impl.id,
                     isDraftCtx || ctx.isComponentDraft(target)
                   );
@@ -12490,15 +12625,11 @@ function walk(ctx, seeds, options = {}) {
         if (edge.methodName) enqueueMethod(edge.compId, edge.methodName);
       }
     }
-    if (methodImpl.narrative.length === 0) {
-      const comp = ctx.componentMap.get(compId);
-      if (comp && effectiveDetail(methodImpl, impl, comp).level !== "full") {
-        for (const depId of [...comp.dependsOn, ...comp.owns]) {
-          if (!ctx.componentMap.has(depId)) continue;
-          reachComponent(depId);
-          enqueueAllMethods(depId);
-        }
-      }
+    for (const ref of methodImpl.calls ?? []) {
+      const parsed = parseDeclaredCall(ref);
+      if (!parsed || !ctx.componentMap.has(parsed.compId)) continue;
+      reachComponent(parsed.compId);
+      enqueueMethod(parsed.compId, parsed.methodName);
     }
   }
   return {
@@ -12563,7 +12694,9 @@ var init_unused_detection = __esm({
                 "INVOKED_BY_REDUNDANT",
                 `Method "${m.name}" on component "${intf.component}" declares invokedBy (${m.invokedBy.kind}), but the internal narrative walk already reaches it \u2014 the declaration is stale; remove it.`,
                 intf.id,
-                isDraftCtx
+                isDraftCtx,
+                void 0,
+                { at: m.name }
               );
             }
           }
@@ -12591,7 +12724,11 @@ var init_unused_detection = __esm({
                   "UNUSED_METHOD",
                   `Method "${m.name}" on component "${comp.id}" is defined but never called by any narrative step.`,
                   intf.id,
-                  isDraftCtx
+                  isDraftCtx,
+                  void 0,
+                  // The site is the method, so an allow covers exactly the one it
+                  // names - never its neighbours on the same interface.
+                  { at: m.name }
                 );
               }
             }
@@ -13682,7 +13819,13 @@ var init_dependency_conformance = __esm({
               "UNDECLARED_DEPENDENCY",
               `"${fromPath}" (realizing ${fromComponents.map((c) => c.id).join(", ")}) imports "${toPath}" (realizing ${toComponents.map((c) => c.id).join(", ")}) but no declared dependsOn/owns edge justifies it \u2014 declare the collaboration on the component that actually uses it, or route the cross-subsystem hop through the target's published surface.`,
               realization.implementationsAt(fromPath)[0]?.id,
-              draftAt(fromPath) || draftAt(toPath)
+              draftAt(fromPath) || draftAt(toPath),
+              void 0,
+              // One import edge, one indivisible fact — but one implementation
+              // maps many files and many edges, so the EDGE is the site, not the
+              // spec. Without it a single allow on the spec covers every crossing
+              // that file ever grows.
+              { at: `${fromPath} -> ${toPath}` }
             );
           }
         }
@@ -13709,7 +13852,12 @@ var init_dependency_conformance = __esm({
               "UNREALIZED_DEPENDENCY",
               `Component "${component.id}" declares ${relation} "${targetId}", but no runtime import connects their source files (${fromFiles.join(", ")} \u219B ${crossSubsystem ? `subsystem ${target.subsystem}` : filesOf(targetId).join(", ")}) \u2014 either the collaboration is wired indirectly (DI) or the declared edge is stale.`,
               impls[0]?.id ?? component.id,
-              draft
+              draft,
+              void 0,
+              // One declared edge, one indivisible fact. A component declares many,
+              // and they all anchor on its one implementation spec, so the EDGE is
+              // the site.
+              { at: `${component.id} -> ${targetId}` }
             );
           }
         }
@@ -14068,7 +14216,7 @@ var init_carried_debt = __esm({
     "use strict";
     carriedDebtRule = {
       name: "carried-debt",
-      description: "The conformance debt register (`rules.conformance.carried`) holds the code\u2194spec findings this tree carries as declared, classified debt \u2014 `unclaimed`'s one-way shape, for findings about code a spec does name. It is not a second lint.allow: an allow says a finding is wrong here by design, an entry here says the finding is right and unpaid, and each entry states which of the three kinds it is (drift: spec and code disagree; undecided: the fix waits on a modelling decision nobody has taken; unreadable: the analysis cannot follow the shape the code is written in) and why. Only a code a rule declares CARRYABLE may appear, and naming any other is an error, so the register can never widen into general-purpose suppression. An entry carries a finding only when it lists EVERY unit that finding reports, so an aggregating finding cannot grow behind it; an entry that matched nothing, that duplicates another, that names a spec the tree does not hold, or that lists a unit no longer reported is STALE_CARRIED_FINDING, so the register only shrinks. The audit is silent in a run that could not have fired the findings at all: one that built no code model, the specs outside a scoped run, and a code the project switched off.",
+      description: "The conformance debt register (`rules.conformance.carried`) holds the code\u2194spec findings this tree carries as declared, classified debt \u2014 `unclaimed`'s one-way shape, for findings about code a spec does name. It is not a second lint.allow: an allow says a finding is wrong here by design, an entry here says the finding is right and unpaid, and each entry states which of the three kinds it is (drift: spec and code disagree; undecided: the fix waits on a modelling decision nobody has taken; unreadable: the analysis cannot follow the shape the code is written in) and why. Only a code a rule declares CARRYABLE may appear, and naming any other is an error, so the register can never widen into general-purpose suppression. An entry carries a finding only when it lists EVERY unit that finding reports, so an aggregating finding cannot grow behind it; an entry that matched nothing, that duplicates another, that names a spec the tree does not hold, or that lists a unit no longer reported is STALE_CARRIED_FINDING, so the register only shrinks. The audit is silent in a run that could not have fired the findings at all: one that built no code model, the specs outside a scoped run, and a code the project switched off. Nothing can check a reason for TRUTH \u2014 a stale entry is one that stopped applying, never one that still applies for a reason that has become false \u2014 so a reason group may declare its own classification provisional (`revisit`: what would settle it), and every run counts those findings beside the kind totals.",
       codes: [
         { code: "UNCARRYABLE_FINDING", defaultSeverity: "error", summary: "The conformance debt register names an issue code no rule emits, or one no rule declares carryable \u2014 the register holds measured code\u2194spec debt, never a design rule somebody wants quiet" },
         { code: "STALE_CARRIED_FINDING", defaultSeverity: "warning", summary: "An entry of the conformance debt register carries a finding that no longer fires, or lists a unit that finding no longer reports \u2014 delete it, the register only shrinks" }
@@ -16446,12 +16594,20 @@ function buildRuleContext(opts) {
   const allowLookup = /* @__PURE__ */ new Map();
   const collectAllows = (specId, lint) => {
     for (const a of lint?.allow ?? []) {
-      const entry = { specId, code: a.code, reason: a.reason, used: false };
+      const entry = { specId, code: a.code, at: a.at, covers: a.covers, reason: a.reason, used: false };
       lintAllows.push(entry);
       if (!allowLookup.has(specId)) allowLookup.set(specId, /* @__PURE__ */ new Map());
-      allowLookup.get(specId).set(a.code, entry);
+      const forSpec = allowLookup.get(specId);
+      const forCode = forSpec.get(a.code) ?? [];
+      forCode.push(entry);
+      forSpec.set(a.code, forCode);
     }
   };
+  const sitesSeen = /* @__PURE__ */ new Map();
+  const sitesReported = (specId, code) => {
+    const seen = sitesSeen.get(`${specId}\0${code}`);
+    return { sites: [...seen?.sites ?? []], unsited: seen?.unsited ?? false };
+  };
   for (const s of subsystems) collectAllows(s.id, s.lint);
   for (const c of components) collectAllows(c.id, c.lint);
   for (const i of interfaces) collectAllows(i.id, i.lint);
@@ -16488,15 +16644,29 @@ function buildRuleContext(opts) {
     }
     const severity = getRuleSeverity(code, defaultSeverity, isDraftContext, owner);
     if (severity === "off") return;
+    let text = message;
+    if (specId) {
+      const key = `${specId}\0${code}`;
+      let seen = sitesSeen.get(key);
+      if (!seen) sitesSeen.set(key, seen = { sites: /* @__PURE__ */ new Set(), unsited: false });
+      if (parts) seen.sites.add(parts.at);
+      else seen.unsited = true;
+    }
+    let allowClaimed = false;
     if (specId) {
-      const allow = allowLookup.get(specId)?.get(code);
+      const allow = (allowLookup.get(specId)?.get(code) ?? []).find((a) => parts ? a.at === parts.at : a.at === void 0);
       if (allow) {
         allow.used = true;
-        if (severity === "warning") return;
+        allowClaimed = true;
+        const grew = (parts?.covers ?? []).filter((unit) => !(allow.covers ?? []).includes(unit));
+        if (grew.length === 0) {
+          if (severity === "warning") return;
+        } else {
+          text = `${text} A lint.allow covers this site, but not ${grew.length} part(s) of it \u2014 ${grew.map((u) => `"${u}"`).join("; ")} ${grew.length === 1 ? "is" : "are"} new. Decide on them: add them to the allow's \`covers\` with a reason that is actually true, or fix them.`;
+        }
       }
     }
-    let text = message;
-    if (specId && parts && severity === "warning") {
+    if (specId && parts && severity === "warning" && !allowClaimed) {
       const entry = carriedLookup.get(carriedKey(specId, code, parts.at));
       if (entry) {
         entry.fired = true;
@@ -16589,6 +16759,7 @@ function buildRuleContext(opts) {
     codeModel: opts.codeModel ?? emptyCodeModel(),
     roundTripIssues: opts.roundTripIssues,
     lintAllows,
+    sitesReported,
     knownIssueCodes: opts.knownIssueCodes,
     carriedFindings,
     carryableIssueCodes: opts.carryableIssueCodes ?? /* @__PURE__ */ new Set(),
@@ -19143,9 +19314,11 @@ function identityKeyOf(field, item) {
       return `${String(o.topic)} ${o.event === void 0 ? "" : String(o.event)}`;
     case "trustedLinks":
       return str(o.subsystem);
+    // lint.allow: an allow is one decision about one OCCURRENCE, so several
+    // may share a code on one spec, each naming its own site. Keyed by code
+    // alone a delta for one site would overwrite its neighbours.
     case "allow":
-      return str(o.code);
-    // lint.allow
+      return `${String(o.code)} ${o.at === void 0 ? "" : String(o.at)}`;
     case "findings":
       return str(o.code);
     // an interface method's findings
@@ -19233,6 +19406,7 @@ function identityFieldsOf(field) {
     case "trustedLinks":
       return ["subsystem"];
     case "allow":
+      return ["code", "at"];
     case "findings":
       return ["code"];
     case "invariants":
@@ -27258,6 +27432,7 @@ __export(src_exports, {
   packEntryLabel: () => packEntryLabel,
   packEntryRef: () => packEntryRef,
   packStoreDir: () => packStoreDir,
+  parseDeclaredCall: () => parseDeclaredCall,
   parseTemplate: () => parseTemplate,
   parseYaml: () => parseYaml,
   passesIntentFloor: () => passesIntentFloor,
@@ -27996,6 +28171,7 @@ function loadProjectConfig4() {
   packEntryLabel,
   packEntryRef,
   packStoreDir,
+  parseDeclaredCall,
   parseTemplate,
   parseYaml,
   passesIntentFloor,