@wairon/cli 5.1.1-dev.5 → 5.1.1-dev.7

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.5";
+    WAIRON_VERSION = "5.1.1-dev.7";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     ARCHITECT_AGENT_ID = "agent-architect";
     ARCHITECT_TEMPLATE_ID = "architect";
@@ -3976,9 +3976,9 @@ var init_surfaces = __esm({
 // src/core/rules/namespace.ts
 function isExternalNamespaceRef(ctx, ref) {
   if (ref.startsWith("::") || ref.startsWith("super::")) return true;
-  const sep6 = ref.indexOf("::");
-  if (sep6 === -1) return false;
-  return !ctx.subsystemIds.has(ref.slice(0, sep6));
+  const sep9 = ref.indexOf("::");
+  if (sep9 === -1) return false;
+  return !ctx.subsystemIds.has(ref.slice(0, sep9));
 }
 function resolveSurfaceRef(ctx, ref) {
   const local = ref.split("::").filter((seg) => seg && seg !== "super").pop();
@@ -4315,10 +4315,10 @@ function stepGraph(steps) {
     const s = byNum.get(n);
     if (s.type !== "parallel" || s.endStep === void 0 || !s.branches?.length) continue;
     const entries = s.branches.map((b) => b.step).sort((a, b) => a - b);
-    const join49 = fallNext(s.endStep);
+    const join50 = fallNext(s.endStep);
     for (let i = 0; i < entries.length; i++) {
       const armEnd = i + 1 < entries.length ? prevOf(entries[i + 1]) : s.endStep;
-      if (armEnd !== void 0 && armEnd >= entries[i]) armEndJoin.set(armEnd, join49);
+      if (armEnd !== void 0 && armEnd >= entries[i]) armEndJoin.set(armEnd, join50);
     }
   }
   const successorsOf = (n) => {
@@ -4392,7 +4392,8 @@ var init_narrative_flow = __esm({
         { code: "REGION_OVERLAP", defaultSeverity: "error", summary: "loop/try regions interleave \u2014 regions must nest or be disjoint to map onto structured code" },
         { code: "JUMP_INTO_REGION", defaultSeverity: "warning", summary: "Jump lands in the middle of a loop/try body from outside \u2014 regions are entered through their header" },
         { code: "FALLTHROUGH_INTO_HANDLER", defaultSeverity: "warning", summary: "try body falls through into its own catch/finally region on the success path" },
-        { code: "BACKWARD_JUMP", defaultSeverity: "warning", summary: "Backward jump that is not a continue to an enclosing loop header \u2014 model repetition with a loop step" }
+        { code: "BACKWARD_JUMP", defaultSeverity: "warning", summary: "Backward jump that is not a continue to an enclosing loop header \u2014 model repetition with a loop step" },
+        { code: "DUPLICATE_STEP_LABEL", defaultSeverity: "error", summary: "Two steps in one narrative share a label \u2014 the symbolic anchor later deltas address by" }
       ],
       check(ctx) {
         for (const impl of ctx.implementations) {
@@ -4401,6 +4402,23 @@ var init_narrative_flow = __esm({
             const steps = implMethod.narrative;
             if (!steps.length) continue;
             const where = `Method "${implMethod.name}" in implementation "${impl.id}": `;
+            const labelled = /* @__PURE__ */ new Map();
+            for (const step of steps) {
+              const label = step.label;
+              if (!label) continue;
+              const first = labelled.get(label);
+              if (first !== void 0) {
+                ctx.addIssue(
+                  "error",
+                  "DUPLICATE_STEP_LABEL",
+                  `${where}steps ${first} and ${step.stepNumber} share the label "${label}". A label anchors one step for later deltas to address; two steps holding it makes every symbolic reference ambiguous and blocks all further edits to this implementation. Rename one.`,
+                  impl.id,
+                  isDraftCtx
+                );
+              } else {
+                labelled.set(label, step.stepNumber);
+              }
+            }
             let sound = true;
             const malformed = (msg) => {
               sound = false;
@@ -7626,11 +7644,11 @@ var init_narrative_antipatterns = __esm({
           const memberEdges = keys.flatMap((k) => (adjacency.get(k) ?? []).filter((e) => inScc.has(e.toKey)));
           if (memberEdges.length === 0) continue;
           const anchor = [...memberEdges].sort((a, b) => a.fromKey.localeCompare(b.fromKey))[0];
-          const path64 = [...keys].sort().join(" \u2192 ");
+          const path67 = [...keys].sort().join(" \u2192 ");
           ctx.addIssue(
             "warning",
             "UNCONDITIONAL_CALL_CYCLE",
-            `Call cycle with no guard: ${path64} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
+            `Call cycle with no guard: ${path67} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
             anchor.impl.id,
             memberEdges.some((e) => ctx.isImplementationDraft(e.impl))
           );
@@ -14403,6 +14421,137 @@ var init_repository = __esm({
   }
 });
 
+// src/core/baseline.ts
+function diffSize(d) {
+  return d.added.length + d.changed.length + d.removed.length;
+}
+function baselineDir() {
+  return process.env["WAIRON_BASELINE_DIR"] || path17.join(os5.homedir(), ".wairon", "baselines");
+}
+function keyFor(root) {
+  const normalized = path17.resolve(root).replace(/\\/g, "/").toLowerCase();
+  return crypto3.createHash("sha256").update(normalized).digest("hex").slice(0, 16);
+}
+function baselinePath(root) {
+  return path17.join(baselineDir(), `${keyFor(root)}.json`);
+}
+function readBaseline(root = getProjectRoot()) {
+  const p = baselinePath(root);
+  if (!pathExists(p)) return null;
+  try {
+    return JSON.parse(fs13.readFileSync(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeBaseline(record2) {
+  const p = baselinePath(record2.projectRoot);
+  ensureDir(path17.dirname(p));
+  fs13.writeFileSync(p, `${JSON.stringify(record2, null, 2)}
+`);
+  return p;
+}
+function currentSpecs(root) {
+  const mountDirs = loadSubsystemSpecs().filter((s) => s.projectPath && !s.id.includes("::")).map((s) => `${path17.resolve(root, s.projectPath).split(path17.sep).join("/")}/`);
+  const out = {};
+  for (const [abs, content] of snapshotSpecFiles()) {
+    const normalized = path17.resolve(abs).split(path17.sep).join("/");
+    if (mountDirs.some((dir) => normalized.startsWith(dir))) continue;
+    out[path17.relative(root, abs).split(path17.sep).join("/")] = content;
+  }
+  return out;
+}
+function captureBaseline(approvedBy, children = {}, root = getProjectRoot(), scope) {
+  const system = loadSystemSpec();
+  const current2 = currentSpecs(root);
+  let specs = current2;
+  if (scope) {
+    const previous = readBaseline(root)?.specs ?? {};
+    specs = { ...previous };
+    for (const rel2 of Object.keys(previous)) {
+      if (scope.paths.has(rel2) && current2[rel2] === void 0) delete specs[rel2];
+    }
+    for (const rel2 of scope.paths) {
+      if (current2[rel2] !== void 0) specs[rel2] = current2[rel2];
+    }
+  }
+  return {
+    schemaVersion: SCHEMA_VERSION,
+    projectRoot: path17.resolve(root),
+    systemName: system?.name ?? path17.basename(root),
+    approvedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    approvedBy,
+    stateId: computeGateStateId(),
+    specs,
+    children
+  };
+}
+function diffAgainstBaseline(root = getProjectRoot()) {
+  const baseline = readBaseline(root);
+  if (!baseline) return null;
+  const current2 = currentSpecs(root);
+  const added = [];
+  const changed = [];
+  const removed = [];
+  const unchangedPaths = [];
+  for (const [rel2, content] of Object.entries(current2)) {
+    const before = baseline.specs[rel2];
+    if (before === void 0) added.push(rel2);
+    else if (before !== content) changed.push(rel2);
+    else unchangedPaths.push(rel2);
+  }
+  for (const rel2 of Object.keys(baseline.specs)) {
+    if (current2[rel2] === void 0) removed.push(rel2);
+  }
+  return {
+    added: added.sort(),
+    changed: changed.sort(),
+    removed: removed.sort(),
+    unchangedPaths: unchangedPaths.sort()
+  };
+}
+function settledSpecPaths(root = getProjectRoot()) {
+  const diff = diffAgainstBaseline(root);
+  return diff ? new Set(diff.unchangedPaths) : null;
+}
+function pinOf(stateId) {
+  return `${stateId.algorithm}:${stateId.digest}`;
+}
+function currentChildPins(mounts, root = getProjectRoot()) {
+  const pins = {};
+  for (const mount of mounts) {
+    if (!mount.projectPath || mount.id.includes("::")) continue;
+    const childRoot = path17.resolve(root, mount.projectPath);
+    const child = readBaseline(childRoot);
+    if (child) pins[mount.id] = pinOf(child.stateId);
+  }
+  return pins;
+}
+function movedChildren(mounts, root = getProjectRoot()) {
+  const baseline = readBaseline(root);
+  if (!baseline) return [];
+  const now = currentChildPins(mounts, root);
+  const moved = [];
+  for (const [id, pinned] of Object.entries(baseline.children)) {
+    const current2 = now[id] ?? null;
+    if (current2 !== pinned) moved.push({ id, pinned, now: current2 });
+  }
+  return moved;
+}
+var fs13, os5, path17, crypto3, SCHEMA_VERSION;
+var init_baseline = __esm({
+  "src/core/baseline.ts"() {
+    "use strict";
+    fs13 = __toESM(require("fs"));
+    os5 = __toESM(require("os"));
+    path17 = __toESM(require("path"));
+    crypto3 = __toESM(require("crypto"));
+    init_fs();
+    init_specs2();
+    SCHEMA_VERSION = "1.0.0";
+  }
+});
+
 // src/core/validation.ts
 var validation_exports = {};
 __export(validation_exports, {
@@ -14533,7 +14682,7 @@ function validateSddTree(rulesOrOptions, projectType = "backend") {
   const types = loadTypeSpecs();
   const surfaceSnapshots = loadSurfaceSnapshots();
   const codeModel = buildCodeModel(implementations, getProjectRoot());
-  const statusBearing = treatAllAsComplete ? [...subsystems, ...components, ...interfaces, ...implementations] : [];
+  const statusBearing = treatAllAsComplete ? [...subsystems, ...components, ...interfaces, ...implementations] : settledStatusBearing({ subsystems, components, interfaces, implementations });
   const statusSnapshot = statusBearing.map((s) => s.status);
   for (const s of statusBearing) s.status = "complete";
   try {
@@ -14655,10 +14804,34 @@ function validateSddTree(rulesOrOptions, projectType = "backend") {
     });
   }
 }
+function settledStatusBearing(loaded) {
+  let settled;
+  try {
+    settled = settledSpecPaths();
+  } catch {
+    return [];
+  }
+  if (!settled || settled.size === 0) return [];
+  const root = getProjectRoot();
+  const index = scanAllSpecs();
+  const rel2 = (abs) => path18.relative(root, abs).split(path18.sep).join("/");
+  const out = [];
+  const take = (specs, paths) => {
+    for (const spec of specs) {
+      const p = paths[spec.id];
+      if (p && settled.has(rel2(p))) out.push(spec);
+    }
+  };
+  take(loaded.subsystems, index.paths.subsystem);
+  take(loaded.components, index.paths.component);
+  take(loaded.interfaces, index.paths.interface);
+  take(loaded.implementations, index.paths.implementation);
+  return out;
+}
 function validateAsComplete(options) {
   return validateSddTree({ ...options ?? {}, treatAllAsComplete: true });
 }
-var SUBPROJECT_REFERENCE_CODES, SUBPROJECT_CONFORMANCE_CODES;
+var path18, SUBPROJECT_REFERENCE_CODES, SUBPROJECT_CONFORMANCE_CODES;
 var init_validation = __esm({
   "src/core/validation.ts"() {
     "use strict";
@@ -14672,6 +14845,8 @@ var init_validation = __esm({
     init_source_analysis();
     init_specs2();
     init_fs();
+    path18 = __toESM(require("path"));
+    init_baseline();
     SUBPROJECT_REFERENCE_CODES = /* @__PURE__ */ new Set([
       "UNDEFINED_TYPE_REFERENCE",
       "INVALID_DEPENDENCY_REFERENCE",
@@ -15001,8 +15176,8 @@ function generateSequenceDiagram(componentId, methodName, options) {
     const steps = [...methodImpl.narrative].sort((a, b) => a.stepNumber - b.stepNumber);
     for (const step of steps) {
       for (const par of parallelArms) {
-        const sep6 = par.sepByStep.get(step.stepNumber);
-        if (sep6 !== void 0) lines.push(`  and ${escapeLabel(sep6)}`);
+        const sep9 = par.sepByStep.get(step.stepNumber);
+        if (sep9 !== void 0) lines.push(`  and ${escapeLabel(sep9)}`);
       }
       switch (step.type) {
         case "local":
@@ -15282,6 +15457,7 @@ __export(specs_exports, {
   saveTypeSpec: () => saveTypeSpec,
   scanAllSpecs: () => scanAllSpecs,
   snapshotSpecFiles: () => snapshotSpecFiles,
+  specPathsInScope: () => specPathsInScope,
   splitNamespace: () => splitNamespace,
   updateSpec: () => updateSpec,
   workspaceFor: () => workspaceFor
@@ -15355,16 +15531,16 @@ function relativizeId(id, prefix) {
   return `${"super::".repeat(prefixParts.length - common)}${idParts.slice(common).join("::")}`;
 }
 function isWithin(dir, file) {
-  const d = path17.resolve(dir);
-  const f = path17.resolve(file);
-  return f === d || f.startsWith(d + path17.sep);
+  const d = path19.resolve(dir);
+  const f = path19.resolve(file);
+  return f === d || f.startsWith(d + path19.sep);
 }
 function projectPathEscapesRoot(projectRoot2, projectPath, resolvedChildDir) {
-  return path17.isAbsolute(projectPath) || !isWithin(projectRoot2, resolvedChildDir);
+  return path19.isAbsolute(projectPath) || !isWithin(projectRoot2, resolvedChildDir);
 }
 function assertContainedProjectPath(projectRoot2, projectPath) {
-  const root = path17.resolve(projectRoot2);
-  const resolved = path17.resolve(root, projectPath);
+  const root = path19.resolve(projectRoot2);
+  const resolved = path19.resolve(root, projectPath);
   if (projectPathEscapesRoot(root, projectPath, resolved)) {
     throw new Error(
       `projectPath "${projectPath}" must resolve within the project root "${root}", but resolves to "${resolved}"; absolute paths and ../-escaping paths are rejected so a chained subproject is always contained by its parent.`
@@ -15375,11 +15551,11 @@ function assertContainedProjectPath(projectRoot2, projectPath) {
 function findChainingParent(childRoot) {
   let childResolved;
   try {
-    childResolved = path17.resolve(childRoot);
+    childResolved = path19.resolve(childRoot);
   } catch {
     return null;
   }
-  let dir = path17.dirname(childResolved);
+  let dir = path19.dirname(childResolved);
   for (let hops = 0; hops < 32; hops++) {
     const specsDir = aiPathsAt(dir).specsDir();
     if (pathExists(specsDir)) {
@@ -15394,7 +15570,7 @@ function findChainingParent(childRoot) {
           const projectPath = raw.projectPath;
           if (typeof projectPath === "string" && projectPath.trim() !== "") {
             try {
-              if (path17.resolve(dir, projectPath) === childResolved) {
+              if (path19.resolve(dir, projectPath) === childResolved) {
                 const id = raw.id;
                 return { parentRoot: dir, subsystemId: typeof id === "string" ? id : "?" };
               }
@@ -15404,7 +15580,7 @@ function findChainingParent(childRoot) {
         }
       }
     }
-    const up = path17.dirname(dir);
+    const up = path19.dirname(dir);
     if (up === dir) break;
     dir = up;
   }
@@ -15509,18 +15685,18 @@ function findOwner(id, components) {
   }) ?? null;
 }
 function moveComponentFolder(fromDir, toDir) {
-  if (path17.normalize(fromDir) === path17.normalize(toDir)) return false;
-  if (!fs13.existsSync(fromDir) || fs13.existsSync(toDir)) return false;
-  ensureDir(path17.dirname(toDir));
-  fs13.renameSync(fromDir, toDir);
+  if (path19.normalize(fromDir) === path19.normalize(toDir)) return false;
+  if (!fs14.existsSync(fromDir) || fs14.existsSync(toDir)) return false;
+  ensureDir(path19.dirname(toDir));
+  fs14.renameSync(fromDir, toDir);
   return true;
 }
 function cleanEmptyDirs(filePath, specsRoot) {
-  let dir = path17.dirname(filePath);
+  let dir = path19.dirname(filePath);
   while (dir !== specsRoot && dir.startsWith(specsRoot)) {
-    if (fs13.existsSync(dir) && fs13.readdirSync(dir).length === 0) {
-      fs13.rmdirSync(dir);
-      dir = path17.dirname(dir);
+    if (fs14.existsSync(dir) && fs14.readdirSync(dir).length === 0) {
+      fs14.rmdirSync(dir);
+      dir = path19.dirname(dir);
     } else {
       break;
     }
@@ -15539,13 +15715,13 @@ function parseOrThrow(schema, value, kind, id) {
 function computeSpecTreeSignature(dirs) {
   const parts = [];
   for (const dir of dirs) {
-    if (!fs13.existsSync(dir)) {
+    if (!fs14.existsSync(dir)) {
       parts.push(`${dir}:missing`);
       continue;
     }
     for (const f of listFilesRecursive(dir, ".yaml")) {
       try {
-        const st = fs13.statSync(f);
+        const st = fs14.statSync(f);
         parts.push(`${f}:${st.mtimeMs}:${st.size}`);
       } catch {
         parts.push(`${f}:gone`);
@@ -15555,7 +15731,7 @@ function computeSpecTreeSignature(dirs) {
   return parts.join("|");
 }
 function workspaceFor(rootDir) {
-  const key = path17.resolve(rootDir);
+  const key = path19.resolve(rootDir);
   let ws = workspaces.get(key);
   if (!ws) {
     ws = new SpecWorkspace(key);
@@ -15694,7 +15870,7 @@ function readLockState() {
   return { state: stateIdEquals(record2.stateId, current2) ? "locked" : "stale", record: record2, current: current2 };
 }
 function computeStateIdAt(root) {
-  const resolved = path17.resolve(root);
+  const resolved = path19.resolve(root);
   return runWithProjectRoot(resolved, () => {
     workspaceFor(resolved).invalidate();
     const system = loadSystemSpec();
@@ -15724,12 +15900,15 @@ function collectPromotableSpecs(scopeSubsystem) {
 function applySpecStatus(kind, id, status2) {
   current().applySpecStatus(kind, id, status2);
 }
+function specPathsInScope(scopeSubsystem) {
+  return current().specPathsInScope(scopeSubsystem);
+}
 function snapshotSpecFiles() {
   return current().snapshotSpecFiles();
 }
 function restoreSpecFiles(snapshot) {
   for (const [file, content] of snapshot) {
-    fs13.writeFileSync(file, content);
+    fs14.writeFileSync(file, content);
   }
 }
 function findLegacySpecFiles() {
@@ -15738,12 +15917,12 @@ function findLegacySpecFiles() {
 function updateSpec(kind, id, delta, hooks) {
   return current().updateSpec(kind, id, delta, hooks);
 }
-var fs13, path17, SIGNATURE_TTL_MS, SpecWorkspace, workspaces;
+var fs14, path19, SIGNATURE_TTL_MS, SpecWorkspace, workspaces;
 var init_specs2 = __esm({
   "src/core/specs.ts"() {
     "use strict";
-    fs13 = __toESM(require("fs"));
-    path17 = __toESM(require("path"));
+    fs14 = __toESM(require("fs"));
+    path19 = __toESM(require("path"));
     init_loader();
     init_fs();
     init_statehash();
@@ -15764,7 +15943,7 @@ var init_specs2 = __esm({
         this.rootSubsystems = /* @__PURE__ */ new Set();
         this.scanVisitedSpecDirs = [];
         this.loaderIssues = [];
-        this.rootDir = path17.resolve(rootDir);
+        this.rootDir = path19.resolve(rootDir);
         this.paths = aiPathsAt(this.rootDir);
       }
       invalidate() {
@@ -15791,7 +15970,7 @@ var init_specs2 = __esm({
         this.rootSubsystems.clear();
         this.cachedRecursive = recursive;
         this.scanVisitedSpecDirs = [];
-        const visited = /* @__PURE__ */ new Set([path17.resolve(this.rootDir)]);
+        const visited = /* @__PURE__ */ new Set([path19.resolve(this.rootDir)]);
         const maxDepth = typeof recursive === "number" ? recursive : recursive ? Infinity : 0;
         this.cachedIndex = this.scanSpecsForProject(this.rootDir, "", visited, maxDepth, 0);
         this.cachedSpecDirs = this.scanVisitedSpecDirs;
@@ -15806,10 +15985,10 @@ var init_specs2 = __esm({
         this.scanVisitedSpecDirs.push(specsDir);
         if (!pathExists(specsDir)) return index;
         const files = listFilesRecursive(specsDir, ".yaml");
-        const systemYaml = path17.normalize(projectPaths.specsSystem());
+        const systemYaml = path19.normalize(projectPaths.specsSystem());
         const localSubprojects = [];
         for (const file of files) {
-          const normFile = path17.normalize(file);
+          const normFile = path19.normalize(file);
           if (normFile === systemYaml) continue;
           let detectedType = "spec";
           try {
@@ -15819,7 +15998,7 @@ var init_specs2 = __esm({
                 severity: "error",
                 code: "INVALID_YAML",
                 message: `Spec file "${file}" is not a valid YAML object or is empty.`,
-                specId: path17.basename(file, ".yaml")
+                specId: path19.basename(file, ".yaml")
               });
               continue;
             }
@@ -15851,8 +16030,8 @@ var init_specs2 = __esm({
               detectedType = "implementation";
               const parsed = ImplementationSpecSchema.parse(raw);
               if (parsed.sourcePath) {
-                const absSourcePath = path17.resolve(projectDir, parsed.sourcePath);
-                parsed.sourcePath = path17.relative(projectDir, absSourcePath).replace(/\\/g, "/");
+                const absSourcePath = path19.resolve(projectDir, parsed.sourcePath);
+                parsed.sourcePath = path19.relative(projectDir, absSourcePath).replace(/\\/g, "/");
               }
               index.implementations.push(parsed);
               index.paths.implementation[parsed.id] = file;
@@ -15874,11 +16053,11 @@ var init_specs2 = __esm({
                 severity: "error",
                 code: "UNKNOWN_SPEC_TYPE",
                 message: `Spec file "${file}" does not match any recognized L1-L4 schema structure.`,
-                specId: path17.basename(file, ".yaml")
+                specId: path19.basename(file, ".yaml")
               });
             }
           } catch (e) {
-            const filename = path17.basename(file, ".yaml");
+            const filename = path19.basename(file, ".yaml");
             this.loaderIssues.push({
               severity: "error",
               code: "SCHEMA_VALIDATION_ERROR",
@@ -15976,7 +16155,7 @@ var init_specs2 = __esm({
         }
         if (currentDepth < maxDepth) {
           for (const subproj of localSubprojects) {
-            const childDir = path17.resolve(projectDir, subproj.projectPath);
+            const childDir = path19.resolve(projectDir, subproj.projectPath);
             if (projectPathEscapesRoot(this.rootDir, subproj.projectPath, childDir)) {
               this.loaderIssues.push({
                 severity: "error",
@@ -15995,7 +16174,7 @@ var init_specs2 = __esm({
               });
               continue;
             }
-            if (!fs13.existsSync(childDir)) {
+            if (!fs14.existsSync(childDir)) {
               this.loaderIssues.push({
                 severity: "error",
                 code: "SUBPROJECT_NOT_FOUND",
@@ -16038,7 +16217,7 @@ var init_specs2 = __esm({
           const index = this.scanAll();
           const sub = index.subsystems.find((s) => s.id === currentPrefix);
           if (sub && sub.projectPath) {
-            const nextDir = path17.resolve(currentDir, sub.projectPath);
+            const nextDir = path19.resolve(currentDir, sub.projectPath);
             if (projectPathEscapesRoot(this.rootDir, sub.projectPath, nextDir)) {
               this.loaderIssues.push({
                 severity: "error",
@@ -16090,9 +16269,9 @@ var init_specs2 = __esm({
           return index.paths.subsystem[matches2[0]];
         }
         if (pathExists(this.paths.specsSubsystemsDir()) && listFiles(this.paths.specsSubsystemsDir(), ".yaml").length > 0) {
-          return path17.join(this.paths.specsSubsystemsDir(), `${id}.yaml`);
+          return path19.join(this.paths.specsSubsystemsDir(), `${id}.yaml`);
         }
-        return path17.join(this.paths.specsDir(), id, ".index.yaml");
+        return path19.join(this.paths.specsDir(), id, ".index.yaml");
       }
       getComponentPath(id, subsystemId) {
         const index = this.scanAll();
@@ -16112,21 +16291,21 @@ var init_specs2 = __esm({
         if (owner) {
           const ownerPath = index.paths.component[owner.id];
           if (ownerPath && ownerPath.endsWith(".index.yaml")) {
-            return path17.join(path17.dirname(ownerPath), id, ".index.yaml");
+            return path19.join(path19.dirname(ownerPath), id, ".index.yaml");
           }
         }
         if (subsystemId) {
           const subPath = this.getSubsystemPath(subsystemId);
-          const subDir = path17.dirname(subPath);
+          const subDir = path19.dirname(subPath);
           if (subPath.endsWith(".index.yaml")) {
-            return path17.join(subDir, id, ".index.yaml");
+            return path19.join(subDir, id, ".index.yaml");
           }
         }
         if (pathExists(this.paths.specsComponentsDir()) && listFiles(this.paths.specsComponentsDir(), ".yaml").length > 0) {
-          return path17.join(this.paths.specsComponentsDir(), `${id}.yaml`);
+          return path19.join(this.paths.specsComponentsDir(), `${id}.yaml`);
         }
         const targetSubsystem = subsystemId || "default";
-        return path17.join(this.paths.specsDir(), targetSubsystem, id, ".index.yaml");
+        return path19.join(this.paths.specsDir(), targetSubsystem, id, ".index.yaml");
       }
       getInterfacePath(id, componentId) {
         const index = this.scanAll();
@@ -16152,16 +16331,16 @@ var init_specs2 = __esm({
         }
         if (componentId) {
           const compPath = this.getComponentPath(componentId);
-          const compDir = path17.dirname(compPath);
+          const compDir = path19.dirname(compPath);
           if (compPath.endsWith(".index.yaml")) {
-            return path17.join(compDir, ".interface.yaml");
+            return path19.join(compDir, ".interface.yaml");
           }
         }
         if (pathExists(this.paths.specsInterfacesDir()) && listFiles(this.paths.specsInterfacesDir(), ".yaml").length > 0) {
-          return path17.join(this.paths.specsInterfacesDir(), `${id}.yaml`);
+          return path19.join(this.paths.specsInterfacesDir(), `${id}.yaml`);
         }
         const targetComponent = componentId || "default";
-        return path17.join(this.paths.specsDir(), "default", targetComponent, ".interface.yaml");
+        return path19.join(this.paths.specsDir(), "default", targetComponent, ".interface.yaml");
       }
       getImplementationPath(id, contractId) {
         const index = this.scanAll();
@@ -16187,16 +16366,16 @@ var init_specs2 = __esm({
         }
         if (contractId) {
           const intfPath = this.getInterfacePath(contractId);
-          const intfDir = path17.dirname(intfPath);
+          const intfDir = path19.dirname(intfPath);
           if (intfPath.endsWith(".interface.yaml")) {
-            return path17.join(intfDir, ".implementation.yaml");
+            return path19.join(intfDir, ".implementation.yaml");
           }
         }
         if (pathExists(this.paths.specsImplementationsDir()) && listFiles(this.paths.specsImplementationsDir(), ".yaml").length > 0) {
-          return path17.join(this.paths.specsImplementationsDir(), `${id}.yaml`);
+          return path19.join(this.paths.specsImplementationsDir(), `${id}.yaml`);
         }
         const targetContract = contractId ? contractId.replace(/^i/, "") : "default";
-        return path17.join(this.paths.specsDir(), "default", targetContract, ".implementation.yaml");
+        return path19.join(this.paths.specsDir(), "default", targetContract, ".implementation.yaml");
       }
       getTypePath(id, subsystemId, group) {
         const index = this.scanAll();
@@ -16227,7 +16406,7 @@ var init_specs2 = __esm({
           const groupPath = index.paths.group[targetGroup] || index.paths.group[plainGroup];
           if (groupPath) {
             const localId2 = id.split("::").pop();
-            return path17.join(path17.dirname(groupPath), `${localId2}.yaml`);
+            return path19.join(path19.dirname(groupPath), `${localId2}.yaml`);
           }
         }
         let localId = id;
@@ -16240,12 +16419,12 @@ var init_specs2 = __esm({
         }
         if (subsystemId) {
           const subPath = this.getSubsystemPath(subsystemId);
-          const subDir = path17.dirname(subPath);
+          const subDir = path19.dirname(subPath);
           if (subPath.endsWith(".index.yaml")) {
-            return path17.join(subDir, "types", `${localId}.yaml`);
+            return path19.join(subDir, "types", `${localId}.yaml`);
           }
         }
-        return path17.join(this.paths.specsTypesDir(), `${localId}.yaml`);
+        return path19.join(this.paths.specsTypesDir(), `${localId}.yaml`);
       }
       getGroupPath(id, subsystemId) {
         const index = this.scanAll();
@@ -16279,12 +16458,12 @@ var init_specs2 = __esm({
         }
         if (subsystemId) {
           const subPath = this.getSubsystemPath(subsystemId);
-          const subDir = path17.dirname(subPath);
+          const subDir = path19.dirname(subPath);
           if (subPath.endsWith(".index.yaml")) {
-            return path17.join(subDir, "types", localId, ".index.yaml");
+            return path19.join(subDir, "types", localId, ".index.yaml");
           }
         }
-        return path17.join(this.paths.specsTypesDir(), localId, ".index.yaml");
+        return path19.join(this.paths.specsTypesDir(), localId, ".index.yaml");
       }
       // -------------------------------------------------------------------------
       // Level 0: System
@@ -16307,7 +16486,7 @@ var init_specs2 = __esm({
       }
       saveSystemSpec(spec) {
         const p = this.paths.specsSystem();
-        ensureDir(path17.dirname(p));
+        ensureDir(path19.dirname(p));
         writeYamlFile(p, parseOrThrow(SystemSpecSchema, spec, "system", spec.name));
         invalidateSpecCache();
       }
@@ -16425,7 +16604,7 @@ var init_specs2 = __esm({
       }
       saveSubsystemSpec(spec) {
         const p = this.getSubsystemPath(spec.id);
-        ensureDir(path17.dirname(p));
+        ensureDir(path19.dirname(p));
         const { prefix } = splitNamespace(spec.id);
         if (!prefix && spec.projectPath && spec.projectPath.trim() !== "") {
           assertContainedProjectPath(this.rootDir, spec.projectPath);
@@ -16456,9 +16635,9 @@ var init_specs2 = __esm({
       }
       deleteSubsystemSpec(id) {
         const p = this.getSubsystemPath(id);
-        if (!fs13.existsSync(p)) return false;
-        fs13.unlinkSync(p);
-        cleanEmptyDirs(p, path17.resolve(this.paths.specsDir()));
+        if (!fs14.existsSync(p)) return false;
+        fs14.unlinkSync(p);
+        cleanEmptyDirs(p, path19.resolve(this.paths.specsDir()));
         invalidateSpecCache();
         return true;
       }
@@ -16491,7 +16670,7 @@ var init_specs2 = __esm({
       saveComponentSpec(spec, opts) {
         const notices = [];
         const p = this.getComponentPath(spec.id, spec.subsystem);
-        ensureDir(path17.dirname(p));
+        ensureDir(path19.dirname(p));
         const specToWrite = this.prepareComponentForWrite(spec);
         const existing = this.loadComponentSpec(spec.id);
         if (existing) {
@@ -16508,7 +16687,7 @@ var init_specs2 = __esm({
         const subsystemChanged = existing && existing.subsystem !== spec.subsystem && splitNamespace(existing.subsystem).localId !== splitNamespace(spec.subsystem).localId;
         if (subsystemChanged && !p.endsWith(".index.yaml")) {
           notices.push(
-            `component "${spec.id}" already exists at ${path17.relative(this.rootDir, p)} \u2014 the flat layout re-saves in place and never relocates the file. The subsystem field is now "${spec.subsystem}" (was "${existing.subsystem}").`
+            `component "${spec.id}" already exists at ${path19.relative(this.rootDir, p)} \u2014 the flat layout re-saves in place and never relocates the file. The subsystem field is now "${spec.subsystem}" (was "${existing.subsystem}").`
           );
         }
         specToWrite.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -16519,9 +16698,9 @@ var init_specs2 = __esm({
       }
       deleteComponentSpec(id) {
         const p = this.getComponentPath(id);
-        if (!fs13.existsSync(p)) return false;
-        fs13.unlinkSync(p);
-        cleanEmptyDirs(p, path17.resolve(this.paths.specsDir()));
+        if (!fs14.existsSync(p)) return false;
+        fs14.unlinkSync(p);
+        cleanEmptyDirs(p, path19.resolve(this.paths.specsDir()));
         invalidateSpecCache();
         return true;
       }
@@ -16534,12 +16713,12 @@ var init_specs2 = __esm({
         if (owner) {
           const ownerPath = index.paths.component[owner.id];
           if (ownerPath && ownerPath.endsWith(".index.yaml")) {
-            const ownerSubDir = path17.dirname(this.getSubsystemPath(owner.subsystem));
-            return path17.join(ownerSubDir, owner.id, comp.id);
+            const ownerSubDir = path19.dirname(this.getSubsystemPath(owner.subsystem));
+            return path19.join(ownerSubDir, owner.id, comp.id);
           }
         }
-        const subDir = path17.dirname(this.getSubsystemPath(comp.subsystem));
-        return path17.join(subDir, comp.id);
+        const subDir = path19.dirname(this.getSubsystemPath(comp.subsystem));
+        return path19.join(subDir, comp.id);
       }
       /**
        * Move component folders so the physical tree mirrors ownership: each owned
@@ -16555,7 +16734,7 @@ var init_specs2 = __esm({
           if (!currentPath) continue;
           const desiredDir = this.desiredComponentDir(comp, index);
           if (!desiredDir) continue;
-          if (moveComponentFolder(path17.dirname(currentPath), desiredDir)) moved.push(comp.id);
+          if (moveComponentFolder(path19.dirname(currentPath), desiredDir)) moved.push(comp.id);
         }
         if (moved.length) invalidateSpecCache();
         return moved;
@@ -16585,16 +16764,46 @@ var init_specs2 = __esm({
           return null;
         }
       }
+      /**
+       * Refuse a write that would land on a file already holding a DIFFERENT spec.
+       *
+       * In the nested layout a spec's path is derived from its parent — a component
+       * for an interface, a contract for an implementation — and the spec's own id
+       * is not part of it (see getInterfacePath / getImplementationPath, which take
+       * the id but ignore it once the parent resolves). So a second id bound to the
+       * same parent resolves to the SAME file.
+       *
+       * Left unguarded that is silent data loss, and doubly invisible: the caller's
+       * `existing` lookup is by the NEW id, finds nothing, and every re-author
+       * notice ("REMOVED …", the carry-forward seam) stays quiet. An agent renaming
+       * an interface by defining a new one destroys the old contract, its
+       * narratives and its lint.allows, and is told "Successfully defined".
+       */
+      assertPathHoldsNoOtherSpec(p, id, kind, parentLabel) {
+        if (!pathExists(p)) return;
+        let occupantId;
+        try {
+          occupantId = readYamlFile(p)?.id;
+        } catch {
+          return;
+        }
+        if (!occupantId) return;
+        if (occupantId === id || splitNamespace(occupantId).localId === splitNamespace(id).localId) return;
+        throw new Error(
+          `Cannot write ${kind} "${id}": ${parentLabel} is already ${kind === "interface" ? "served by" : "implemented by"} "${occupantId}" at ${path19.relative(this.rootDir, p)}, and both ids resolve to that one file. Re-author "${occupantId}" instead, or delete it first if you meant to replace it.`
+        );
+      }
       /** Returns non-fatal placement notices (see saveTypeSpec) — empty when there is nothing to clarify. */
       saveInterfaceSpec(spec, opts) {
         const notices = [];
         const p = this.getInterfacePath(spec.id, spec.component);
-        ensureDir(path17.dirname(p));
+        this.assertPathHoldsNoOtherSpec(p, spec.id, "interface", `component "${spec.component}"`);
+        ensureDir(path19.dirname(p));
         const specToWrite = this.prepareInterfaceForWrite(spec);
         const existing = this.loadInterfaceSpec(spec.id);
         if (existing && existing.component !== spec.component && splitNamespace(existing.component).localId !== splitNamespace(spec.component).localId) {
           notices.push(
-            `interface "${spec.id}" already exists at ${path17.relative(this.rootDir, p)} \u2014 re-saving updates the component binding field in place (now "${spec.component}", was "${existing.component}") and never moves the file.`
+            `interface "${spec.id}" already exists at ${path19.relative(this.rootDir, p)} \u2014 re-saving updates the component binding field in place (now "${spec.component}", was "${existing.component}") and never moves the file.`
           );
         }
         if (existing) {
@@ -16617,9 +16826,9 @@ var init_specs2 = __esm({
       }
       deleteInterfaceSpec(id) {
         const p = this.getInterfacePath(id);
-        if (!fs13.existsSync(p)) return false;
-        fs13.unlinkSync(p);
-        cleanEmptyDirs(p, path17.resolve(this.paths.specsDir()));
+        if (!fs14.existsSync(p)) return false;
+        fs14.unlinkSync(p);
+        cleanEmptyDirs(p, path19.resolve(this.paths.specsDir()));
         invalidateSpecCache();
         return true;
       }
@@ -16652,12 +16861,13 @@ var init_specs2 = __esm({
       saveImplementationSpec(spec, opts) {
         const notices = [];
         const p = this.getImplementationPath(spec.id, spec.contract);
-        ensureDir(path17.dirname(p));
+        this.assertPathHoldsNoOtherSpec(p, spec.id, "implementation", `contract "${spec.contract}"`);
+        ensureDir(path19.dirname(p));
         const specToWrite = this.prepareImplementationForWrite(spec);
         const existing = this.loadImplementationSpec(spec.id);
         if (existing && existing.contract !== spec.contract && splitNamespace(existing.contract).localId !== splitNamespace(spec.contract).localId) {
           notices.push(
-            `implementation "${spec.id}" already exists at ${path17.relative(this.rootDir, p)} \u2014 re-saving updates the contract binding field in place (now "${spec.contract}", was "${existing.contract}") and never moves the file.`
+            `implementation "${spec.id}" already exists at ${path19.relative(this.rootDir, p)} \u2014 re-saving updates the contract binding field in place (now "${spec.contract}", was "${existing.contract}") and never moves the file.`
           );
         }
         if (existing) {
@@ -16673,9 +16883,9 @@ var init_specs2 = __esm({
       }
       deleteImplementationSpec(id) {
         const p = this.getImplementationPath(id);
-        if (!fs13.existsSync(p)) return false;
-        fs13.unlinkSync(p);
-        cleanEmptyDirs(p, path17.resolve(this.paths.specsDir()));
+        if (!fs14.existsSync(p)) return false;
+        fs14.unlinkSync(p);
+        cleanEmptyDirs(p, path19.resolve(this.paths.specsDir()));
         invalidateSpecCache();
         return true;
       }
@@ -16700,11 +16910,11 @@ var init_specs2 = __esm({
         const existing = this.loadTypeSpec(spec.id);
         const group = spec.group || (existing ? existing.group : void 0);
         const p = this.getTypePath(spec.id, spec.subsystem, group);
-        ensureDir(path17.dirname(p));
+        ensureDir(path19.dirname(p));
         const subsystemChanged = existing && (existing.subsystem ?? "") !== (spec.subsystem ?? "") && splitNamespace(existing.subsystem ?? "").localId !== splitNamespace(spec.subsystem ?? "").localId;
         if (subsystemChanged) {
           notices.push(
-            `type "${spec.id}" already exists at ${path17.relative(this.rootDir, p)} \u2014 re-saving updates fields in place and never relocates the file. The subsystem field is now "${spec.subsystem ?? "(none)"}" (was "${existing.subsystem ?? "(none)"}").`
+            `type "${spec.id}" already exists at ${path19.relative(this.rootDir, p)} \u2014 re-saving updates fields in place and never relocates the file. The subsystem field is now "${spec.subsystem ?? "(none)"}" (was "${existing.subsystem ?? "(none)"}").`
           );
         }
         if (spec.subsystem && (!existing || subsystemChanged) && !this.getSubsystemPath(spec.subsystem).endsWith(".index.yaml")) {
@@ -16727,9 +16937,9 @@ var init_specs2 = __esm({
       deleteTypeSpec(id) {
         const spec = this.loadTypeSpec(id);
         const p = this.getTypePath(id, spec?.subsystem, spec?.group);
-        if (!fs13.existsSync(p)) return false;
-        fs13.unlinkSync(p);
-        cleanEmptyDirs(p, path17.resolve(this.paths.specsDir()));
+        if (!fs14.existsSync(p)) return false;
+        fs14.unlinkSync(p);
+        cleanEmptyDirs(p, path19.resolve(this.paths.specsDir()));
         invalidateSpecCache();
         return true;
       }
@@ -16744,7 +16954,7 @@ var init_specs2 = __esm({
       }
       saveGroupSpec(spec) {
         const p = this.getGroupPath(spec.id);
-        ensureDir(path17.dirname(p));
+        ensureDir(path19.dirname(p));
         const specToWrite = this.prepareGroupForWrite(spec);
         const existing = this.loadGroupSpec(spec.id);
         if (existing) {
@@ -16756,9 +16966,9 @@ var init_specs2 = __esm({
       }
       deleteGroupSpec(id) {
         const p = this.getGroupPath(id);
-        if (!fs13.existsSync(p)) return false;
-        fs13.unlinkSync(p);
-        cleanEmptyDirs(p, path17.resolve(this.paths.specsDir()));
+        if (!fs14.existsSync(p)) return false;
+        fs14.unlinkSync(p);
+        cleanEmptyDirs(p, path19.resolve(this.paths.specsDir()));
         invalidateSpecCache();
         return true;
       }
@@ -16806,6 +17016,50 @@ var init_specs2 = __esm({
         }
         return out;
       }
+      /**
+       * Every spec FILE inside a subsystem scope (absolute paths), regardless of
+       * status. `collectPromotableSpecs` answers a different question — which specs
+       * are not yet complete — so it cannot stand in for this: a scoped approval
+       * must cover the specs it approves whether or not they were already settled.
+       */
+      specPathsInScope(scopeSubsystem) {
+        const index = this.scanAll();
+        const components = this.loadComponentSpecs();
+        const interfaces = this.loadInterfaceSpecs();
+        const implementations = this.loadImplementationSpecs();
+        const inScope = (specSubsystem) => {
+          if (!scopeSubsystem) return true;
+          if (!specSubsystem) return false;
+          return specSubsystem === scopeSubsystem || specSubsystem.startsWith(`${scopeSubsystem}::`);
+        };
+        const out = /* @__PURE__ */ new Set();
+        const add = (p) => {
+          if (p) out.add(path19.resolve(p));
+        };
+        for (const s of this.loadSubsystemSpecs()) {
+          if (!scopeSubsystem || s.id === scopeSubsystem || s.id.startsWith(`${scopeSubsystem}::`)) {
+            add(index.paths.subsystem[s.id]);
+          }
+        }
+        for (const c of components) {
+          if (inScope(c.subsystem)) add(index.paths.component[c.id]);
+        }
+        for (const i of interfaces) {
+          const comp = components.find((c) => c.id === i.component);
+          if (comp && inScope(comp.subsystem)) add(index.paths.interface[i.id]);
+        }
+        for (const m of implementations) {
+          const intf = interfaces.find((i) => i.id === m.contract);
+          const comp = intf ? components.find((c) => c.id === intf.component) : null;
+          if (comp && inScope(comp.subsystem)) add(index.paths.implementation[m.id]);
+        }
+        if (!scopeSubsystem) {
+          add(this.paths.specsSystem());
+          for (const p of Object.values(index.paths.type)) add(p);
+          for (const p of Object.values(index.paths.group)) add(p);
+        }
+        return [...out];
+      }
       /** Set a single spec's status (bumps updatedAt). Caller invalidates the cache. */
       applySpecStatus(kind, id, status2) {
         switch (kind) {
@@ -16843,16 +17097,16 @@ var init_specs2 = __esm({
         const files = /* @__PURE__ */ new Set();
         const sysPath = this.paths.specsSystem();
         if (pathExists(sysPath)) {
-          files.add(path17.resolve(sysPath));
+          files.add(path19.resolve(sysPath));
         }
         for (const group of Object.values(index.paths)) {
           for (const file of Object.values(group)) {
-            files.add(path17.resolve(file));
+            files.add(path19.resolve(file));
           }
         }
         for (const file of files) {
-          if (fs13.existsSync(file)) {
-            snapshot.set(file, fs13.readFileSync(file, "utf8"));
+          if (fs14.existsSync(file)) {
+            snapshot.set(file, fs14.readFileSync(file, "utf8"));
           }
         }
         return snapshot;
@@ -16866,20 +17120,20 @@ var init_specs2 = __esm({
         const files = listFilesRecursive(specsDir, ".yaml");
         const legacy = [];
         for (const f of files) {
-          const base = path17.basename(f);
-          const dir = path17.dirname(f);
+          const base = path19.basename(f);
+          const dir = path19.dirname(f);
           if (base === "system.yaml") {
-            legacy.push({ path: f, expected: path17.join(dir, ".index.yaml") });
+            legacy.push({ path: f, expected: path19.join(dir, ".index.yaml") });
           } else if (base === "subsystem.yaml") {
-            legacy.push({ path: f, expected: path17.join(dir, ".index.yaml") });
+            legacy.push({ path: f, expected: path19.join(dir, ".index.yaml") });
           } else if (base === "component.yaml") {
-            legacy.push({ path: f, expected: path17.join(dir, ".index.yaml") });
+            legacy.push({ path: f, expected: path19.join(dir, ".index.yaml") });
           } else if (base === "group.yaml") {
-            legacy.push({ path: f, expected: path17.join(dir, ".index.yaml") });
+            legacy.push({ path: f, expected: path19.join(dir, ".index.yaml") });
           } else if (base === "interface.yaml") {
-            legacy.push({ path: f, expected: path17.join(dir, ".interface.yaml") });
+            legacy.push({ path: f, expected: path19.join(dir, ".interface.yaml") });
           } else if (base === "implementation.yaml") {
-            legacy.push({ path: f, expected: path17.join(dir, ".implementation.yaml") });
+            legacy.push({ path: f, expected: path19.join(dir, ".implementation.yaml") });
           }
         }
         return legacy;
@@ -16946,6 +17200,35 @@ var init_specs2 = __esm({
           }
           return refs;
         };
+        const normalizeIdentity = (k) => String(k ?? "").toLowerCase().replace(/[_\-\s]/g, "");
+        const assertDeltaMarkers = (item, label) => {
+          if (!item || typeof item !== "object") return;
+          if ("remove" in item && typeof item.remove !== "boolean") {
+            throw new Error(
+              `Refusing to update ${label}: "remove" must be the boolean true, got ${JSON.stringify(item.remove)}. A non-boolean is ignored, which would leave the element in place while reporting success.`
+            );
+          }
+          if ("action" in item && item.action !== "add" && item.action !== "delete") {
+            throw new Error(
+              `Refusing to update ${label}: unknown action ${JSON.stringify(item.action)} \u2014 expected "add" or "delete". An unknown verb is ignored, which would leave the element in place while reporting success.`
+            );
+          }
+        };
+        const assertUnmatchedIsAnAddition = (deltaItem, key, existingKeys, label) => {
+          if (deltaItem?.remove === true || deltaItem?.action === "delete") {
+            throw new Error(
+              `Refusing to delete ${label} "${String(key)}": nothing with that identity exists. ` + (existingKeys.length ? `Present: ${existingKeys.map(String).join(", ")}.` : "The collection is empty.")
+            );
+          }
+          const near = existingKeys.find(
+            (k) => String(k) !== String(key) && normalizeIdentity(k) === normalizeIdentity(key)
+          );
+          if (near !== void 0) {
+            throw new Error(
+              `Refusing to add ${label} "${String(key)}": "${String(near)}" already exists and differs only in case or separators. Use the existing identity to edit it, or pick a name that is not a near-duplicate.`
+            );
+          }
+        };
         const mergeNarrative = (existingSteps, deltaSteps) => {
           let steps = [...existingSteps];
           const sortedDeltas = [...deltaSteps].sort((a, b) => a.stepNumber - b.stepNumber);
@@ -17014,6 +17297,7 @@ var init_specs2 = __esm({
         const mergeMethods = (existingMethods, deltaMethods) => {
           const merged = [...existingMethods];
           for (const deltaMethod of deltaMethods) {
+            assertDeltaMarkers(deltaMethod, `method "${deltaMethod?.name}"`);
             const idx = merged.findIndex((m) => m.name === deltaMethod.name);
             if (idx !== -1) {
               if (deltaMethod.remove === true || deltaMethod.action === "delete") {
@@ -17033,9 +17317,8 @@ var init_specs2 = __esm({
                 };
               }
             } else {
-              if (deltaMethod.remove !== true && deltaMethod.action !== "delete") {
-                merged.push(deltaMethod);
-              }
+              assertUnmatchedIsAnAddition(deltaMethod, deltaMethod.name, merged.map((m) => m.name), "method");
+              merged.push(deltaMethod);
             }
           }
           return merged;
@@ -17043,6 +17326,7 @@ var init_specs2 = __esm({
         const mergeNamedArray = (existing, delta2) => {
           const merged = [...existing];
           for (const deltaItem of delta2) {
+            assertDeltaMarkers(deltaItem, `entry "${deltaItem?.name}"`);
             const idx = merged.findIndex((item) => item.name === deltaItem.name);
             if (idx !== -1) {
               if (deltaItem.remove === true || deltaItem.action === "delete") {
@@ -17055,9 +17339,8 @@ var init_specs2 = __esm({
                 };
               }
             } else {
-              if (deltaItem.remove !== true && deltaItem.action !== "delete") {
-                merged.push(deltaItem);
-              }
+              assertUnmatchedIsAnAddition(deltaItem, deltaItem.name, merged.map((i) => i.name), "entry");
+              merged.push(deltaItem);
             }
           }
           return merged;
@@ -17065,6 +17348,7 @@ var init_specs2 = __esm({
         const mergeKeyedArray = (existing, delta2, keyOf) => {
           const merged = [...existing];
           for (const deltaItem of delta2) {
+            assertDeltaMarkers(deltaItem, `entry "${keyOf(deltaItem)}"`);
             const idx = merged.findIndex((item) => keyOf(item) === keyOf(deltaItem));
             if (idx !== -1) {
               if (deltaItem.remove === true || deltaItem.action === "delete") {
@@ -17072,7 +17356,8 @@ var init_specs2 = __esm({
               } else {
                 merged[idx] = { ...merged[idx], ...deltaItem };
               }
-            } else if (deltaItem.remove !== true && deltaItem.action !== "delete") {
+            } else {
+              assertUnmatchedIsAnAddition(deltaItem, keyOf(deltaItem), merged.map(keyOf), "entry");
               merged.push(deltaItem);
             }
           }
@@ -17081,6 +17366,8 @@ var init_specs2 = __esm({
         const mergePublicInterfaces = (existing, delta2) => {
           const merged = [...existing];
           for (const deltaItem of delta2) {
+            const piKey = (i) => `${i?.component}.${i?.interface}`;
+            assertDeltaMarkers(deltaItem, `publicInterface "${piKey(deltaItem)}"`);
             const idx = merged.findIndex((item) => item.component === deltaItem.component && item.interface === deltaItem.interface);
             if (idx !== -1) {
               if (deltaItem.remove === true || deltaItem.action === "delete") {
@@ -17092,9 +17379,8 @@ var init_specs2 = __esm({
                 };
               }
             } else {
-              if (deltaItem.remove !== true && deltaItem.action !== "delete") {
-                merged.push(deltaItem);
-              }
+              assertUnmatchedIsAnAddition(deltaItem, piKey(deltaItem), merged.map(piKey), "publicInterface");
+              merged.push(deltaItem);
             }
           }
           return merged;
@@ -17135,11 +17421,22 @@ var init_specs2 = __esm({
           for (const deltaItem of delta2) {
             const key = identityKeyOf(field, deltaItem);
             const idx = key === null ? -1 : merged.findIndex((item) => identityKeyOf(field, item) === key);
+            assertDeltaMarkers(deltaItem, `${field} entry "${String(key)}"`);
             const isDelete = deltaItem?.remove === true || deltaItem?.action === "delete";
             if (idx !== -1) {
               if (isDelete) merged.splice(idx, 1);
               else merged[idx] = { ...merged[idx], ...deltaItem };
-            } else if (!isDelete) {
+            } else {
+              if (key !== null) {
+                assertUnmatchedIsAnAddition(
+                  deltaItem,
+                  key,
+                  merged.map((i) => identityKeyOf(field, i)).filter((k) => k !== null),
+                  field
+                );
+              } else if (isDelete) {
+                throw new Error(`Refusing to delete a ${field} entry with no resolvable identity.`);
+              }
               merged.push(deltaItem);
             }
           }
@@ -17331,7 +17628,7 @@ function provisionProject(name) {
 function ensureProjectInitialized(fallbackName) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const paths = aiPathsAt(getProjectRoot());
-  const hasSystem = fs14.existsSync(paths.specsSystem());
+  const hasSystem = fs15.existsSync(paths.specsSystem());
   let name = fallbackName;
   if (hasSystem) {
     const existing = loadSystemSpec();
@@ -17339,7 +17636,7 @@ function ensureProjectInitialized(fallbackName) {
   }
   let wroteConfig = false;
   let wroteSystem = false;
-  if (!fs14.existsSync(paths.projectConfig())) {
+  if (!fs15.existsSync(paths.projectConfig())) {
     saveProjectConfig(defaultProjectConfig(name, now));
     wroteConfig = true;
   }
@@ -17368,11 +17665,11 @@ function promoteAllComplete() {
 function walkChainedSubprojects(projectRoot2, onChild) {
   const visited = /* @__PURE__ */ new Set();
   const walk = (dir) => {
-    const resolved = path18.resolve(dir);
+    const resolved = path20.resolve(dir);
     if (visited.has(resolved)) return;
     visited.add(resolved);
     const specsDir = aiPathsAt(dir).specsDir();
-    if (!fs14.existsSync(specsDir)) return;
+    if (!fs15.existsSync(specsDir)) return;
     for (const file of listFilesRecursive(specsDir, ".yaml")) {
       let raw;
       try {
@@ -17390,7 +17687,7 @@ function walkChainedSubprojects(projectRoot2, onChild) {
         continue;
       }
       const id = raw.id;
-      onChild(childDir, typeof id === "string" ? id : path18.basename(childDir));
+      onChild(childDir, typeof id === "string" ? id : path20.basename(childDir));
       walk(childDir);
     }
   };
@@ -17399,7 +17696,7 @@ function walkChainedSubprojects(projectRoot2, onChild) {
 function listDirectChainedSubprojects(projectRoot2) {
   const out = [];
   const specsDir = aiPathsAt(projectRoot2).specsDir();
-  if (!fs14.existsSync(specsDir)) return out;
+  if (!fs15.existsSync(specsDir)) return out;
   for (const file of listFilesRecursive(specsDir, ".yaml")) {
     let raw;
     try {
@@ -17417,12 +17714,12 @@ function listDirectChainedSubprojects(projectRoot2) {
       continue;
     }
     const id = raw.id;
-    out.push({ dir, subsystemId: typeof id === "string" ? id : path18.basename(dir) });
+    out.push({ dir, subsystemId: typeof id === "string" ? id : path20.basename(dir) });
   }
   return out;
 }
 function childHasSpecsButNoConfig(childDir) {
-  return fs14.existsSync(aiPathsAt(childDir).specsDir()) && !fs14.existsSync(aiPathsAt(childDir).projectConfig());
+  return fs15.existsSync(aiPathsAt(childDir).specsDir()) && !fs15.existsSync(aiPathsAt(childDir).projectConfig());
 }
 function findChainingSubprojectsMissingConfig(projectRoot2) {
   const missing = [];
@@ -17471,14 +17768,14 @@ function moveSubsystemProject(subsystemId, newProjectPath) {
   const oldDir = assertContainedProjectPath(root, sub.projectPath);
   const newDir = assertContainedProjectPath(root, nextPath);
   if (oldDir !== newDir) {
-    if (!fs14.existsSync(oldDir)) {
+    if (!fs15.existsSync(oldDir)) {
       throw new WaironError(`Subproject directory not found at its current path: ${oldDir}`);
     }
-    if (fs14.existsSync(newDir)) {
+    if (fs15.existsSync(newDir)) {
       throw new WaironError(`Target directory already exists: ${newDir}`);
     }
-    ensureDir(path18.dirname(newDir));
-    fs14.renameSync(oldDir, newDir);
+    ensureDir(path20.dirname(newDir));
+    fs15.renameSync(oldDir, newDir);
   }
   saveSubsystemSpec({ ...sub, projectPath: nextPath, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
   invalidateSpecCache();
@@ -17487,9 +17784,9 @@ function toPosixPath(p) {
   return p.replace(/\\/g, "/");
 }
 function isWithinDir(dir, file) {
-  const d = path18.resolve(dir);
-  const f = path18.resolve(file);
-  return f === d || f.startsWith(d + path18.sep);
+  const d = path20.resolve(dir);
+  const f = path20.resolve(file);
+  return f === d || f.startsWith(d + path20.sep);
 }
 function externalizeSubsystem(subsystemId, projectPath) {
   if (subsystemId.includes("::")) {
@@ -17501,14 +17798,14 @@ function externalizeSubsystem(subsystemId, projectPath) {
   }
   const parentRoot = getProjectRoot();
   const parentSpecsDir = aiPathsAt(parentRoot).specsDir();
-  const fooDir = path18.join(parentSpecsDir, subsystemId);
-  if (!fs14.existsSync(fooDir)) {
+  const fooDir = path20.join(parentSpecsDir, subsystemId);
+  if (!fs15.existsSync(fooDir)) {
     throw new WaironError(`subsystem specs directory not found: ${fooDir}`);
   }
   const relPath = toPosixPath(projectPath);
   const childDir = assertContainedProjectPath(parentRoot, relPath);
-  const childFooDir = path18.join(childDir, ".wai", "specs", subsystemId);
-  if (fs14.existsSync(childFooDir)) {
+  const childFooDir = path20.join(childDir, ".wai", "specs", subsystemId);
+  if (fs15.existsSync(childFooDir)) {
     throw new WaironError(`target already contains a "${subsystemId}" subsystem: ${childFooDir}`);
   }
   const renameMap = buildRenameMap(
@@ -17518,17 +17815,17 @@ function externalizeSubsystem(subsystemId, projectPath) {
   );
   const childSystemName = foo.name || subsystemId;
   runWithProjectRoot(childDir, () => {
-    ensureDir(path18.join(childDir, ".wai", "specs"));
+    ensureDir(path20.join(childDir, ".wai", "specs"));
     provisionProject(childSystemName);
   });
-  ensureDir(path18.dirname(childFooDir));
-  fs14.renameSync(fooDir, childFooDir);
-  patchSubsystemIndex(path18.join(childFooDir, ".index.yaml"), (s) => {
+  ensureDir(path20.dirname(childFooDir));
+  fs15.renameSync(fooDir, childFooDir);
+  patchSubsystemIndex(path20.join(childFooDir, ".index.yaml"), (s) => {
     s.parentSystem = childSystemName;
     delete s.projectPath;
   });
   ensureDir(fooDir);
-  writeYamlFile(path18.join(fooDir, ".index.yaml"), {
+  writeYamlFile(path20.join(fooDir, ".index.yaml"), {
     id: subsystemId,
     name: foo.name,
     description: foo.description,
@@ -17554,9 +17851,9 @@ function internalizeSubsystem(subsystemId) {
   const parentRoot = getProjectRoot();
   const parentSpecsDir = aiPathsAt(parentRoot).specsDir();
   const childDir = assertContainedProjectPath(parentRoot, foo.projectPath);
-  const childWai = path18.join(childDir, ".wai");
-  const childFooDir = path18.join(childDir, ".wai", "specs", subsystemId);
-  if (!fs14.existsSync(childFooDir)) {
+  const childWai = path20.join(childDir, ".wai");
+  const childFooDir = path20.join(childDir, ".wai", "specs", subsystemId);
+  if (!fs15.existsSync(childFooDir)) {
     throw new WaironError(`external subproject missing subsystem "${subsystemId}": ${childFooDir}`);
   }
   const childOwnSubs = runWithProjectRoot(childDir, () => loadSubsystemSpecs()).filter((s) => !s.id.includes("::"));
@@ -17569,15 +17866,15 @@ function internalizeSubsystem(subsystemId) {
     false
   );
   const parentSystemName = loadSystemSpec()?.name ?? foo.parentSystem;
-  const fooDir = path18.join(parentSpecsDir, subsystemId);
-  fs14.rmSync(fooDir, { recursive: true, force: true });
-  ensureDir(path18.dirname(fooDir));
-  fs14.renameSync(childFooDir, fooDir);
-  patchSubsystemIndex(path18.join(fooDir, ".index.yaml"), (s) => {
+  const fooDir = path20.join(parentSpecsDir, subsystemId);
+  fs15.rmSync(fooDir, { recursive: true, force: true });
+  ensureDir(path20.dirname(fooDir));
+  fs15.renameSync(childFooDir, fooDir);
+  patchSubsystemIndex(path20.join(fooDir, ".index.yaml"), (s) => {
     s.parentSystem = parentSystemName;
     delete s.projectPath;
   });
-  fs14.rmSync(childWai, { recursive: true, force: true });
+  fs15.rmSync(childWai, { recursive: true, force: true });
   rewriteRefsInDir(parentSpecsDir, renameMap, fooDir);
   invalidateSpecCache();
 }
@@ -17674,18 +17971,18 @@ function rewriteRefsInDir(specsDir, renameMap, excludeDir) {
   }
 }
 function patchSubsystemIndex(indexPath, mutate) {
-  if (!fs14.existsSync(indexPath)) return;
+  if (!fs15.existsSync(indexPath)) return;
   const raw = readYamlFile(indexPath);
   mutate(raw);
   raw.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   writeYamlFile(indexPath, raw);
 }
-var fs14, path18;
+var fs15, path20;
 var init_provision = __esm({
   "src/core/provision.ts"() {
     "use strict";
-    fs14 = __toESM(require("fs"));
-    path18 = __toESM(require("path"));
+    fs15 = __toESM(require("fs"));
+    path20 = __toESM(require("path"));
     init_specs2();
     init_loader();
     init_fs();
@@ -17726,18 +18023,18 @@ __export(ai_guide_exports, {
   writeRootGuideDelegator: () => writeRootGuideDelegator
 });
 function globalGuideFilePath(targetType) {
-  if (targetType === "claude") return path19.join(process.env["CLAUDE_CONFIG_DIR"] || path19.join(os5.homedir(), ".claude"), "CLAUDE.md");
-  if (targetType === "gemini") return path19.join(process.env["GEMINI_CONFIG_DIR"] || path19.join(os5.homedir(), ".gemini"), "GEMINI.md");
+  if (targetType === "claude") return path21.join(process.env["CLAUDE_CONFIG_DIR"] || path21.join(os6.homedir(), ".claude"), "CLAUDE.md");
+  if (targetType === "gemini") return path21.join(process.env["GEMINI_CONFIG_DIR"] || path21.join(os6.homedir(), ".gemini"), "GEMINI.md");
   return null;
 }
 function localGuideFilePath(projectRoot2, targetType) {
-  if (targetType === "claude") return path19.join(projectRoot2, ".claude", "CLAUDE.md");
-  if (targetType === "gemini" || targetType === "agy") return path19.join(projectRoot2, ".gemini", "GEMINI.md");
+  if (targetType === "claude") return path21.join(projectRoot2, ".claude", "CLAUDE.md");
+  if (targetType === "gemini" || targetType === "agy") return path21.join(projectRoot2, ".gemini", "GEMINI.md");
   return null;
 }
 function hasWaironGuide(filePath) {
-  if (!fs15.existsSync(filePath)) return false;
-  return fs15.readFileSync(filePath, "utf-8").includes(GUIDE_MARKER_START);
+  if (!fs16.existsSync(filePath)) return false;
+  return fs16.readFileSync(filePath, "utf-8").includes(GUIDE_MARKER_START);
 }
 function injectGuide(filePath, scope) {
   const body = scope === "global" ? GLOBAL_GUIDE_BODY : LOCAL_GUIDE_BODY;
@@ -17748,11 +18045,11 @@ ${versionStamp()}
 ${body}
 ${GUIDE_MARKER_END}
 `;
-  const existing = fs15.existsSync(filePath) ? fs15.readFileSync(filePath, "utf-8") : "";
+  const existing = fs16.existsSync(filePath) ? fs16.readFileSync(filePath, "utf-8") : "";
   const stripped = stripGuideSection(existing);
   const newContent = stripped.trimEnd() + section;
-  fs15.mkdirSync(path19.dirname(filePath), { recursive: true });
-  fs15.writeFileSync(filePath, newContent, "utf-8");
+  fs16.mkdirSync(path21.dirname(filePath), { recursive: true });
+  fs16.writeFileSync(filePath, newContent, "utf-8");
 }
 function stripGuideSection(content) {
   const start = content.indexOf(GUIDE_MARKER_START);
@@ -17762,7 +18059,7 @@ function stripGuideSection(content) {
 }
 function writeRootGuideDelegator(projectRoot2, targetType) {
   if (targetType === "claude") {
-    const filePath = path19.join(projectRoot2, "CLAUDE.md");
+    const filePath = path21.join(projectRoot2, "CLAUDE.md");
     const content = `@.claude/CLAUDE.md
 
 # Wairon SDD Project
@@ -17775,42 +18072,42 @@ To design or modify the system, invoke the **\`sdd-architect\`** skill
 (in \`.claude/skills/\`). Author and validate specs with the \`sdd_*\` MCP tools;
 the \`wairon\` CLI is the human developer's tool, not yours.
 `;
-    fs15.writeFileSync(filePath, content, "utf-8");
+    fs16.writeFileSync(filePath, content, "utf-8");
   } else if (targetType === "gemini" || targetType === "agy") {
-    const filePath = path19.join(projectRoot2, "GEMINI.md");
+    const filePath = path21.join(projectRoot2, "GEMINI.md");
     const content = `# Wairon SDD Project
 ${GUIDE_MARKER_START}
 ${versionStamp()}
 ${LOCAL_GUIDE_BODY}
 ${GUIDE_MARKER_END}
 `;
-    fs15.writeFileSync(filePath, content, "utf-8");
+    fs16.writeFileSync(filePath, content, "utf-8");
   } else if (targetType === "cursor") {
-    const filePath = path19.join(projectRoot2, ".cursorrules");
+    const filePath = path21.join(projectRoot2, ".cursorrules");
     const content = `# Wairon SDD Project
 
 This project uses the Wairon Spec-Driven Development (SDD) framework.
 
 Refer to the rules in [.cursor/rules/](.cursor/rules/) for full instructions.
 `;
-    fs15.writeFileSync(filePath, content, "utf-8");
+    fs16.writeFileSync(filePath, content, "utf-8");
   } else if (targetType === "copilot") {
-    const filePath = path19.join(projectRoot2, ".github", "copilot-instructions.md");
-    fs15.mkdirSync(path19.dirname(filePath), { recursive: true });
+    const filePath = path21.join(projectRoot2, ".github", "copilot-instructions.md");
+    fs16.mkdirSync(path21.dirname(filePath), { recursive: true });
     const content = `# Wairon SDD Project
 
 This project uses the Wairon Spec-Driven Development (SDD) framework.
 
 Refer to the prompts in [.github/prompts/](.github/prompts/) for instructions.
 `;
-    fs15.writeFileSync(filePath, content, "utf-8");
+    fs16.writeFileSync(filePath, content, "utf-8");
   } else if (targetType === "codex") {
-    const filePath = path19.join(projectRoot2, ".codexrules");
+    const filePath = path21.join(projectRoot2, ".codexrules");
     const content = `# Wairon SDD Project
 
 Refer to [.codex/agents/](.codex/agents/) for full instructions.
 `;
-    fs15.writeFileSync(filePath, content, "utf-8");
+    fs16.writeFileSync(filePath, content, "utf-8");
   }
 }
 function reinjectLocalGuides(projectRoot2, targetTypes) {
@@ -17826,13 +18123,13 @@ function reinjectLocalGuides(projectRoot2, targetTypes) {
   }
   return written;
 }
-var fs15, os5, path19, GUIDE_MARKER_START, GUIDE_MARKER_END, GLOBAL_GUIDE_BODY, LOCAL_GUIDE_BODY, GUIDE_TARGETS;
+var fs16, os6, path21, GUIDE_MARKER_START, GUIDE_MARKER_END, GLOBAL_GUIDE_BODY, LOCAL_GUIDE_BODY, GUIDE_TARGETS;
 var init_ai_guide = __esm({
   "src/utils/ai-guide.ts"() {
     "use strict";
-    fs15 = __toESM(require("fs"));
-    os5 = __toESM(require("os"));
-    path19 = __toESM(require("path"));
+    fs16 = __toESM(require("fs"));
+    os6 = __toESM(require("os"));
+    path21 = __toESM(require("path"));
     init_stamp();
     GUIDE_MARKER_START = "<!-- wairon-guide-start -->";
     GUIDE_MARKER_END = "<!-- wairon-guide-end -->";
@@ -17894,7 +18191,7 @@ __export(domains_exports, {
   resolveDomains: () => resolveDomains
 });
 function rel(p) {
-  return path24.relative(process.cwd(), p).replace(/\\/g, "/");
+  return path26.relative(process.cwd(), p).replace(/\\/g, "/");
 }
 function deriveSubsystemDomains() {
   const subsystems = loadSubsystemSpecs();
@@ -17944,11 +18241,11 @@ function removeFreeStandingDomain(id) {
   config.domains.splice(idx, 1);
   saveTopologyConfig(config);
 }
-var path24;
+var path26;
 var init_domains = __esm({
   "src/core/domains.ts"() {
     "use strict";
-    path24 = __toESM(require("path"));
+    path26 = __toESM(require("path"));
     init_loader();
     init_specs2();
     init_errors();
@@ -18104,16 +18401,16 @@ function packNamespace(pack) {
   return pack.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function extensionsFor(builtin, packSkills) {
-  return packSkills.filter((s) => s.extends === builtin && fs17.existsSync(s.sourcePath));
+  return packSkills.filter((s) => s.extends === builtin && fs18.existsSync(s.sourcePath));
 }
 function composeBuiltinSkill(name, packSkills) {
   const srcPath = skillTemplatePath(name);
-  const base = fs17.existsSync(srcPath) ? fs17.readFileSync(srcPath, "utf-8") : "";
+  const base = fs18.existsSync(srcPath) ? fs18.readFileSync(srcPath, "utf-8") : "";
   const sections = extensionsFor(name, packSkills);
   if (sections.length === 0) return base;
   const parts = [base.trimEnd()];
   for (const section of sections) {
-    const body = fs17.readFileSync(section.sourcePath, "utf-8").replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, "");
+    const body = fs18.readFileSync(section.sourcePath, "utf-8").replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, "");
     parts.push(`## Platform: ${section.pack}`, body.trim());
   }
   return `${parts.join("\n\n")}
@@ -18129,16 +18426,16 @@ function readFrontmatter(raw, fallbackName) {
   return { name: field("name") || fallbackName, description: field("description") };
 }
 function builtinSkillsDir() {
-  return path25.resolve(__dirname, "..", "templates", "skills");
+  return path27.resolve(__dirname, "..", "templates", "skills");
 }
 function skillTemplatePath(name) {
-  return path25.join(builtinSkillsDir(), `${name}.md`);
+  return path27.join(builtinSkillsDir(), `${name}.md`);
 }
 function skillDestPath(type, destDir, name) {
   if (type === "claude" || type === "codex" || type === "gemini" || type === "agy") {
-    return path25.join(destDir, name, "SKILL.md");
+    return path27.join(destDir, name, "SKILL.md");
   }
-  return path25.join(destDir, `${name}.md`);
+  return path27.join(destDir, `${name}.md`);
 }
 function skillsDirForTarget(type) {
   switch (type) {
@@ -18173,22 +18470,22 @@ function exportSddSkills(targetTypes) {
     ensureDir(destDir);
     destinations.push(destDir);
     for (const name of SKILL_NAMES) {
-      if (!fs17.existsSync(skillTemplatePath(name))) continue;
+      if (!fs18.existsSync(skillTemplatePath(name))) continue;
       const content = composeBuiltinSkill(name, packSkills.filter((s) => s.targets.includes(type)));
       const destPath = skillDestPath(type, destDir, name);
-      ensureDir(path25.dirname(destPath));
-      fs17.writeFileSync(destPath, content, "utf-8");
+      ensureDir(path27.dirname(destPath));
+      fs18.writeFileSync(destPath, content, "utf-8");
       fileCount++;
     }
     for (const skill of packSkills) {
       if (skill.extends !== void 0) continue;
       if (!skill.targets.includes(type)) continue;
-      if (!fs17.existsSync(skill.sourcePath)) continue;
+      if (!fs18.existsSync(skill.sourcePath)) continue;
       const id = packSkillId(skill);
-      const content = fs17.readFileSync(skill.sourcePath, "utf-8");
+      const content = fs18.readFileSync(skill.sourcePath, "utf-8");
       const destPath = skillDestPath(type, destDir, id);
-      ensureDir(path25.dirname(destPath));
-      fs17.writeFileSync(destPath, content, "utf-8");
+      ensureDir(path27.dirname(destPath));
+      fs18.writeFileSync(destPath, content, "utf-8");
       fileCount++;
     }
   }
@@ -18201,12 +18498,12 @@ function checkSkillFreshness(type) {
   const packSkills = loadProjectExtensions2().skills.filter((s) => s.targets.includes(type));
   for (const name of SKILL_NAMES) {
     const destPath = skillDestPath(type, dir, name);
-    if (!fs17.existsSync(destPath)) {
+    if (!fs18.existsSync(destPath)) {
       result.missing.push(name);
       continue;
     }
     const want = composeBuiltinSkill(name, packSkills);
-    const have = fs17.readFileSync(destPath, "utf-8");
+    const have = fs18.readFileSync(destPath, "utf-8");
     if (have === want) result.ok.push(name);
     else result.stale.push(name);
   }
@@ -18218,7 +18515,7 @@ function activeTargetTypes() {
   return config.targets.filter((t) => !("enabled" in t) || t.enabled).map((t) => typeof t === "string" ? t : t.type);
 }
 function readSkillFrontmatter(name) {
-  return readFrontmatter(fs17.readFileSync(skillTemplatePath(name), "utf-8"), name);
+  return readFrontmatter(fs18.readFileSync(skillTemplatePath(name), "utf-8"), name);
 }
 function listSkillResources() {
   const builtin = RESOURCE_SKILL_IDS.map((id) => {
@@ -18232,9 +18529,9 @@ function listSkillResources() {
       defaultForHostedMcp: true
     };
   });
-  const pack = loadProjectExtensions2().skills.filter((s) => s.extends === void 0 && fs17.existsSync(s.sourcePath)).map((skill) => {
+  const pack = loadProjectExtensions2().skills.filter((s) => s.extends === void 0 && fs18.existsSync(s.sourcePath)).map((skill) => {
     const id = packSkillId(skill);
-    const fm = readFrontmatter(fs17.readFileSync(skill.sourcePath, "utf-8"), id);
+    const fm = readFrontmatter(fs18.readFileSync(skill.sourcePath, "utf-8"), id);
     return {
       id,
       name: fm.name,
@@ -18250,8 +18547,8 @@ function readSkillResource(resourceId) {
   const packSkills = loadProjectExtensions2().skills;
   if (SKILL_NAMES.includes(resourceId)) return composeBuiltinSkill(resourceId, packSkills);
   const packSkill = packSkills.find((s) => s.extends === void 0 && packSkillId(s) === resourceId);
-  if (packSkill) return fs17.readFileSync(packSkill.sourcePath, "utf-8");
-  return fs17.readFileSync(skillTemplatePath(resourceId), "utf-8");
+  if (packSkill) return fs18.readFileSync(packSkill.sourcePath, "utf-8");
+  return fs18.readFileSync(skillTemplatePath(resourceId), "utf-8");
 }
 function listResources() {
   return listSkillResources();
@@ -18264,12 +18561,12 @@ function readResource(resourceId) {
   if (!known) throw new SkillResourceNotFoundError(resourceId);
   return readSkillResource(resourceId);
 }
-var path25, fs17, SKILL_NAMES, SKILL_RESOURCE_SCHEME, RESOURCE_SKILL_IDS, SkillResourceNotFoundError;
+var path27, fs18, SKILL_NAMES, SKILL_RESOURCE_SCHEME, RESOURCE_SKILL_IDS, SkillResourceNotFoundError;
 var init_skills = __esm({
   "src/core/skills.ts"() {
     "use strict";
-    path25 = __toESM(require("path"));
-    fs17 = __toESM(require("fs"));
+    path27 = __toESM(require("path"));
+    fs18 = __toESM(require("fs"));
     init_fs();
     init_defaults();
     init_extensions();
@@ -18496,23 +18793,34 @@ async function runStatus(options = {}) {
   const lock = lockLine().trim();
   if (lock) {
     logger.blank();
-    if (lock.includes("STALE")) logger.warn(lock);
+    if (lock.includes("changed since approval")) logger.warn(lock);
     else logger.info(lock);
   }
   logger.blank();
 }
 function lockLine() {
   try {
-    const { state, record: record2 } = readLockState();
-    if (state === "unlocked") return "";
-    if (state === "locked") {
+    const baseline = readBaseline();
+    if (!baseline) return "";
+    const moved = movedChildren(loadSubsystemSpecs());
+    const childNote = moved.length ? `
+${moved.length} chained child project(s) moved since approval: ${moved.map((m) => m.id).join(", ")}.` : "";
+    const diff = diffAgainstBaseline();
+    if (!diff || diffSize(diff) === 0) {
       return `
-Lock: FROZEN at ${record2.lockedAt} by ${record2.lockedBy} (wairon ${record2.validatorVersion}).
+Approved: ${baseline.approvedAt} by ${baseline.approvedBy} \u2014 no spec has changed since.${childNote}
 `;
     }
+    const parts = [];
+    if (diff.changed.length) parts.push(`${diff.changed.length} changed`);
+    if (diff.added.length) parts.push(`${diff.added.length} added`);
+    if (diff.removed.length) parts.push(`${diff.removed.length} removed`);
+    const named = [...diff.changed, ...diff.added, ...diff.removed].slice(0, 5);
+    const rest = diffSize(diff) - named.length;
     return `
-Lock: STALE \u2014 the specs or the governing doctrine changed since ${record2.lockedAt}, so this lock no longer holds and promotion will refuse it. Re-run \`wairon lock\` to freeze the current state.
-`;
+${diffSize(diff)} spec(s) changed since approval (${parts.join(", ")}) \u2014 approved ${baseline.approvedAt} by ${baseline.approvedBy}:
+` + named.map((p) => `  ${p}`).join("\n") + (rest > 0 ? `
+  \u2026 and ${rest} more` : "") + childNote + "\n";
   } catch {
     return "";
   }
@@ -18639,6 +18947,7 @@ var init_status = __esm({
     init_loader();
     init_fs();
     init_specs2();
+    init_baseline();
   }
 });
 
@@ -18687,7 +18996,7 @@ function errText(message) {
 }
 function captureBuildStamp(entryPath) {
   try {
-    const s = fs18.statSync(entryPath);
+    const s = fs19.statSync(entryPath);
     return { path: entryPath, mtimeMs: s.mtimeMs, size: s.size };
   } catch {
     return null;
@@ -18696,7 +19005,7 @@ function captureBuildStamp(entryPath) {
 function isBuildStale(stamp) {
   if (!stamp) return false;
   try {
-    const s = fs18.statSync(stamp.path);
+    const s = fs19.statSync(stamp.path);
     return s.mtimeMs !== stamp.mtimeMs || s.size !== stamp.size;
   } catch {
     return false;
@@ -19914,10 +20223,6 @@ NOTICE:
       description: "Hosted project lifecycle (execute-primary): LOCK the bound project (validate-as-complete gate + commit-scoped lock record). Executes directly when your resolved permission is yes and returns the completed outcome; when it is approval, a pending approval request is created instead (await it with sdd_host_await_approval).",
       inputSchema: {}
     }, hostedStub);
-    reg(server, "sdd_host_promote_project", {
-      description: "Hosted project lifecycle (execute-primary): PROMOTE the bound, locked project after a StateId re-check. Executes directly when your resolved permission is yes; when it is approval, a pending approval request is created instead.",
-      inputSchema: {}
-    }, hostedStub);
     reg(server, "sdd_host_initialize_project", {
       description: "Hosted project lifecycle (execute-primary): initialize a new hosted project into its REQUIRED owner organization unit (with an optional profile selection). Executes directly when your resolved permission is yes; when it is approval, a pending approval request is created instead.",
       inputSchema: {
@@ -20003,7 +20308,7 @@ async function scopeToClientWorkspace(server) {
     } catch {
       dir = null;
     }
-    if (dir && (fs18.existsSync(path27.join(dir, ".wai")) || fs18.existsSync(path27.join(dir, ".wairon")))) {
+    if (dir && (fs19.existsSync(path29.join(dir, ".wai")) || fs19.existsSync(path29.join(dir, ".wairon")))) {
       setProjectRoot(dir);
       process.stderr.write(`[wairon mcp] scoped to client workspace root: ${dir}
 `);
@@ -20027,7 +20332,7 @@ async function startMcpServer() {
   } catch {
   }
 }
-var import_mcp, import_stdio, import_zod9, import_types3, fs18, path27, import_url, SERVER_BUILD_STAMP, STALE_SERVER_WARNING, SPEC_WRITE_TOOLS, listChangedEmitters, STORE_MANAGED_FIELDS, ALWAYS_CARRIED_FIELDS, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
+var import_mcp, import_stdio, import_zod9, import_types3, fs19, path29, import_url, SERVER_BUILD_STAMP, STALE_SERVER_WARNING, SPEC_WRITE_TOOLS, listChangedEmitters, STORE_MANAGED_FIELDS, ALWAYS_CARRIED_FIELDS, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
 var init_server = __esm({
   "src/mcp/server.ts"() {
     "use strict";
@@ -20035,8 +20340,8 @@ var init_server = __esm({
     import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
     import_zod9 = require("zod");
     import_types3 = require("@modelcontextprotocol/sdk/types.js");
-    fs18 = __toESM(require("fs"));
-    path27 = __toESM(require("path"));
+    fs19 = __toESM(require("fs"));
+    path29 = __toESM(require("path"));
     import_url = require("url");
     init_fs();
     init_defaults();
@@ -20087,34 +20392,34 @@ __export(mcp_exports, {
   validateConfigDir: () => validateConfigDir
 });
 function geminiGlobalDir(override) {
-  return override || process.env["GEMINI_CONFIG_DIR"] || path28.join(os6.homedir(), ".gemini");
+  return override || process.env["GEMINI_CONFIG_DIR"] || path30.join(os7.homedir(), ".gemini");
 }
 function claudeMcpConfigPath(useGlobal, override) {
-  if (!useGlobal) return path28.join(process.cwd(), ".mcp.json");
+  if (!useGlobal) return path30.join(process.cwd(), ".mcp.json");
   const dir = override || process.env["CLAUDE_CONFIG_DIR"];
-  return dir ? path28.join(dir, ".claude.json") : path28.join(os6.homedir(), ".claude.json");
+  return dir ? path30.join(dir, ".claude.json") : path30.join(os7.homedir(), ".claude.json");
 }
 function validateConfigDir(dir, backend) {
-  const resolved = path28.resolve(dir);
+  const resolved = path30.resolve(dir);
   const agent = backend === "claude" ? "Claude" : "Gemini/Antigravity";
-  if (!fs19.existsSync(resolved)) {
-    const parent = path28.dirname(resolved);
-    if (!fs19.existsSync(parent)) {
+  if (!fs20.existsSync(resolved)) {
+    const parent = path30.dirname(resolved);
+    if (!fs20.existsSync(parent)) {
       throw new WaironError(`--config-dir "${dir}" does not exist and its parent is missing \u2014 check the path.`);
     }
     logger.warn(`Config dir "${resolved}" does not exist yet; it will be created.`);
     return;
   }
-  if (!fs19.statSync(resolved).isDirectory()) {
+  if (!fs20.statSync(resolved).isDirectory()) {
     throw new WaironError(`--config-dir "${dir}" is not a directory.`);
   }
   const markers = backend === "claude" ? ["settings.json", "settings.local.json", ".credentials.json", "projects", "statsig", "todos", "shell-snapshots", "CLAUDE.md"] : ["settings.json", "GEMINI.md", "oauth_creds.json", "antigravity-cli", "tmp"];
-  const entries = fs19.readdirSync(resolved);
+  const entries = fs20.readdirSync(resolved);
   if (entries.length === 0) {
     logger.warn(`Config dir "${resolved}" is empty; proceeding (treating it as a fresh ${agent} config dir).`);
     return;
   }
-  if (!markers.some((m) => fs19.existsSync(path28.join(resolved, m)))) {
+  if (!markers.some((m) => fs20.existsSync(path30.join(resolved, m)))) {
     throw new WaironError(
       `"${dir}" does not look like a ${agent} config directory (none of ${markers.slice(0, 4).join(", ")} found). Point --config-dir at the agent's config directory.`
     );
@@ -20122,12 +20427,12 @@ function validateConfigDir(dir, backend) {
 }
 async function runMcpServe() {
   const { setProjectRoot: setProjectRoot2, getProjectRoot: getProjectRoot2, findProjectRoot: findProjectRoot2 } = await Promise.resolve().then(() => (init_fs(), fs_exports));
-  const cwd = path28.resolve(process.cwd());
+  const cwd = path30.resolve(process.cwd());
   const envDir = process.env["WAIRON_PROJECT_DIR"];
   let resolved;
   let how;
-  if (envDir && fs19.existsSync(path28.join(envDir, ".wai"))) {
-    resolved = path28.resolve(envDir);
+  if (envDir && fs20.existsSync(path30.join(envDir, ".wai"))) {
+    resolved = path30.resolve(envDir);
     how = "WAIRON_PROJECT_DIR (pinned at install)";
   } else {
     const found = findProjectRoot2(cwd);
@@ -20190,20 +20495,20 @@ async function runMcpInstall(options = {}) {
     let settingsPath;
     if (backend === "gemini") {
       if (useGlobal) {
-        configBase = path28.join(geminiGlobalDir(options.configDir), "antigravity-cli");
-        settingsPath = path28.join(configBase, "mcp_config.json");
+        configBase = path30.join(geminiGlobalDir(options.configDir), "antigravity-cli");
+        settingsPath = path30.join(configBase, "mcp_config.json");
       } else {
-        configBase = path28.join(process.cwd(), ".gemini");
-        settingsPath = path28.join(configBase, "settings.json");
+        configBase = path30.join(process.cwd(), ".gemini");
+        settingsPath = path30.join(configBase, "settings.json");
       }
     } else {
       settingsPath = claudeMcpConfigPath(useGlobal, options.configDir);
-      configBase = path28.dirname(settingsPath);
+      configBase = path30.dirname(settingsPath);
     }
     let settings = {};
-    if (fs19.existsSync(settingsPath)) {
+    if (fs20.existsSync(settingsPath)) {
       try {
-        settings = JSON.parse(fs19.readFileSync(settingsPath, "utf8"));
+        settings = JSON.parse(fs20.readFileSync(settingsPath, "utf8"));
       } catch {
         logger.warn(`Could not parse ${settingsPath} \u2014 starting fresh.`);
       }
@@ -20211,7 +20516,7 @@ async function runMcpInstall(options = {}) {
     const mcpServers = settings["mcpServers"] ?? {};
     const agentLabel = backend === "gemini" ? "Antigravity" : "Claude";
     const isPackaged = typeof process.pkg !== "undefined";
-    const scriptPath = process.argv[1] ? path28.resolve(process.argv[1]).replace(/\\/g, "/") : null;
+    const scriptPath = process.argv[1] ? path30.resolve(process.argv[1]).replace(/\\/g, "/") : null;
     const useDirectNode = !isPackaged && scriptPath && (scriptPath.endsWith(".js") || scriptPath.endsWith(".ts"));
     const env = useGlobal ? {} : { WAIRON_PROJECT_DIR: process.cwd().replace(/\\/g, "/") };
     const desiredEntry = useDirectNode ? { command: "node", args: [scriptPath, "mcp", "serve"], env } : { command: "wairon", args: ["mcp", "serve"], env };
@@ -20223,8 +20528,8 @@ async function runMcpInstall(options = {}) {
     const wasStale = !!existingEntry;
     mcpServers["wairon"] = desiredEntry;
     settings["mcpServers"] = mcpServers;
-    if (!fs19.existsSync(configBase)) fs19.mkdirSync(configBase, { recursive: true });
-    fs19.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    if (!fs20.existsSync(configBase)) fs20.mkdirSync(configBase, { recursive: true });
+    fs20.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
     logger.success(`wairon MCP server ${wasStale ? "updated (was stale)" : "registered"} for ${agentLabel} in ${import_chalk4.default.cyan(settingsPath)}.`);
     logger.blank();
     logger.info("AI tools using this config will have access to these wairon tools:");
@@ -20249,8 +20554,8 @@ async function runMcpStatus() {
   const projectConfig = loadProjectConfig();
   const claudeProject = claudeMcpConfigPath(false);
   const claudeGlobal = claudeMcpConfigPath(true);
-  const geminiProject = path28.join(process.cwd(), ".gemini", "settings.json");
-  const geminiGlobal = path28.join(geminiGlobalDir(), "antigravity-cli", "mcp_config.json");
+  const geminiProject = path30.join(process.cwd(), ".gemini", "settings.json");
+  const geminiGlobal = path30.join(geminiGlobalDir(), "antigravity-cli", "mcp_config.json");
   logger.blank();
   logger.info(`${import_chalk4.default.bold("wairon MCP Server")}`);
   logger.blank();
@@ -20261,12 +20566,12 @@ async function runMcpStatus() {
     { label: "Antigravity (global)", filePath: geminiGlobal, fallbackName: "mcp_config.json" }
   ];
   for (const { label, filePath, fallbackName } of checks) {
-    if (!fs19.existsSync(filePath)) {
+    if (!fs20.existsSync(filePath)) {
       console.log(`  ${label}: ${import_chalk4.default.gray(`${fallbackName} not found`)}`);
       continue;
     }
     try {
-      const s = JSON.parse(fs19.readFileSync(filePath, "utf8"));
+      const s = JSON.parse(fs20.readFileSync(filePath, "utf8"));
       const registered = !!s["mcpServers"]?.["wairon"];
       const mark = registered ? import_chalk4.default.green("\u2713 registered") : import_chalk4.default.gray("not registered");
       console.log(`  ${label}: ${mark}  ${import_chalk4.default.gray(filePath)}`);
@@ -20282,16 +20587,16 @@ async function runMcpStatus() {
   logger.info(`To start manually: ${import_chalk4.default.bold("wairon mcp serve")}`);
   logger.blank();
   const mcpDir = aiDir("mcp");
-  if (fs19.existsSync(mcpDir)) {
+  if (fs20.existsSync(mcpDir)) {
     logger.info(`MCP state dir: ${import_chalk4.default.gray(mcpDir)}`);
   }
 }
 function removeLegacyGlobalPlugin() {
-  const home = process.env["USERPROFILE"] ?? process.env["HOME"] ?? os6.homedir();
-  const pluginDir = path28.join(home, ".gemini", "config", "plugins", "wairon");
+  const home = process.env["USERPROFILE"] ?? process.env["HOME"] ?? os7.homedir();
+  const pluginDir = path30.join(home, ".gemini", "config", "plugins", "wairon");
   try {
-    if (fs19.existsSync(pluginDir)) {
-      fs19.rmSync(pluginDir, { recursive: true, force: true });
+    if (fs20.existsSync(pluginDir)) {
+      fs20.rmSync(pluginDir, { recursive: true, force: true });
       logger.info(`Removed legacy global Antigravity plugin at ${import_chalk4.default.gray(pluginDir)} (it collides with the wairon MCP server).`);
       return true;
     }
@@ -20300,13 +20605,13 @@ function removeLegacyGlobalPlugin() {
   }
   return false;
 }
-var fs19, os6, path28, import_chalk4;
+var fs20, os7, path30, import_chalk4;
 var init_mcp = __esm({
   "src/commands/mcp.ts"() {
     "use strict";
-    fs19 = __toESM(require("fs"));
-    os6 = __toESM(require("os"));
-    path28 = __toESM(require("path"));
+    fs20 = __toESM(require("fs"));
+    os7 = __toESM(require("os"));
+    path30 = __toESM(require("path"));
     import_chalk4 = __toESM(require("chalk"));
     init_logger();
     init_loader();
@@ -23141,8 +23446,8 @@ var require_dist = __commonJS({
     function slug(name) {
       return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
     }
-    var fs53 = __toESM2(require("fs"));
-    var path64 = __toESM2(require("path"));
+    var fs54 = __toESM2(require("fs"));
+    var path67 = __toESM2(require("path"));
     var import_fflate = require_node();
     var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".hg", ".svn"]);
     function listEntries(archive) {
@@ -23180,9 +23485,9 @@ var require_dist = __commonJS({
     }
     function writeTree(destDir, files) {
       for (const file of files) {
-        const absolute = path64.join(destDir, file.path);
-        fs53.mkdirSync(path64.dirname(absolute), { recursive: true });
-        fs53.writeFileSync(absolute, file.contents);
+        const absolute = path67.join(destDir, file.path);
+        fs54.mkdirSync(path67.dirname(absolute), { recursive: true });
+        fs54.writeFileSync(absolute, file.contents);
       }
     }
     function classifyKind(name, symlinks) {
@@ -23191,14 +23496,14 @@ var require_dist = __commonJS({
       return "file";
     }
     function walkPackDir(root, current2, out) {
-      for (const entry of fs53.readdirSync(current2, { withFileTypes: true })) {
+      for (const entry of fs54.readdirSync(current2, { withFileTypes: true })) {
         if (entry.isDirectory()) {
           if (SKIP_DIRS.has(entry.name)) continue;
-          walkPackDir(root, path64.join(current2, entry.name), out);
+          walkPackDir(root, path67.join(current2, entry.name), out);
         } else if (entry.isFile()) {
-          const absolute = path64.join(current2, entry.name);
-          const relative22 = path64.relative(root, absolute).split(path64.sep).join("/");
-          out.push({ path: relative22, contents: fs53.readFileSync(absolute) });
+          const absolute = path67.join(current2, entry.name);
+          const relative22 = path67.relative(root, absolute).split(path67.sep).join("/");
+          out.push({ path: relative22, contents: fs54.readFileSync(absolute) });
         }
       }
     }
@@ -23367,7 +23672,7 @@ var require_dist = __commonJS({
 });
 
 // src/cli/index.ts
-var path63 = __toESM(require("path"));
+var path66 = __toESM(require("path"));
 var import_commander = require("commander");
 init_defaults();
 init_logger();
@@ -23594,7 +23899,7 @@ function isSupportedAlias(name) {
 }
 
 // src/commands/init.ts
-var path29 = __toESM(require("path"));
+var path31 = __toESM(require("path"));
 var import_chalk5 = __toESM(require("chalk"));
 var import_inquirer = __toESM(require("inquirer"));
 init_logger();
@@ -23615,7 +23920,7 @@ var WAIRON_MANAGED_MARKER = "wairon:managed";
 var WAIRON_MANAGED_BANNER = `<!-- ${WAIRON_MANAGED_MARKER} \u2014 generated by \`wairon generate\`; do not edit, changes are overwritten -->`;
 
 // src/exporters/claude.ts
-var path20 = __toESM(require("path"));
+var path22 = __toESM(require("path"));
 init_fs();
 var ClaudeExporter = class {
   constructor() {
@@ -23624,7 +23929,7 @@ var ClaudeExporter = class {
   outputPath(ctx) {
     const { agent, target, projectRoot: projectRoot2 } = ctx;
     const outputDir = "outputDir" in target ? target.outputDir : ".claude/agents";
-    return path20.resolve(projectRoot2, outputDir, `${agent.id.replace(/::/g, "--")}.md`);
+    return path22.resolve(projectRoot2, outputDir, `${agent.id.replace(/::/g, "--")}.md`);
   }
   export(ctx) {
     const { agent, renderedInstructions } = ctx;
@@ -23645,7 +23950,7 @@ var ClaudeExporter = class {
 };
 
 // src/exporters/custom.ts
-var path21 = __toESM(require("path"));
+var path23 = __toESM(require("path"));
 init_fs();
 var CustomExporter = class {
   constructor() {
@@ -23656,7 +23961,7 @@ var CustomExporter = class {
     if (!("outputDir" in target)) {
       throw new Error("CustomExporter requires target.outputDir");
     }
-    return path21.resolve(projectRoot2, target.outputDir, `${agent.id.replace(/::/g, "--")}.md`);
+    return path23.resolve(projectRoot2, target.outputDir, `${agent.id.replace(/::/g, "--")}.md`);
   }
   export(ctx) {
     const { agent, target, renderedInstructions } = ctx;
@@ -23679,7 +23984,7 @@ var CustomExporter = class {
 };
 
 // src/exporters/gemini.ts
-var path22 = __toESM(require("path"));
+var path24 = __toESM(require("path"));
 init_fs();
 var GeminiExporter = class {
   constructor() {
@@ -23688,7 +23993,7 @@ var GeminiExporter = class {
   outputPath(ctx) {
     const { agent, target, projectRoot: projectRoot2 } = ctx;
     const outputDir = "outputDir" in target ? target.outputDir : ".gemini/agents";
-    return path22.resolve(projectRoot2, outputDir, `${agent.id.replace(/::/g, "--")}.yaml`);
+    return path24.resolve(projectRoot2, outputDir, `${agent.id.replace(/::/g, "--")}.yaml`);
   }
   export(ctx) {
     const { agent, renderedInstructions } = ctx;
@@ -23713,11 +24018,11 @@ function yamlString(value) {
 }
 
 // src/exporters/generate.ts
-var path26 = __toESM(require("path"));
+var path28 = __toESM(require("path"));
 
 // src/core/detection.ts
-var fs16 = __toESM(require("fs"));
-var path23 = __toESM(require("path"));
+var fs17 = __toESM(require("fs"));
+var path25 = __toESM(require("path"));
 init_defaults();
 var PACKAGE_MARKERS = [
   "package.json",
@@ -23769,7 +24074,7 @@ function deduplicateIds(candidates, existingIds = /* @__PURE__ */ new Set()) {
   });
 }
 function parseGitmodules(filePath) {
-  const content = fs16.readFileSync(filePath, "utf-8");
+  const content = fs17.readFileSync(filePath, "utf-8");
   const entries = [];
   let current2 = {};
   for (const line2 of content.split("\n")) {
@@ -23791,8 +24096,8 @@ function parseGitmodules(filePath) {
   return entries;
 }
 function detectGitSubmodules(projectRoot2) {
-  const gitmodulesPath = path23.join(projectRoot2, ".gitmodules");
-  if (!fs16.existsSync(gitmodulesPath)) return [];
+  const gitmodulesPath = path25.join(projectRoot2, ".gitmodules");
+  if (!fs17.existsSync(gitmodulesPath)) return [];
   return parseGitmodules(gitmodulesPath).map((entry) => ({
     suggestedId: pathToId(entry.path),
     suggestedName: pathToName(entry.path),
@@ -23810,18 +24115,18 @@ function walkForGit(projectRoot2, currentDir, depth, results) {
   if (depth > MAX_SCAN_DEPTH) return;
   let entries;
   try {
-    entries = fs16.readdirSync(currentDir, { withFileTypes: true });
+    entries = fs17.readdirSync(currentDir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     if (SCAN_EXCLUDE_DIRS.has(entry.name)) continue;
-    const fullPath = path23.join(currentDir, entry.name);
-    const relPath = normalizePath3(path23.relative(projectRoot2, fullPath));
+    const fullPath = path25.join(currentDir, entry.name);
+    const relPath = normalizePath3(path25.relative(projectRoot2, fullPath));
     if (relPath === "" || relPath === ".") continue;
-    const gitPath = path23.join(fullPath, ".git");
-    if (fs16.existsSync(gitPath)) {
+    const gitPath = path25.join(fullPath, ".git");
+    if (fs17.existsSync(gitPath)) {
       results.push({
         suggestedId: pathToId(relPath),
         suggestedName: pathToName(relPath),
@@ -23843,17 +24148,17 @@ function walkForPackages(projectRoot2, currentDir, depth, results) {
   if (depth > MAX_SCAN_DEPTH) return;
   let entries;
   try {
-    entries = fs16.readdirSync(currentDir, { withFileTypes: true });
+    entries = fs17.readdirSync(currentDir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     if (SCAN_EXCLUDE_DIRS.has(entry.name)) continue;
-    const fullPath = path23.join(currentDir, entry.name);
-    const relPath = normalizePath3(path23.relative(projectRoot2, fullPath));
+    const fullPath = path25.join(currentDir, entry.name);
+    const relPath = normalizePath3(path25.relative(projectRoot2, fullPath));
     if (relPath === "" || relPath === ".") continue;
-    const hasMarker = PACKAGE_MARKERS.some((m) => fs16.existsSync(path23.join(fullPath, m)));
+    const hasMarker = PACKAGE_MARKERS.some((m) => fs17.existsSync(path25.join(fullPath, m)));
     if (hasMarker) {
       results.push({
         suggestedId: pathToId(relPath),
@@ -23867,8 +24172,8 @@ function walkForPackages(projectRoot2, currentDir, depth, results) {
   }
 }
 function pathToId(relPath) {
-  const basename13 = path23.basename(relPath);
-  return basename13.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  const basename14 = path25.basename(relPath);
+  return basename14.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function pathToName(relPath) {
   const id = pathToId(relPath);
@@ -24095,7 +24400,7 @@ function resolveExpectedOutputPaths(agents, projectConfig, projectRoot2 = getPro
       const targetConfig = resolveTargetConfig(agentTarget, projectConfig);
       if (!targetConfig) continue;
       const ctx = { agent, projectRoot: projectRoot2, target: targetConfig };
-      expected.add(path26.resolve(getExporter(targetConfig).outputPath(ctx)));
+      expected.add(path28.resolve(getExporter(targetConfig).outputPath(ctx)));
     }
   }
   return expected;
@@ -24113,7 +24418,7 @@ async function runInit(options = {}) {
   logger.header("wairon init");
   const cwd = process.cwd();
   const ancestorRoot = findSystemRoot(cwd);
-  if (ancestorRoot && path29.resolve(ancestorRoot) === path29.resolve(cwd)) {
+  if (ancestorRoot && path31.resolve(ancestorRoot) === path31.resolve(cwd)) {
     logger.info("Project already initialized.");
     logger.info("Design your spec tree with the SDD architect skill, then run `wairon generate`.");
     return;
@@ -24129,8 +24434,8 @@ async function runInit(options = {}) {
   await runInitInteractive();
 }
 async function runInitAsExternalSubsystem(parentRoot, cwd, options) {
-  const relPath = path29.relative(parentRoot, cwd) || ".";
-  const defaultId = path29.basename(cwd);
+  const relPath = path31.relative(parentRoot, cwd) || ".";
+  const defaultId = path31.basename(cwd);
   logger.info(`Detected a parent wairon project at ${parentRoot}`);
   logger.info(`This directory ("${relPath}") is not yet a wairon project.`);
   if (!options.yes) {
@@ -24190,7 +24495,7 @@ async function runInitAsExternalSubsystem(parentRoot, cwd, options) {
 }
 async function runInitNonInteractive() {
   const cwd = process.cwd();
-  const projectName = path29.basename(cwd);
+  const projectName = path31.basename(cwd);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const targets = [defaultTargetConfig("claude"), defaultTargetConfig("agy")];
   const projectConfig = buildProjectConfig(projectName, targets, now, "backend");
@@ -24212,7 +24517,7 @@ async function runInitNonInteractive() {
 }
 async function runInitInteractive() {
   const cwd = process.cwd();
-  const defaultProjectName = path29.basename(cwd);
+  const defaultProjectName = path31.basename(cwd);
   const { projectName } = await import_inquirer.default.prompt([
     {
       type: "input",
@@ -24372,7 +24677,7 @@ async function executeInit(projectName, targets, projectConfig, guidePlan, now)
         projectRoot: projectRoot2,
         target: targetConfig
       });
-      logger.success(`Generated: ${path29.relative(cwd, result.outputPath)}`);
+      logger.success(`Generated: ${path31.relative(cwd, result.outputPath)}`);
     }
   }
   writeStarterDocs(projectName);
@@ -24387,7 +24692,7 @@ async function executeInit(projectName, targets, projectConfig, guidePlan, now)
   if (guidePlan.claudeLocal) {
     const p = localGuideFilePath(projectRoot2, "claude");
     injectGuide(p, "local");
-    logger.success(`Injected wairon guide into ${path29.relative(cwd, p)}`);
+    logger.success(`Injected wairon guide into ${path31.relative(cwd, p)}`);
     writeRootGuideDelegator(projectRoot2, "claude");
     logger.success(`Created root CLAUDE.md delegator pointing to .claude/CLAUDE.md`);
   }
@@ -24399,7 +24704,7 @@ async function executeInit(projectName, targets, projectConfig, guidePlan, now)
   if (guidePlan.geminiLocal) {
     const p = localGuideFilePath(projectRoot2, "gemini");
     injectGuide(p, "local");
-    logger.success(`Injected wairon guide into ${path29.relative(cwd, p)}`);
+    logger.success(`Injected wairon guide into ${path31.relative(cwd, p)}`);
     writeRootGuideDelegator(projectRoot2, "gemini");
     logger.success(`Created root GEMINI.md delegator pointing to .gemini/GEMINI.md`);
   }
@@ -24632,8 +24937,8 @@ A new project initialized with Wairon.
 }
 
 // src/commands/generate.ts
-var fs20 = __toESM(require("fs"));
-var path30 = __toESM(require("path"));
+var fs21 = __toESM(require("fs"));
+var path32 = __toESM(require("path"));
 init_logger();
 init_loader();
 init_fs();
@@ -24641,29 +24946,29 @@ init_provision();
 init_specs2();
 var WAIRON_AGENT_FILE = /-(owner|implementer|architect)\.md$/;
 function pruneStaleAgents(expectedPaths, scanDirs) {
-  const dirs = new Set(scanDirs ?? [...expectedPaths].map((p) => path30.dirname(p)));
+  const dirs = new Set(scanDirs ?? [...expectedPaths].map((p) => path32.dirname(p)));
   let pruned = 0;
   for (const dir of dirs) {
     let entries;
     try {
-      entries = fs20.readdirSync(dir);
+      entries = fs21.readdirSync(dir);
     } catch {
       continue;
     }
     for (const name of entries) {
       if (!name.endsWith(".md")) continue;
-      const full = path30.resolve(dir, name);
+      const full = path32.resolve(dir, name);
       if (expectedPaths.has(full)) continue;
       let owned = WAIRON_AGENT_FILE.test(name);
       if (!owned) {
         try {
-          owned = fs20.readFileSync(full, "utf8").includes(WAIRON_MANAGED_MARKER);
+          owned = fs21.readFileSync(full, "utf8").includes(WAIRON_MANAGED_MARKER);
         } catch {
           owned = false;
         }
       }
       if (!owned) continue;
-      fs20.unlinkSync(full);
+      fs21.unlinkSync(full);
       pruned++;
       logger.verbose(`Pruned stale: ${full}`);
     }
@@ -24677,7 +24982,7 @@ async function runGenerate(options = {}) {
   const children = listDirectChainedSubprojects(getProjectRoot());
   for (const child of children) {
     logger.blank();
-    logger.info(`\u21B3 Chained subproject "${child.subsystemId}" \u2014 generating its layer in ${path30.relative(getProjectRoot(), child.dir) || "."}/`);
+    logger.info(`\u21B3 Chained subproject "${child.subsystemId}" \u2014 generating its layer in ${path32.relative(getProjectRoot(), child.dir) || "."}/`);
     await runWithProjectRoot(child.dir, async () => {
       ensureProjectInitialized(child.subsystemId);
       invalidateSpecCache();
@@ -24698,7 +25003,7 @@ async function generateLayer(options = {}) {
   } else if (options.dryRun) {
     logger.info("Dry run \u2014 rules.materializeAgentFiles is off: no agent files are written; leftover managed files would be removed.");
   } else if (options.prune !== false) {
-    const candidateDirs = [...resolveExpectedOutputPaths(registry.agents, projectConfig)].map((p) => path30.dirname(p));
+    const candidateDirs = [...resolveExpectedOutputPaths(registry.agents, projectConfig)].map((p) => path32.dirname(p));
     const removed = pruneStaleAgents(/* @__PURE__ */ new Set(), candidateDirs);
     if (removed > 0) {
       logger.info(`Removed ${removed} previously materialized agent file(s) \u2014 agents are served as live briefs (sdd_get_agent_brief); opt back in with rules.materializeAgentFiles: true.`);
@@ -24785,22 +25090,34 @@ function materializeAgentLayer(agents, projectConfig, options) {
 }
 
 // src/commands/lock.ts
-var os7 = __toESM(require("os"));
+var os8 = __toESM(require("os"));
 var import_inquirer2 = __toESM(require("inquirer"));
 init_logger();
+init_baseline();
 init_defaults();
+var path33 = __toESM(require("path"));
+init_fs();
 async function runLock(options = {}, gate) {
-  const promotable = collectPromotableSpecs(options.subsystem);
-  if (promotable.length === 0) {
-    logger.info("All specs are already complete \u2014 this will re-validate and regenerate the agent topology.");
+  const diff = diffAgainstBaseline();
+  if (!diff) {
+    logger.info("First approval of this tree \u2014 the whole spec tree becomes the approved baseline.");
+  } else if (diffSize(diff) === 0) {
+    logger.info("Nothing has changed since the last approval \u2014 this will re-validate and regenerate the agent topology.");
   } else {
-    logger.info(`${promotable.length} spec(s) will be frozen as complete:`);
-    for (const p of promotable) {
-      logger.info(`  \u2022 ${p.kind.padEnd(14)} ${p.id}  (${p.status} \u2192 complete)`);
+    logger.info(`${diffSize(diff)} spec(s) changed since the last approval:`);
+    for (const p of diff.changed) logger.info(`  ~ ${p}`);
+    for (const p of diff.added) logger.info(`  + ${p}`);
+    for (const p of diff.removed) logger.info(`  - ${p}`);
+  }
+  const moved = movedChildren(loadSubsystemSpecs());
+  if (moved.length > 0) {
+    logger.info(`${moved.length} chained child project(s) moved since the last approval:`);
+    for (const m of moved) {
+      logger.info(`  ${m.id}: ${m.pinned.slice(0, 19)}\u2026 \u2192 ${m.now ? `${m.now.slice(0, 19)}\u2026` : "(no approval)"}`);
     }
   }
   logger.blank();
-  logger.warn("This freezes the design as the source of truth and (re)generates the agent topology.");
+  logger.warn("This records the current design as approved and (re)generates the agent topology.");
   if (!options.yes) {
     if (!process.stdin.isTTY) {
       logger.error("Non-interactive shell \u2014 re-run with --yes to confirm the lock.");
@@ -24810,24 +25127,15 @@ async function runLock(options = {}, gate) {
       {
         type: "confirm",
         name: "confirmed",
-        message: "Lock these specs and generate the agent topology? This freezes the design.",
+        message: "Approve this design and generate the agent topology?",
         default: false
       }
     ]);
     if (!confirmed) return null;
   }
-  if (options.subsystem) {
-    for (const p of promotable) applySpecStatus(p.kind, p.id, "complete");
-    invalidateSpecCache();
-  } else {
-    promoteAllComplete();
-  }
-  if (promotable.length > 0) {
-    logger.success(`Locked ${promotable.length} spec(s) as complete.`);
-  }
   let lockedBy = "local";
   try {
-    lockedBy = `local:${os7.userInfo().username}`;
+    lockedBy = `local:${os8.userInfo().username}`;
   } catch {
   }
   const record2 = {
@@ -24843,6 +25151,13 @@ async function runLock(options = {}, gate) {
     status: "ready"
   };
   writeLockRecord(record2);
+  const root = getProjectRoot();
+  const scope = options.subsystem ? {
+    paths: new Set(
+      specPathsInScope(options.subsystem).map((p) => path33.relative(root, p).split(path33.sep).join("/"))
+    )
+  } : void 0;
+  writeBaseline(captureBaseline(lockedBy, currentChildPins(loadSubsystemSpecs(), root), root, scope));
   return record2;
 }
 
@@ -25099,29 +25414,29 @@ init_mcp();
 
 // src/commands/update.ts
 var https2 = __toESM(require("https"));
-var fs22 = __toESM(require("fs"));
-var path31 = __toESM(require("path"));
-var os8 = __toESM(require("os"));
-var crypto3 = __toESM(require("crypto"));
+var fs23 = __toESM(require("fs"));
+var path34 = __toESM(require("path"));
+var os9 = __toESM(require("os"));
+var crypto4 = __toESM(require("crypto"));
 var import_child_process2 = require("child_process");
 init_logger();
 init_defaults();
 init_version();
 
 // src/utils/download.ts
-var fs21 = __toESM(require("fs"));
+var fs22 = __toESM(require("fs"));
 var http = __toESM(require("http"));
 var https = __toESM(require("https"));
 init_defaults();
 function downloadFile(url, dest) {
-  return new Promise((resolve26, reject) => {
-    const file = fs21.createWriteStream(dest);
+  return new Promise((resolve27, reject) => {
+    const file = fs22.createWriteStream(dest);
     const get4 = url.startsWith("https://") ? https.get : http.get;
     get4(url, { headers: { "User-Agent": `wairon/${WAIRON_VERSION}` }, agent: false }, (res) => {
       if (res.statusCode === 301 || res.statusCode === 302) {
         file.close();
         res.destroy();
-        downloadFile(res.headers.location, dest).then(resolve26).catch(reject);
+        downloadFile(res.headers.location, dest).then(resolve27).catch(reject);
         return;
       }
       if (res.statusCode !== 200) {
@@ -25133,16 +25448,16 @@ function downloadFile(url, dest) {
       res.pipe(file);
       file.on("finish", () => {
         res.destroy();
-        file.close(() => resolve26());
+        file.close(() => resolve27());
       });
       file.on("error", (err) => {
         res.destroy();
-        fs21.unlink(dest, () => {
+        fs22.unlink(dest, () => {
         });
         reject(err);
       });
     }).on("error", (err) => {
-      fs21.unlink(dest, () => {
+      fs22.unlink(dest, () => {
       });
       reject(err);
     });
@@ -25208,8 +25523,8 @@ async function runUpdate(options = {}) {
     logger.info(`Download manually from: ${release.html_url}`);
     process.exit(1);
   }
-  const tmpDir = os8.tmpdir();
-  const tmpFile = path31.join(tmpDir, assetName);
+  const tmpDir = os9.tmpdir();
+  const tmpFile = path34.join(tmpDir, assetName);
   logger.info(`Downloading ${assetName}...`);
   try {
     await downloadFile(asset.browser_download_url, tmpFile);
@@ -25226,16 +25541,16 @@ async function runUpdate(options = {}) {
   const checksumAssetName = assetName + ".sha256";
   const checksumAsset = release.assets.find((a) => a.name === checksumAssetName);
   if (checksumAsset) {
-    const tmpChecksum = path31.join(tmpDir, checksumAssetName);
+    const tmpChecksum = path34.join(tmpDir, checksumAssetName);
     logger.info(`Verifying checksum...`);
     try {
       await downloadFile(checksumAsset.browser_download_url, tmpChecksum);
       verifyChecksum(tmpFile, tmpChecksum, assetName);
-      fs22.unlinkSync(tmpChecksum);
+      fs23.unlinkSync(tmpChecksum);
     } catch (err) {
       logger.error(`Checksum verification failed: ${err.message}`);
       try {
-        fs22.unlinkSync(tmpFile);
+        fs23.unlinkSync(tmpFile);
       } catch {
       }
       process.exit(1);
@@ -25270,7 +25585,7 @@ function releaseChannelLabel(tag) {
   return "stable";
 }
 function fetchReleases(repo) {
-  return new Promise((resolve26, reject) => {
+  return new Promise((resolve27, reject) => {
     const url = `https://api.github.com/repos/${repo}/releases?per_page=20`;
     const options = {
       headers: {
@@ -25290,7 +25605,7 @@ function fetchReleases(repo) {
           return;
         }
         try {
-          resolve26(JSON.parse(data));
+          resolve27(JSON.parse(data));
         } catch {
           reject(new Error("Failed to parse GitHub API response"));
         }
@@ -25300,10 +25615,10 @@ function fetchReleases(repo) {
   });
 }
 function verifyChecksum(filePath, checksumFile, expectedFilename) {
-  const checksumContent = fs22.readFileSync(checksumFile, "utf-8").trim();
+  const checksumContent = fs23.readFileSync(checksumFile, "utf-8").trim();
   const expectedHash = checksumContent.split(/\s+/)[0].toLowerCase();
-  const fileBuffer = fs22.readFileSync(filePath);
-  const actualHash = crypto3.createHash("sha256").update(fileBuffer).digest("hex").toLowerCase();
+  const fileBuffer = fs23.readFileSync(filePath);
+  const actualHash = crypto4.createHash("sha256").update(fileBuffer).digest("hex").toLowerCase();
   if (actualHash !== expectedHash) {
     throw new Error(
       `SHA-256 mismatch for ${expectedFilename}
@@ -25333,9 +25648,9 @@ function isPkgBinary2() {
 function installBinary(tmpFile, destPath) {
   const platform = process.platform;
   const isZip = tmpFile.endsWith(".zip");
-  const extractDir = path31.join(os8.tmpdir(), "wairon-extract");
-  if (fs22.existsSync(extractDir)) fs22.rmSync(extractDir, { recursive: true });
-  fs22.mkdirSync(extractDir, { recursive: true });
+  const extractDir = path34.join(os9.tmpdir(), "wairon-extract");
+  if (fs23.existsSync(extractDir)) fs23.rmSync(extractDir, { recursive: true });
+  fs23.mkdirSync(extractDir, { recursive: true });
   if (isZip) {
     (0, import_child_process2.execSync)(
       `powershell -NoProfile -NonInteractive -Command "Expand-Archive -Path '${tmpFile}' -DestinationPath '${extractDir}' -Force"`,
@@ -25345,18 +25660,18 @@ function installBinary(tmpFile, destPath) {
     (0, import_child_process2.execSync)(`tar -xzf "${tmpFile}" -C "${extractDir}"`, { stdio: ["ignore", "pipe", "pipe"] });
   }
   const binaryName = platform === "win32" ? "wairon.exe" : "wairon";
-  const extractedBinary = path31.join(extractDir, binaryName);
-  if (!fs22.existsSync(extractedBinary)) {
+  const extractedBinary = path34.join(extractDir, binaryName);
+  if (!fs23.existsSync(extractedBinary)) {
     throw new Error(`Extracted binary not found at ${extractedBinary}`);
   }
   if (platform === "win32") {
     const oldPath = destPath + ".old";
     try {
       cleanStaleBinary(oldPath);
-      fs22.renameSync(destPath, oldPath);
-      fs22.copyFileSync(extractedBinary, destPath);
+      fs23.renameSync(destPath, oldPath);
+      fs23.copyFileSync(extractedBinary, destPath);
       try {
-        fs22.unlinkSync(oldPath);
+        fs23.unlinkSync(oldPath);
       } catch {
       }
     } catch (err) {
@@ -25370,25 +25685,25 @@ function installBinary(tmpFile, destPath) {
     }
   } else {
     const tmpDest = destPath + ".new";
-    fs22.copyFileSync(extractedBinary, tmpDest);
-    fs22.chmodSync(tmpDest, 493);
-    fs22.renameSync(tmpDest, destPath);
+    fs23.copyFileSync(extractedBinary, tmpDest);
+    fs23.chmodSync(tmpDest, 493);
+    fs23.renameSync(tmpDest, destPath);
   }
   try {
-    fs22.unlinkSync(tmpFile);
+    fs23.unlinkSync(tmpFile);
   } catch {
   }
   try {
-    fs22.rmSync(extractDir, { recursive: true });
+    fs23.rmSync(extractDir, { recursive: true });
   } catch {
   }
 }
 function cleanStaleBinary(oldPath) {
   const target = oldPath ?? (isPkgBinary2() ? process.execPath + ".old" : null);
   if (!target) return;
-  if (fs22.existsSync(target)) {
+  if (fs23.existsSync(target)) {
     try {
-      fs22.unlinkSync(target);
+      fs23.unlinkSync(target);
     } catch {
     }
   }
@@ -25465,7 +25780,7 @@ async function filteredCheckbox(config) {
     32,
     Math.max(...items.map((i) => i.label.length))
   );
-  return new Promise((resolve26) => {
+  return new Promise((resolve27) => {
     const checked = /* @__PURE__ */ new Set();
     let cursor = 0;
     let filterIdx = 0;
@@ -25532,7 +25847,7 @@ async function filteredCheckbox(config) {
       );
       teardown();
       const result = items.filter((_, idx) => checked.has(idx)).map((i) => i.value);
-      resolve26(result);
+      resolve27(result);
     }
     function abort() {
       process.stdout.write("\n");
@@ -25804,9 +26119,9 @@ async function runSkillsInstall() {
 }
 
 // src/commands/doctor.ts
-var fs23 = __toESM(require("fs"));
-var os9 = __toESM(require("os"));
-var path32 = __toESM(require("path"));
+var fs24 = __toESM(require("fs"));
+var os10 = __toESM(require("os"));
+var path35 = __toESM(require("path"));
 var import_chalk12 = __toESM(require("chalk"));
 init_logger();
 init_defaults();
@@ -25837,10 +26152,10 @@ function stampVerdict(content) {
   return { mark: "warn", note: `v${v} \u2014 stale, installed is v${WAIRON_VERSION}` };
 }
 function mcpEntryHealth(settingsPath) {
-  if (!fs23.existsSync(settingsPath)) return { mark: "warn", note: "not registered" };
+  if (!fs24.existsSync(settingsPath)) return { mark: "warn", note: "not registered" };
   let entry;
   try {
-    const s = JSON.parse(fs23.readFileSync(settingsPath, "utf8"));
+    const s = JSON.parse(fs24.readFileSync(settingsPath, "utf8"));
     entry = s.mcpServers?.["wairon"];
   } catch {
     return { mark: "error", note: "parse error" };
@@ -25848,7 +26163,7 @@ function mcpEntryHealth(settingsPath) {
   if (!entry) return { mark: "warn", note: "not registered" };
   if (entry.command === "node" && Array.isArray(entry.args) && typeof entry.args[0] === "string") {
     const scriptPath = entry.args[0];
-    if (!fs23.existsSync(scriptPath)) {
+    if (!fs24.existsSync(scriptPath)) {
       return { mark: "error", note: `registered but the server path is missing \u2014 ${scriptPath}` };
     }
   }
@@ -25900,7 +26215,7 @@ async function runDoctor(options = {}) {
     const { findChainingSubprojectsMissingConfig: findChainingSubprojectsMissingConfig2 } = (init_provision(), __toCommonJS(provision_exports));
     const missing = findChainingSubprojectsMissingConfig2(getProjectRoot());
     if (missing.length > 0) {
-      line(tally, "warn", `${missing.length} chained subproject(s) have specs but no project.yaml (un-runnable standalone): ${missing.map((d) => path32.relative(getProjectRoot(), d) || ".").join(", ")}. Run \`wairon doctor --fix\` to initialize them.`);
+      line(tally, "warn", `${missing.length} chained subproject(s) have specs but no project.yaml (un-runnable standalone): ${missing.map((d) => path35.relative(getProjectRoot(), d) || ".").join(", ")}. Run \`wairon doctor --fix\` to initialize them.`);
     }
   } catch {
   }
@@ -25938,7 +26253,7 @@ async function runDoctor(options = {}) {
     const gp = localGuideFilePath(process.cwd(), t);
     if (!gp || seenGuides.has(gp)) continue;
     seenGuides.add(gp);
-    const rel2 = path32.relative(process.cwd(), gp).replace(/\\/g, "/");
+    const rel2 = path35.relative(process.cwd(), gp).replace(/\\/g, "/");
     if (!pathExists(gp)) {
       line(tally, "warn", `${rel2} guide \u2014 not injected (run \`wairon generate\`)`);
       continue;
@@ -26020,17 +26335,17 @@ async function runDoctor(options = {}) {
     line(tally, h.mark, `Claude (project .mcp.json): ${h.note}${h.mark === "ok" ? "" : " \u2014 run `wairon mcp install --backend claude`"}`);
   }
   if (wantGemini) {
-    const globalCfg = path32.join(os9.homedir(), ".gemini", "antigravity-cli", "mcp_config.json");
+    const globalCfg = path35.join(os10.homedir(), ".gemini", "antigravity-cli", "mcp_config.json");
     const hg = mcpEntryHealth(globalCfg);
     line(tally, hg.mark, `Antigravity (global mcp_config.json): ${hg.note}${hg.mark === "ok" ? "" : " \u2014 run `wairon mcp install --backend gemini --global`"}`);
     const projPath = fromProjectRoot(".gemini", "settings.json");
-    if (fs23.existsSync(projPath)) {
+    if (fs24.existsSync(projPath)) {
       const hp = mcpEntryHealth(projPath);
       line(tally, hp.mark === "error" ? "error" : "ok", `Gemini CLI (project): ${hp.note} ${import_chalk12.default.gray("(Antigravity ignores this file)")}`);
     }
   }
-  const pluginDir = path32.join(os9.homedir(), ".gemini", "config", "plugins", "wairon");
-  if (fs23.existsSync(pluginDir)) {
+  const pluginDir = path35.join(os10.homedir(), ".gemini", "config", "plugins", "wairon");
+  if (fs24.existsSync(pluginDir)) {
     line(tally, "warn", `Legacy Antigravity plugin present (${pluginDir}) \u2014 it collides with the wairon MCP server. Remove it with \`wairon doctor --fix\`.`);
   }
   logger.blank();
@@ -26069,7 +26384,7 @@ async function applyFixes() {
     const legacySpecs = findLegacySpecFiles();
     if (legacySpecs.length > 0) {
       for (const { path: oldPath, expected: newPath } of legacySpecs) {
-        fs23.renameSync(oldPath, newPath);
+        fs24.renameSync(oldPath, newPath);
       }
       console.log(`  ${icon("ok")} Migrated ${legacySpecs.length} legacy spec file(s) to the new dot-prefixed unified schema.`);
     }
@@ -26123,8 +26438,8 @@ function printSummary(tally) {
 }
 
 // src/commands/diagram.ts
-var fs24 = __toESM(require("fs"));
-var path33 = __toESM(require("path"));
+var fs25 = __toESM(require("fs"));
+var path36 = __toESM(require("path"));
 init_logger();
 init_loader();
 init_fs();
@@ -26159,71 +26474,71 @@ function collectIssues() {
 }
 function writeCanvas(dest) {
   const model = buildCanvasModel(collectIssues());
-  ensureDir(path33.dirname(path33.resolve(dest)));
-  fs24.writeFileSync(dest, renderCanvasHtml(model), "utf-8");
+  ensureDir(path36.dirname(path36.resolve(dest)));
+  fs25.writeFileSync(dest, renderCanvasHtml(model), "utf-8");
 }
 function parseSequenceRef(ref) {
-  const sep6 = ref.includes(":") ? ref.lastIndexOf(":") : ref.lastIndexOf(".");
-  if (sep6 <= 0 || sep6 === ref.length - 1) {
+  const sep9 = ref.includes(":") ? ref.lastIndexOf(":") : ref.lastIndexOf(".");
+  if (sep9 <= 0 || sep9 === ref.length - 1) {
     throw new WaironError(
       `Invalid --sequence reference "${ref}". Use <componentId>:<methodName> (e.g. billing-portal:authorize).`
     );
   }
-  return { component: ref.slice(0, sep6), method: ref.slice(sep6 + 1) };
+  return { component: ref.slice(0, sep9), method: ref.slice(sep9 + 1) };
 }
 async function runDiagram(rawOptions = {}) {
   assertProjectInitialized();
   const options = applyFormat(rawOptions);
   if (options.canvas && !options.all) {
-    const dest2 = options.out ?? path33.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
+    const dest2 = options.out ?? path36.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
     writeCanvas(dest2);
     logger.success(`Interactive canvas written to ${dest2}`);
     logger.info("Open it in a browser \u2014 fully self-contained (works offline).");
     return;
   }
   if (options.drawio && !options.all) {
-    const dest2 = options.out ?? path33.join(AI_PATHS.docsDir(), "diagrams", "architecture.drawio");
-    ensureDir(path33.dirname(path33.resolve(dest2)));
-    fs24.writeFileSync(dest2, generateDrawioXml(buildCanvasModel()), "utf-8");
+    const dest2 = options.out ?? path36.join(AI_PATHS.docsDir(), "diagrams", "architecture.drawio");
+    ensureDir(path36.dirname(path36.resolve(dest2)));
+    fs25.writeFileSync(dest2, generateDrawioXml(buildCanvasModel()), "utf-8");
     logger.success(`draw.io diagram written to ${dest2}`);
     logger.info("Open with draw.io / diagrams.net (or import into tools that accept the format).");
     return;
   }
   if (options.excalidraw && !options.all) {
-    const dest2 = options.out ?? path33.join(AI_PATHS.docsDir(), "diagrams", "architecture.excalidraw");
-    ensureDir(path33.dirname(path33.resolve(dest2)));
-    fs24.writeFileSync(dest2, generateExcalidrawScene(buildCanvasModel()), "utf-8");
+    const dest2 = options.out ?? path36.join(AI_PATHS.docsDir(), "diagrams", "architecture.excalidraw");
+    ensureDir(path36.dirname(path36.resolve(dest2)));
+    fs25.writeFileSync(dest2, generateExcalidrawScene(buildCanvasModel()), "utf-8");
     logger.success(`Excalidraw scene written to ${dest2}`);
     logger.info("Open with excalidraw.com or the VS Code extension.");
     return;
   }
   const wantsMermaid = options.format?.toLowerCase().startsWith("mermaid") || !!options.subsystem || !!options.sequence;
   if (!options.all && !options.sequence && !wantsMermaid) {
-    const dest2 = options.out ?? path33.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
+    const dest2 = options.out ?? path36.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
     writeCanvas(dest2);
     logger.success(`Interactive canvas written to ${dest2}`);
     logger.info("Open it in a browser \u2014 fully self-contained (works offline). Other formats: --format mermaid|drawio|excalidraw.");
     return;
   }
   if (options.all) {
-    const outDir = options.out ?? path33.join(AI_PATHS.docsDir(), "diagrams");
+    const outDir = options.out ?? path36.join(AI_PATHS.docsDir(), "diagrams");
     const files = generateDiagramSet();
     if (files.length === 0) {
       logger.warn("No diagrams to generate \u2014 the spec tree has no components yet.");
       return;
     }
     for (const file of files) {
-      const dest2 = path33.join(outDir, file.relPath);
-      ensureDir(path33.dirname(dest2));
-      fs24.writeFileSync(dest2, toMarkdown(file), "utf-8");
+      const dest2 = path36.join(outDir, file.relPath);
+      ensureDir(path36.dirname(dest2));
+      fs25.writeFileSync(dest2, toMarkdown(file), "utf-8");
     }
-    writeCanvas(path33.join(outDir, "canvas.html"));
+    writeCanvas(path36.join(outDir, "canvas.html"));
     const exportModel = buildCanvasModel();
-    fs24.writeFileSync(path33.join(outDir, "architecture.drawio"), generateDrawioXml(exportModel), "utf-8");
-    fs24.writeFileSync(path33.join(outDir, "architecture.excalidraw"), generateExcalidrawScene(exportModel), "utf-8");
+    fs25.writeFileSync(path36.join(outDir, "architecture.drawio"), generateDrawioXml(exportModel), "utf-8");
+    fs25.writeFileSync(path36.join(outDir, "architecture.excalidraw"), generateExcalidrawScene(exportModel), "utf-8");
     const graph = loadSpecGraph();
-    const indexPath = path33.join(outDir, "README.md");
-    fs24.writeFileSync(indexPath, diagramSetIndex(files, graph.systemName), "utf-8");
+    const indexPath = path36.join(outDir, "README.md");
+    fs25.writeFileSync(indexPath, diagramSetIndex(files, graph.systemName), "utf-8");
     logger.success(`Generated ${files.length} diagram(s) + interactive canvas.html + index into ${outDir}`);
     for (const file of files.slice(0, 12)) {
       logger.info(`  ${file.relPath}`);
@@ -26234,26 +26549,26 @@ async function runDiagram(rawOptions = {}) {
   let mermaid;
   let title;
   let defaultDest;
-  const diagramsDir = path33.join(AI_PATHS.docsDir(), "diagrams");
+  const diagramsDir = path36.join(AI_PATHS.docsDir(), "diagrams");
   if (options.sequence) {
     const { component, method: method2 } = parseSequenceRef(options.sequence);
     mermaid = generateSequenceDiagram(component, method2, { depth: options.depth });
     title = `${component}.${method2} \u2014 narrative sequence`;
-    defaultDest = path33.join(diagramsDir, "sequences", `${component.replace(/::/g, "--")}.${method2}.md`);
+    defaultDest = path36.join(diagramsDir, "sequences", `${component.replace(/::/g, "--")}.${method2}.md`);
   } else if (options.subsystem) {
     mermaid = generateComponentDiagram({ subsystem: options.subsystem });
     title = `${options.subsystem} \u2014 components`;
-    defaultDest = path33.join(diagramsDir, "subsystems", `${options.subsystem.replace(/::/g, "--")}.md`);
+    defaultDest = path36.join(diagramsDir, "subsystems", `${options.subsystem.replace(/::/g, "--")}.md`);
   } else {
     mermaid = generateComponentDiagram();
     title = "Component architecture";
-    defaultDest = path33.join(diagramsDir, "system.md");
+    defaultDest = path36.join(diagramsDir, "system.md");
   }
   const dest = options.out ?? defaultDest;
-  ensureDir(path33.dirname(path33.resolve(dest)));
+  ensureDir(path36.dirname(path36.resolve(dest)));
   const content = dest.endsWith(".mmd") ? `${mermaid}
 ` : toMarkdown({ relPath: dest, title, mermaid });
-  fs24.writeFileSync(dest, content, "utf-8");
+  fs25.writeFileSync(dest, content, "utf-8");
   logger.success(`Mermaid diagram written to ${dest}`);
   logger.info("Renders on GitHub/IDE previews; use a .mmd --out path for raw Mermaid.");
 }
@@ -26362,9 +26677,9 @@ Component variants (${variants.length})
 }
 
 // src/commands/packs.ts
-var fs25 = __toESM(require("fs"));
-var os10 = __toESM(require("os"));
-var path34 = __toESM(require("path"));
+var fs26 = __toESM(require("fs"));
+var os11 = __toESM(require("os"));
+var path37 = __toESM(require("path"));
 var import_chalk16 = __toESM(require("chalk"));
 var import_sdk = __toESM(require_dist());
 init_logger();
@@ -26390,11 +26705,11 @@ function describe(probe2) {
   return parts.join(", ");
 }
 function resolveSourceUnit(source) {
-  const abs = path34.resolve(source);
-  if (!fs25.existsSync(abs)) {
+  const abs = path37.resolve(source);
+  if (!fs26.existsSync(abs)) {
     throw new Error(`Pack source "${source}" does not exist.`);
   }
-  const isDir = fs25.statSync(abs).isDirectory();
+  const isDir = fs26.statSync(abs).isDirectory();
   if (isDir && !packDirEntry(abs)) {
     throw new Error(`"${source}" is a directory without a pack entry file (pack.yaml | pack.cjs | index.cjs | ...).`);
   }
@@ -26410,7 +26725,7 @@ async function addPack(source, options = {}) {
   }
   const { abs } = resolveSourceUnit(source);
   const scope = options.global ? "global" : "project";
-  const probe2 = probePack(abs, path34.dirname(abs), scope);
+  const probe2 = probePack(abs, path37.dirname(abs), scope);
   if (probe2.error) {
     logger.error(probe2.error);
     process.exitCode = 1;
@@ -26418,10 +26733,10 @@ async function addPack(source, options = {}) {
   }
   if (options.global) {
     const destDir = globalPacksDir();
-    const dest2 = path34.join(destDir, path34.basename(abs));
-    if (path34.resolve(dest2) !== abs) {
-      fs25.mkdirSync(destDir, { recursive: true });
-      fs25.cpSync(abs, dest2, { recursive: true, force: true });
+    const dest2 = path37.join(destDir, path37.basename(abs));
+    if (path37.resolve(dest2) !== abs) {
+      fs26.mkdirSync(destDir, { recursive: true });
+      fs26.cpSync(abs, dest2, { recursive: true, force: true });
     }
     logger.success(`Installed pack "${probe2.name}" globally: ${dest2}`);
     logger.info(`${describe(probe2)} \u2014 auto-loaded for every project on this machine (WAIRON_PACKS_DIR / ~/.wairon/packs).`);
@@ -26434,11 +26749,11 @@ async function addPack(source, options = {}) {
     return;
   }
   const root = getProjectRoot();
-  const relRef = `.wai/packs/${path34.basename(abs)}`;
-  const dest = path34.join(root, ".wai", "packs", path34.basename(abs));
-  if (path34.resolve(dest) !== abs) {
-    fs25.mkdirSync(path34.dirname(dest), { recursive: true });
-    fs25.cpSync(abs, dest, { recursive: true, force: true });
+  const relRef = `.wai/packs/${path37.basename(abs)}`;
+  const dest = path37.join(root, ".wai", "packs", path37.basename(abs));
+  if (path37.resolve(dest) !== abs) {
+    fs26.mkdirSync(path37.dirname(dest), { recursive: true });
+    fs26.cpSync(abs, dest, { recursive: true, force: true });
   }
   const config = loadProjectConfig();
   const packs = config.extensions?.packs ?? [];
@@ -26447,14 +26762,14 @@ async function addPack(source, options = {}) {
     saveProjectConfig(config);
     logger.success(`Vendored pack "${probe2.name}" into ${relRef} and registered it in .wai/project.yaml.`);
   } else {
-    fs25.cpSync(abs, dest, { recursive: true, force: true });
+    fs26.cpSync(abs, dest, { recursive: true, force: true });
     logger.success(`Pack "${probe2.name}" already registered \u2014 refreshed ${relRef} from the source.`);
   }
   logger.info(`${describe(probe2)} \u2014 commit .wai/ so CI and every clone enforce it.`);
 }
 async function addPackFromArchive(source, options) {
-  const abs = path34.resolve(source);
-  if (!fs25.existsSync(abs) || !fs25.statSync(abs).isFile()) {
+  const abs = path37.resolve(source);
+  if (!fs26.existsSync(abs) || !fs26.statSync(abs).isFile()) {
     logger.error(`Pack archive "${source}" does not exist.`);
     process.exitCode = 1;
     return;
@@ -26469,27 +26784,27 @@ async function addPackFromArchive(source, options) {
       process.exitCode = 1;
       return;
     }
-    baseDir = path34.join(getProjectRoot(), ".wai", "packs");
+    baseDir = path37.join(getProjectRoot(), ".wai", "packs");
   }
-  const bytes = fs25.readFileSync(abs);
-  fs25.mkdirSync(baseDir, { recursive: true });
-  const staging = fs25.mkdtempSync(path34.join(baseDir, ".wpack-staging-"));
+  const bytes = fs26.readFileSync(abs);
+  fs26.mkdirSync(baseDir, { recursive: true });
+  const staging = fs26.mkdtempSync(path37.join(baseDir, ".wpack-staging-"));
   let result;
   try {
     result = (0, import_sdk.extractPack)(bytes, staging);
   } catch (err) {
-    fs25.rmSync(staging, { recursive: true, force: true });
-    logger.error(`Failed to extract pack archive "${path34.basename(abs)}": ${err instanceof Error ? err.message : String(err)}`);
+    fs26.rmSync(staging, { recursive: true, force: true });
+    logger.error(`Failed to extract pack archive "${path37.basename(abs)}": ${err instanceof Error ? err.message : String(err)}`);
     process.exitCode = 1;
     return;
   }
   const name = result.name;
-  const destDir = path34.join(baseDir, name);
-  if (fs25.existsSync(destDir)) fs25.rmSync(destDir, { recursive: true, force: true });
-  fs25.renameSync(staging, destDir);
-  const probe2 = probePack(destDir, path34.dirname(destDir), scope);
+  const destDir = path37.join(baseDir, name);
+  if (fs26.existsSync(destDir)) fs26.rmSync(destDir, { recursive: true, force: true });
+  fs26.renameSync(staging, destDir);
+  const probe2 = probePack(destDir, path37.dirname(destDir), scope);
   if (probe2.error) {
-    fs25.rmSync(destDir, { recursive: true, force: true });
+    fs26.rmSync(destDir, { recursive: true, force: true });
     logger.error(probe2.error);
     process.exitCode = 1;
     return;
@@ -26507,7 +26822,7 @@ async function addPackFromArchive(source, options) {
     saveProjectConfig(config);
     logger.success(`Installed pack "${probe2.name ?? name}" into ${relRef} and registered it in .wai/project.yaml.`);
   } else {
-    logger.success(`Pack "${probe2.name ?? name}" already registered \u2014 refreshed ${relRef} from ${path34.basename(abs)}.`);
+    logger.success(`Pack "${probe2.name ?? name}" already registered \u2014 refreshed ${relRef} from ${path37.basename(abs)}.`);
   }
   logger.info(`${describe(probe2)} \u2014 commit .wai/ so CI and every clone enforce it.`);
 }
@@ -26528,7 +26843,7 @@ async function buildPack(source, options = {}) {
   const sourceDir = source && source.length > 0 ? source : ".";
   const result = (0, import_sdk.buildPack)(sourceDir);
   const outPath = options.out ?? result.suggestedFileName;
-  fs25.writeFileSync(outPath, result.archive);
+  fs26.writeFileSync(outPath, result.archive);
   logger.success(`Built pack "${result.info.name}" v${result.info.version} \u2192 ${outPath} (${result.archive.byteLength} bytes)`);
   logger.info(`Install it with \`wairon pack add ${outPath}\`, or upload it to a hosted instance.`);
 }
@@ -26539,8 +26854,8 @@ function expandSource(source, version) {
   return source.replace(/\{version\}/g, version ?? "").replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, name) => process.env[name] ?? "");
 }
 async function fetchArchive(url) {
-  const dir = fs25.mkdtempSync(path34.join(os10.tmpdir(), "wairon-packdl-"));
-  const dest = path34.join(dir, "pack.wpack");
+  const dir = fs26.mkdtempSync(path37.join(os11.tmpdir(), "wairon-packdl-"));
+  const dest = path37.join(dir, "pack.wpack");
   await downloadFile(url, dest);
   return dest;
 }
@@ -26559,7 +26874,7 @@ async function installPack(source) {
     }
     const extracted = extractArchiveToTemp(archive);
     try {
-      fs25.rmSync(path34.dirname(archive), { recursive: true, force: true });
+      fs26.rmSync(path37.dirname(archive), { recursive: true, force: true });
     } catch {
     }
     if (!extracted) return;
@@ -26571,7 +26886,7 @@ async function installPack(source) {
       process.exitCode = 1;
     } finally {
       try {
-        fs25.rmSync(extracted.dir, { recursive: true, force: true });
+        fs26.rmSync(extracted.dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -26582,7 +26897,7 @@ async function installPack(source) {
     if (!extracted) return;
     sourceDir = extracted.dir;
     cleanup = extracted.dir;
-    origin = path34.resolve(source);
+    origin = path37.resolve(source);
   } else {
     let unit;
     try {
@@ -26608,7 +26923,7 @@ async function installPack(source) {
   } finally {
     if (cleanup) {
       try {
-        fs25.rmSync(cleanup, { recursive: true, force: true });
+        fs26.rmSync(cleanup, { recursive: true, force: true });
       } catch {
       }
     }
@@ -26625,20 +26940,20 @@ function reportInstalled(installed, origin) {
   }
 }
 function extractArchiveToTemp(source) {
-  const abs = path34.resolve(source);
-  if (!fs25.existsSync(abs)) {
+  const abs = path37.resolve(source);
+  if (!fs26.existsSync(abs)) {
     logger.error(`Pack archive "${source}" does not exist.`);
     process.exitCode = 1;
     return null;
   }
-  const tempDir = fs25.mkdtempSync(path34.join(os10.tmpdir(), "wairon-packinstall-"));
+  const tempDir = fs26.mkdtempSync(path37.join(os11.tmpdir(), "wairon-packinstall-"));
   try {
-    const result = (0, import_sdk.extractPack)(new Uint8Array(fs25.readFileSync(abs)), tempDir);
+    const result = (0, import_sdk.extractPack)(new Uint8Array(fs26.readFileSync(abs)), tempDir);
     void result;
     return { dir: tempDir };
   } catch (e) {
     try {
-      fs25.rmSync(tempDir, { recursive: true, force: true });
+      fs26.rmSync(tempDir, { recursive: true, force: true });
     } catch {
     }
     logger.error(`Could not extract "${source}": ${e instanceof Error ? e.message : String(e)}`);
@@ -26784,7 +27099,7 @@ async function fetchAndInstall(selection, url) {
   const archive = await fetchArchive(url);
   const extracted = extractArchiveToTemp(archive);
   try {
-    fs25.rmSync(path34.dirname(archive), { recursive: true, force: true });
+    fs26.rmSync(path37.dirname(archive), { recursive: true, force: true });
   } catch {
   }
   if (!extracted) return null;
@@ -26796,7 +27111,7 @@ async function fetchAndInstall(selection, url) {
     return pack;
   } finally {
     try {
-      fs25.rmSync(extracted.dir, { recursive: true, force: true });
+      fs26.rmSync(extracted.dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -26807,10 +27122,10 @@ function bundleTargets(selections, name, all) {
   return selections.filter((s) => s.bundle === true);
 }
 function writeBundle(root, resolved) {
-  const dest = path34.join(root, ".wai", "packs", resolved.name, resolved.version);
-  fs25.rmSync(dest, { recursive: true, force: true });
-  fs25.mkdirSync(path34.dirname(dest), { recursive: true });
-  fs25.cpSync(resolved.path, dest, { recursive: true });
+  const dest = path37.join(root, ".wai", "packs", resolved.name, resolved.version);
+  fs26.rmSync(dest, { recursive: true, force: true });
+  fs26.mkdirSync(path37.dirname(dest), { recursive: true });
+  fs26.cpSync(resolved.path, dest, { recursive: true });
   return dest;
 }
 async function bundlePack(name, options = {}) {
@@ -26841,7 +27156,7 @@ async function bundlePack(name, options = {}) {
     selection.version = resolved.version;
     selection.bundle = true;
     bundled.push(`${resolved.name}@${resolved.version}`);
-    console.log(`  ${import_chalk16.default.green("+")} ${import_chalk16.default.dim(path34.relative(root, dest).replace(/\\/g, "/"))}`);
+    console.log(`  ${import_chalk16.default.green("+")} ${import_chalk16.default.dim(path37.relative(root, dest).replace(/\\/g, "/"))}`);
   }
   if (bundled.length === 0) return;
   config.extensions = { packs: entries, useGlobalPacks: globalPacksEnabled(config) };
@@ -26883,9 +27198,9 @@ async function listPacks() {
   console.log(import_chalk16.default.bold.cyan(`\u25A0 Global (${globalPacksDir()})${useGlobal ? "" : import_chalk16.default.yellow("  [disabled: extensions.useGlobalPacks: false]")}`));
   if (globalRefs.length === 0) console.log(import_chalk16.default.dim("  (none)"));
   for (const ref of globalRefs) {
-    const probe2 = probePack(ref, path34.dirname(ref), "global");
-    if (probe2.error) console.log(`  ${import_chalk16.default.red("\u2716")} ${path34.basename(ref)} \u2014 ${import_chalk16.default.red(probe2.error)}`);
-    else console.log(`  ${import_chalk16.default.green("\u25CF")} ${import_chalk16.default.bold(probe2.name ?? path34.basename(ref))}  ${import_chalk16.default.dim(describe(probe2))}`);
+    const probe2 = probePack(ref, path37.dirname(ref), "global");
+    if (probe2.error) console.log(`  ${import_chalk16.default.red("\u2716")} ${path37.basename(ref)} \u2014 ${import_chalk16.default.red(probe2.error)}`);
+    else console.log(`  ${import_chalk16.default.green("\u25CF")} ${import_chalk16.default.bold(probe2.name ?? path37.basename(ref))}  ${import_chalk16.default.dim(describe(probe2))}`);
   }
   console.log("");
   if (!inProject) {
@@ -26913,9 +27228,9 @@ async function listPacks() {
 async function removePack(name, options = {}) {
   if (options.global) {
     for (const ref of discoverPacks(globalPacksDir())) {
-      const probe2 = probePack(ref, path34.dirname(ref), "global");
-      if (probe2.name === name || path34.basename(ref) === name) {
-        fs25.rmSync(ref, { recursive: true, force: true });
+      const probe2 = probePack(ref, path37.dirname(ref), "global");
+      if (probe2.name === name || path37.basename(ref) === name) {
+        fs26.rmSync(ref, { recursive: true, force: true });
         logger.success(`Removed global pack "${probe2.name ?? name}" (${ref}).`);
         return;
       }
@@ -26936,16 +27251,16 @@ async function removePack(name, options = {}) {
     if (typeof entry !== "string") continue;
     const ref = entry;
     const probe2 = probePack(ref, root, "project");
-    if (probe2.name === name || ref === name || path34.basename(ref) === name) {
+    if (probe2.name === name || ref === name || path37.basename(ref) === name) {
       config.extensions = {
         packs: packs.filter((p) => p !== ref),
         useGlobalPacks: globalPacksEnabled(config)
       };
       saveProjectConfig(config);
-      const resolved = path34.resolve(root, ref);
-      const vendorDir = path34.resolve(root, ".wai", "packs");
-      if (resolved.startsWith(vendorDir + path34.sep)) {
-        fs25.rmSync(resolved, { recursive: true, force: true });
+      const resolved = path37.resolve(root, ref);
+      const vendorDir = path37.resolve(root, ".wai", "packs");
+      if (resolved.startsWith(vendorDir + path37.sep)) {
+        fs26.rmSync(resolved, { recursive: true, force: true });
         logger.success(`Deregistered pack "${probe2.name ?? name}" and deleted ${ref}.`);
       } else {
         logger.success(`Deregistered pack "${probe2.name ?? name}" (files at ${ref} left in place).`);
@@ -26958,22 +27273,22 @@ async function removePack(name, options = {}) {
 }
 
 // src/commands/host.ts
-var fs52 = __toESM(require("fs"));
-var path61 = __toESM(require("path"));
-var os11 = __toESM(require("os"));
-var crypto21 = __toESM(require("crypto"));
+var fs53 = __toESM(require("fs"));
+var path64 = __toESM(require("path"));
+var os12 = __toESM(require("os"));
+var crypto22 = __toESM(require("crypto"));
 var import_child_process5 = require("child_process");
 var import_chalk17 = __toESM(require("chalk"));
 init_logger();
 init_errors();
 
 // src/server/admin.ts
-var crypto8 = __toESM(require("crypto"));
+var crypto9 = __toESM(require("crypto"));
 init_fs();
 init_defaults();
 
 // src/server/auth.ts
-var crypto6 = __toESM(require("crypto"));
+var crypto7 = __toESM(require("crypto"));
 
 // src/server/types.ts
 var SSO_ADMIN_ROLE_ID = "sso-admin";
@@ -26986,35 +27301,35 @@ var UNAUTHENTICATED = {
 var WEB_SESSION_PREFIX = "ws_";
 
 // src/server/credentials.ts
-var fs26 = __toESM(require("fs"));
-var path35 = __toESM(require("path"));
-var crypto4 = __toESM(require("crypto"));
+var fs27 = __toESM(require("fs"));
+var path38 = __toESM(require("path"));
+var crypto5 = __toESM(require("crypto"));
 var HASH_NS = "wairon:token:v1";
 function hashToken(token) {
-  return crypto4.createHash("sha256").update(`${HASH_NS}:${token}`).digest("hex");
+  return crypto5.createHash("sha256").update(`${HASH_NS}:${token}`).digest("hex");
 }
 function storePath(dataDir) {
-  return path35.join(dataDir, "auth", "credentials.json");
+  return path38.join(dataDir, "auth", "credentials.json");
 }
 function load3(dataDir) {
   try {
-    return JSON.parse(fs26.readFileSync(storePath(dataDir), "utf8"));
+    return JSON.parse(fs27.readFileSync(storePath(dataDir), "utf8"));
   } catch {
     return [];
   }
 }
 function save(dataDir, records) {
   const p = storePath(dataDir);
-  fs26.mkdirSync(path35.dirname(p), { recursive: true });
+  fs27.mkdirSync(path38.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs26.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs26.renameSync(tmp, p);
+  fs27.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs27.renameSync(tmp, p);
 }
 function digestEquals(a, b) {
   const ab = Buffer.from(a, "hex");
   const bb = Buffer.from(b, "hex");
   if (ab.length === 0 || ab.length !== bb.length) return false;
-  return crypto4.timingSafeEqual(ab, bb);
+  return crypto5.timingSafeEqual(ab, bb);
 }
 function findByTokenHash(dataDir, tokenHash) {
   return load3(dataDir).find((r) => digestEquals(r.keyHash, tokenHash)) ?? null;
@@ -27053,17 +27368,17 @@ function listByOwner(dataDir, ownerUserId) {
 }
 
 // src/server/websessions.ts
-var fs27 = __toESM(require("fs"));
-var path36 = __toESM(require("path"));
-var crypto5 = __toESM(require("crypto"));
+var fs28 = __toESM(require("fs"));
+var path39 = __toESM(require("path"));
+var crypto6 = __toESM(require("crypto"));
 function storePath2(dataDir) {
-  return path36.join(dataDir, "web-sessions.json");
+  return path39.join(dataDir, "web-sessions.json");
 }
 function readSessions(dataDir) {
   const p = storePath2(dataDir);
   let raw;
   try {
-    raw = fs27.readFileSync(p, "utf8");
+    raw = fs28.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read web session store at ${p}: ${e.message}`);
@@ -27078,13 +27393,13 @@ function readSessions(dataDir) {
 }
 function persistSessions(dataDir, sessions) {
   const p = storePath2(dataDir);
-  fs27.mkdirSync(path36.dirname(p), { recursive: true });
+  fs28.mkdirSync(path39.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs27.writeFileSync(tmp, JSON.stringify(sessions, null, 2) + "\n");
-  fs27.renameSync(tmp, p);
+  fs28.writeFileSync(tmp, JSON.stringify(sessions, null, 2) + "\n");
+  fs28.renameSync(tmp, p);
 }
 function mintSessionId() {
-  return `${WEB_SESSION_PREFIX}${crypto5.randomBytes(24).toString("hex")}`;
+  return `${WEB_SESSION_PREFIX}${crypto6.randomBytes(24).toString("hex")}`;
 }
 var WebSessionStore = class {
   constructor(dataDir) {
@@ -27242,17 +27557,17 @@ function listWebSessionsBySubject(dataDir, userId) {
 }
 
 // src/server/users.ts
-var fs28 = __toESM(require("fs"));
-var path37 = __toESM(require("path"));
+var fs29 = __toESM(require("fs"));
+var path40 = __toESM(require("path"));
 var VALID_STATUSES = ["active", "inactive", "suspended", "deactivated", "disabled"];
 function storePath3(dataDir) {
-  return path37.join(dataDir, "users.json");
+  return path40.join(dataDir, "users.json");
 }
 function loadStore(dataDir) {
   const p = storePath3(dataDir);
   let raw;
   try {
-    raw = fs28.readFileSync(p, "utf8");
+    raw = fs29.readFileSync(p, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw new Error(`Cannot read hosted-user store at ${p}: ${err.message}`);
@@ -27270,10 +27585,10 @@ function loadStore(dataDir) {
 }
 function replaceAll(dataDir, records) {
   const p = storePath3(dataDir);
-  fs28.mkdirSync(path37.dirname(p), { recursive: true });
+  fs29.mkdirSync(path40.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs28.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs28.renameSync(tmp, p);
+  fs29.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs29.renameSync(tmp, p);
 }
 function registryUpsert(dataDir, record2) {
   const records = loadStore(dataDir);
@@ -27375,11 +27690,11 @@ function remapUnitReferences(dataDir, remap, removedScopeIds) {
 }
 
 // src/server/instance.ts
-var fs29 = __toESM(require("fs"));
-var path38 = __toESM(require("path"));
+var fs30 = __toESM(require("fs"));
+var path41 = __toESM(require("path"));
 var import_crypto = require("crypto");
 function storePath4(dataDir) {
-  return path38.join(dataDir, "instance.json");
+  return path41.join(dataDir, "instance.json");
 }
 var InstanceIdentityStore = class {
   constructor(dataDir) {
@@ -27396,7 +27711,7 @@ var InstanceIdentityStore = class {
     const p = storePath4(this.dataDir);
     let raw;
     try {
-      raw = fs29.readFileSync(p, "utf8");
+      raw = fs30.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw new Error(`Cannot read instance identity at ${p}: ${err.message}`);
@@ -27419,10 +27734,10 @@ var InstanceIdentityStore = class {
    *  never truncates the file. Only called by the registry's create-once seed. */
   replace(identity) {
     const p = storePath4(this.dataDir);
-    fs29.mkdirSync(path38.dirname(p), { recursive: true });
+    fs30.mkdirSync(path41.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
-    fs29.writeFileSync(tmp, JSON.stringify(identity, null, 2) + "\n");
-    fs29.renameSync(tmp, p);
+    fs30.writeFileSync(tmp, JSON.stringify(identity, null, 2) + "\n");
+    fs30.renameSync(tmp, p);
   }
 };
 var InstanceIdentityRegistry = class {
@@ -27478,8 +27793,8 @@ function getInstanceIdentity(dataDir) {
 }
 
 // src/utils/secrets.ts
-var fs30 = __toESM(require("fs"));
-var path39 = __toESM(require("path"));
+var fs31 = __toESM(require("fs"));
+var path42 = __toESM(require("path"));
 var ENV_FALLBACK = {
   "git-token": ["WAIRON_GIT_TOKEN"],
   "notion-token": ["WAIRON_NOTION_TOKEN"],
@@ -27488,13 +27803,13 @@ var ENV_FALLBACK = {
 };
 function storePath5() {
   const dataDir = process.env["WAIRON_DATA_DIR"];
-  return dataDir ? path39.join(dataDir, "auth", "secrets.json") : null;
+  return dataDir ? path42.join(dataDir, "auth", "secrets.json") : null;
 }
 function readStore() {
   const p = storePath5();
   if (!p) return {};
   try {
-    return JSON.parse(fs30.readFileSync(p, "utf8"));
+    return JSON.parse(fs31.readFileSync(p, "utf8"));
   } catch {
     return {};
   }
@@ -27519,10 +27834,10 @@ function setSecret(key, value) {
   if (!p) throw new Error("WAIRON_DATA_DIR is not set \u2014 a running server needs it to store secrets.");
   const store = readStore();
   store[key] = value;
-  fs30.mkdirSync(path39.dirname(p), { recursive: true });
+  fs31.mkdirSync(path42.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs30.writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n");
-  fs30.renameSync(tmp, p);
+  fs31.writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n");
+  fs31.renameSync(tmp, p);
 }
 function listSecretKeys() {
   return Object.keys(readStore());
@@ -27600,7 +27915,7 @@ function masterMatches(credential) {
   if (!master || !credential) return false;
   const a = Buffer.from(hashToken(credential), "hex");
   const b = Buffer.from(hashToken(master), "hex");
-  return a.length === b.length && crypto6.timingSafeEqual(a, b);
+  return a.length === b.length && crypto7.timingSafeEqual(a, b);
 }
 function bootstrapAdminPrincipal() {
   const subject = {
@@ -27648,7 +27963,7 @@ function authenticateMaster(token) {
 function hashedEquals(a, b) {
   const ha = Buffer.from(hashToken(a), "hex");
   const hb = Buffer.from(hashToken(b), "hex");
-  return ha.length === hb.length && crypto6.timingSafeEqual(ha, hb);
+  return ha.length === hb.length && crypto7.timingSafeEqual(ha, hb);
 }
 function verifyBuiltinAdmin(cfg, user, password) {
   const configuredUser = cfg.builtinAdminUser ?? "";
@@ -27697,16 +28012,16 @@ function signingKey() {
 }
 function signViewToken(project2, format) {
   const body = Buffer.from(JSON.stringify({ project: project2, format, exp: Date.now() + VIEW_TTL_MS })).toString("base64url");
-  const sig = crypto6.createHmac("sha256", signingKey()).update(body).digest("base64url");
+  const sig = crypto7.createHmac("sha256", signingKey()).update(body).digest("base64url");
   return `${body}.${sig}`;
 }
 function verifyViewToken(token) {
   const [body, sig] = String(token).split(".");
   if (!body || !sig) throw new Error("invalid view token");
-  const expected = crypto6.createHmac("sha256", signingKey()).update(body).digest("base64url");
+  const expected = crypto7.createHmac("sha256", signingKey()).update(body).digest("base64url");
   const a = Buffer.from(sig);
   const b = Buffer.from(expected);
-  if (a.length !== b.length || !crypto6.timingSafeEqual(a, b)) throw new Error("invalid view token");
+  if (a.length !== b.length || !crypto7.timingSafeEqual(a, b)) throw new Error("invalid view token");
   const payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
   if (Date.now() > payload.exp) throw new Error("expired view token");
   return { project: payload.project, format: payload.format, expiresAt: new Date(payload.exp).toISOString() };
@@ -27714,33 +28029,33 @@ function verifyViewToken(token) {
 var SSO_STATE_TTL_MS = 10 * 60 * 1e3;
 function signSsoState(payload) {
   const body = Buffer.from(JSON.stringify({ payload, exp: Date.now() + SSO_STATE_TTL_MS })).toString("base64url");
-  const sig = crypto6.createHmac("sha256", signingKey()).update(body).digest("base64url");
+  const sig = crypto7.createHmac("sha256", signingKey()).update(body).digest("base64url");
   return `${body}.${sig}`;
 }
 function verifySsoState(state) {
   const [body, sig] = String(state).split(".");
   if (!body || !sig) throw new Error("invalid SSO state");
-  const expected = crypto6.createHmac("sha256", signingKey()).update(body).digest("base64url");
+  const expected = crypto7.createHmac("sha256", signingKey()).update(body).digest("base64url");
   const a = Buffer.from(sig);
   const b = Buffer.from(expected);
-  if (a.length !== b.length || !crypto6.timingSafeEqual(a, b)) throw new Error("invalid SSO state");
+  if (a.length !== b.length || !crypto7.timingSafeEqual(a, b)) throw new Error("invalid SSO state");
   const parsed = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
   if (Date.now() > parsed.exp) throw new Error("expired SSO state");
   return parsed.payload;
 }
 
 // src/server/organization.ts
-var fs31 = __toESM(require("fs"));
-var path40 = __toESM(require("path"));
-var crypto7 = __toESM(require("crypto"));
+var fs32 = __toESM(require("fs"));
+var path43 = __toESM(require("path"));
+var crypto8 = __toESM(require("crypto"));
 function storePath6(dataDir) {
-  return path40.join(dataDir, "organization.json");
+  return path43.join(dataDir, "organization.json");
 }
 function readState(dataDir) {
   const p = storePath6(dataDir);
   let raw;
   try {
-    raw = fs31.readFileSync(p, "utf8");
+    raw = fs32.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return { units: [], placements: [] };
     throw new Error(`Failed to read organization store at ${p}: ${e.message}`);
@@ -27757,10 +28072,10 @@ function readState(dataDir) {
 }
 function persistState(dataDir, state) {
   const p = storePath6(dataDir);
-  fs31.mkdirSync(path40.dirname(p), { recursive: true });
+  fs32.mkdirSync(path43.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs31.writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n");
-  fs31.renameSync(tmp, p);
+  fs32.writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n");
+  fs32.renameSync(tmp, p);
 }
 var SLUG_PATTERN = /^[a-z0-9-]+$/;
 var UNIT_KINDS = ["business_entity", "department", "team", "group"];
@@ -28055,7 +28370,7 @@ var OrganizationRegistry = class {
       createdAt: placements[existingIdx].createdAt
     } : {
       ...placement,
-      id: placement.id || crypto7.randomUUID(),
+      id: placement.id || crypto8.randomUUID(),
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     const next = isUpdate ? placements.map((p, i) => i === existingIdx ? stored : p) : [...placements, stored];
@@ -28136,11 +28451,11 @@ function getOrganizationUnit(dataDir, id) {
 }
 
 // src/server/permissions.ts
-var fs32 = __toESM(require("fs"));
-var path41 = __toESM(require("path"));
+var fs33 = __toESM(require("fs"));
+var path44 = __toESM(require("path"));
 var import_crypto2 = require("crypto");
 function storePath7(dataDir) {
-  return path41.join(dataDir, "permissions.json");
+  return path44.join(dataDir, "permissions.json");
 }
 function assignmentKey(a) {
   return [a.subjectKind, a.subjectId ?? "", a.scopeKind, a.scopeId ?? "", a.capability].join("|");
@@ -28149,7 +28464,7 @@ function load4(dataDir) {
   const p = storePath7(dataDir);
   let raw;
   try {
-    raw = fs32.readFileSync(p, "utf8");
+    raw = fs33.readFileSync(p, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw new Error(`Cannot read permission store at ${p}: ${err.message}`);
@@ -28167,10 +28482,10 @@ function load4(dataDir) {
 }
 function replaceAll2(dataDir, assignments) {
   const p = storePath7(dataDir);
-  fs32.mkdirSync(path41.dirname(p), { recursive: true });
+  fs33.mkdirSync(path44.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs32.writeFileSync(tmp, JSON.stringify(assignments, null, 2) + "\n");
-  fs32.renameSync(tmp, p);
+  fs33.writeFileSync(tmp, JSON.stringify(assignments, null, 2) + "\n");
+  fs33.renameSync(tmp, p);
 }
 function registrySet(dataDir, assignment) {
   const assignments = load4(dataDir);
@@ -28256,8 +28571,8 @@ function getAssignment(dataDir, assignmentId) {
 }
 
 // src/server/roles.ts
-var fs33 = __toESM(require("fs"));
-var path42 = __toESM(require("path"));
+var fs34 = __toESM(require("fs"));
+var path45 = __toESM(require("path"));
 var BUILTIN_ROLES = [
   {
     id: SSO_ADMIN_ROLE_ID,
@@ -28275,13 +28590,13 @@ function isBuiltinRoleId(roleId) {
   return BUILTIN_ROLE_IDS.has(roleId);
 }
 function storePath8(dataDir) {
-  return path42.join(dataDir, "roles.json");
+  return path45.join(dataDir, "roles.json");
 }
 function load5(dataDir) {
   const p = storePath8(dataDir);
   let raw;
   try {
-    raw = fs33.readFileSync(p, "utf8");
+    raw = fs34.readFileSync(p, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw new Error(`Cannot read role store at ${p}: ${err.message}`);
@@ -28299,10 +28614,10 @@ function load5(dataDir) {
 }
 function replaceAll3(dataDir, roles) {
   const p = storePath8(dataDir);
-  fs33.mkdirSync(path42.dirname(p), { recursive: true });
+  fs34.mkdirSync(path45.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs33.writeFileSync(tmp, JSON.stringify(roles, null, 2) + "\n");
-  fs33.renameSync(tmp, p);
+  fs34.writeFileSync(tmp, JSON.stringify(roles, null, 2) + "\n");
+  fs34.renameSync(tmp, p);
 }
 function registryCreate(dataDir, role) {
   if (isBuiltinRoleId(role.id)) {
@@ -28536,8 +28851,8 @@ function actionableUnitIds(scopes) {
 }
 
 // src/server/projects.ts
-var fs37 = __toESM(require("fs"));
-var path46 = __toESM(require("path"));
+var fs38 = __toESM(require("fs"));
+var path49 = __toESM(require("path"));
 init_loader();
 init_yaml();
 init_fs();
@@ -28556,37 +28871,37 @@ init_types();
 init_server();
 
 // src/git/config.ts
-var fs34 = __toESM(require("fs"));
-var path43 = __toESM(require("path"));
+var fs35 = __toESM(require("fs"));
+var path46 = __toESM(require("path"));
 init_fs();
 function configPath() {
   return aiDir("git.json");
 }
 function readGitConfig() {
   try {
-    return JSON.parse(fs34.readFileSync(configPath(), "utf8"));
+    return JSON.parse(fs35.readFileSync(configPath(), "utf8"));
   } catch {
     return null;
   }
 }
 function writeGitConfig(config) {
   const p = configPath();
-  fs34.mkdirSync(path43.dirname(p), { recursive: true });
+  fs35.mkdirSync(path46.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs34.writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n");
-  fs34.renameSync(tmp, p);
+  fs35.writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n");
+  fs35.renameSync(tmp, p);
 }
 function clearGitConfig() {
   try {
-    fs34.rmSync(configPath(), { force: true });
+    fs35.rmSync(configPath(), { force: true });
   } catch {
   }
 }
 
 // src/git/adapter.ts
 var import_child_process3 = require("child_process");
-var fs35 = __toESM(require("fs"));
-var path44 = __toESM(require("path"));
+var fs36 = __toESM(require("fs"));
+var path47 = __toESM(require("path"));
 init_fs();
 function git(args, cwd) {
   return (0, import_child_process3.execFileSync)("git", args, {
@@ -28638,10 +28953,10 @@ function compareUrl(remote, defaultBranch, workingBranch) {
   return `${web}/compare/${encodeURIComponent(defaultBranch)}...${encodeURIComponent(workingBranch)}`;
 }
 function excludeLocalFiles() {
-  const excludePath = path44.join(getProjectRoot(), ".git", "info", "exclude");
+  const excludePath = path47.join(getProjectRoot(), ".git", "info", "exclude");
   try {
-    fs35.mkdirSync(path44.dirname(excludePath), { recursive: true });
-    fs35.appendFileSync(excludePath, "\n.wai/lock.json\n.wai/git.json\n");
+    fs36.mkdirSync(path47.dirname(excludePath), { recursive: true });
+    fs36.appendFileSync(excludePath, "\n.wai/lock.json\n.wai/git.json\n");
   } catch {
   }
 }
@@ -28706,25 +29021,25 @@ function configureSync(periodicSyncMinutes, skipIfClean) {
 }
 
 // src/producers/config.ts
-var fs36 = __toESM(require("fs"));
-var path45 = __toESM(require("path"));
+var fs37 = __toESM(require("fs"));
+var path48 = __toESM(require("path"));
 init_fs();
 function configPath2() {
   return aiDir("producers.json");
 }
 function load6() {
   try {
-    return JSON.parse(fs36.readFileSync(configPath2(), "utf8"));
+    return JSON.parse(fs37.readFileSync(configPath2(), "utf8"));
   } catch {
     return [];
   }
 }
 function save2(configs) {
   const p = configPath2();
-  fs36.mkdirSync(path45.dirname(p), { recursive: true });
+  fs37.mkdirSync(path48.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs36.writeFileSync(tmp, JSON.stringify(configs, null, 2) + "\n");
-  fs36.renameSync(tmp, p);
+  fs37.writeFileSync(tmp, JSON.stringify(configs, null, 2) + "\n");
+  fs37.renameSync(tmp, p);
 }
 function readProducerConfig(target) {
   return load6().find((c) => c.target === target) ?? null;
@@ -29142,24 +29457,24 @@ function isValidProjectId(id) {
   return typeof id === "string" && ID_RE.test(id);
 }
 function registryPath(dataDir) {
-  return path46.join(dataDir, "projects.json");
+  return path49.join(dataDir, "projects.json");
 }
 function load7(dataDir) {
   try {
-    return JSON.parse(fs37.readFileSync(registryPath(dataDir), "utf8"));
+    return JSON.parse(fs38.readFileSync(registryPath(dataDir), "utf8"));
   } catch {
     return [];
   }
 }
 function save3(dataDir, records) {
   const p = registryPath(dataDir);
-  fs37.mkdirSync(path46.dirname(p), { recursive: true });
+  fs38.mkdirSync(path49.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs37.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs37.renameSync(tmp, p);
+  fs38.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs38.renameSync(tmp, p);
 }
 function projectRoot(dataDir, id) {
-  return path46.join(dataDir, "projects", id);
+  return path49.join(dataDir, "projects", id);
 }
 function existingProjectRoot(dataDir, id) {
   if (!isValidProjectId(id)) return null;
@@ -29175,7 +29490,7 @@ function createProjectRecord(dataDir, id) {
     throw new Error(`Project "${id}" already exists.`);
   }
   const root = projectRoot(dataDir, id);
-  fs37.mkdirSync(root, { recursive: true });
+  fs38.mkdirSync(root, { recursive: true });
   const record2 = {
     id,
     rootPath: root,
@@ -29210,7 +29525,7 @@ function removeProjectRecord(dataDir, id) {
   const rec = records.find((r) => r.id === id);
   if (rec) {
     try {
-      fs37.rmSync(rec.rootPath, { recursive: true, force: true });
+      fs38.rmSync(rec.rootPath, { recursive: true, force: true });
     } catch {
     }
   }
@@ -29226,7 +29541,7 @@ function parseQualifiedSelector(value) {
 }
 function findSubsystemSpec(root, subsystemId) {
   const specsDir = aiPathsAt(root).specsDir();
-  if (!fs37.existsSync(specsDir)) return null;
+  if (!fs38.existsSync(specsDir)) return null;
   for (const file of listFilesRecursive(specsDir, ".yaml")) {
     let raw;
     try {
@@ -29404,9 +29719,9 @@ function mintKey(cfg, credential, project2, role) {
       "instance-wide super-admin (*:*) keys cannot be minted \u2014 the built-in admin account (WAIRON_ADMIN_USER) is the only super-admin"
     );
   }
-  const token = "wk_" + crypto8.randomBytes(24).toString("hex");
+  const token = "wk_" + crypto9.randomBytes(24).toString("hex");
   const record2 = {
-    id: crypto8.randomBytes(6).toString("hex"),
+    id: crypto9.randomBytes(6).toString("hex"),
     keyHash: hashToken(token),
     role,
     projects: project2 === "*" ? ["*"] : [project2],
@@ -29602,31 +29917,10 @@ function diagramViewLink(cfg, credential, project2) {
   if (!existingProjectRoot(cfg.dataDir, project2)) throw new Error(`Unknown project "${project2}".`);
   return `/view/diagram?token=${signViewToken(project2, "canvas")}`;
 }
-function promoteProject(cfg, credential, project2) {
-  const principal = requirePrincipal(cfg, credential);
-  if (authorize(cfg.dataDir, principal, "project:write", "project", project2).value !== "yes") {
-    throw new AdminAuthError("Forbidden \u2014 promoting a project requires project:write over it");
-  }
-  return executeApprovedPromote(cfg, project2);
-}
-function executeApprovedPromote(cfg, projectId, subproject) {
-  const root = boundLifecycleRoot(cfg, projectId, subproject);
-  return runWithProjectRoot(root, () => {
-    const { state, record: lock, current: current2 } = hostCore.readLockState();
-    if (state === "unlocked" || !lock) {
-      return { status: "not-locked", message: "Project is not locked; run lock first." };
-    }
-    if (state === "stale") {
-      return { status: "stale", stateId: current2, message: "Spec tree or governing doctrine changed since lock; re-lock required." };
-    }
-    hostCore.writeLockRecord({ ...lock, status: "promoted" });
-    return { status: "ready", stateId: current2, message: "Locked state matches; change-set marked ready for promotion." };
-  });
-}
 
 // src/server/packs.ts
-var fs38 = __toESM(require("fs"));
-var path47 = __toESM(require("path"));
+var fs39 = __toESM(require("fs"));
+var path50 = __toESM(require("path"));
 init_fs();
 init_yaml();
 init_loader();
@@ -29672,19 +29966,19 @@ function assertNotCodeArchive(info) {
 function extractDeclarativeArchive(archive, destDir) {
   const result = hostSdk.extractArchive(archive, destDir, HOSTED_STRICT_LIMITS);
   try {
-    assertDeclarative(fs38.readFileSync(path47.join(result.directory, result.entryPath), "utf8"));
+    assertDeclarative(fs39.readFileSync(path50.join(result.directory, result.entryPath), "utf8"));
   } catch (e) {
-    fs38.rmSync(destDir, { recursive: true, force: true });
+    fs39.rmSync(destDir, { recursive: true, force: true });
     throw e;
   }
 }
 function probe(loadRef, baseRoot, scope, displayRef) {
   const loaded = hostCore.loadExtensionPacks([{ ref: loadRef, scope }], baseRoot);
   if (loaded.errors.length) {
-    return { name: path47.basename(displayRef), scope, ref: displayRef, profiles: 0, languages: 0, rules: 0, error: loaded.errors[0] };
+    return { name: path50.basename(displayRef), scope, ref: displayRef, profiles: 0, languages: 0, rules: 0, error: loaded.errors[0] };
   }
   return {
-    name: loaded.packNames[0] ?? path47.basename(displayRef),
+    name: loaded.packNames[0] ?? path50.basename(displayRef),
     scope,
     ref: displayRef,
     profiles: Object.keys(loaded.profiles).length,
@@ -29698,20 +29992,20 @@ function probe(loadRef, baseRoot, scope, displayRef) {
   };
 }
 function writeFileAtomic(file, content) {
-  fs38.mkdirSync(path47.dirname(file), { recursive: true });
+  fs39.mkdirSync(path50.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
-  fs38.writeFileSync(tmp, content);
-  fs38.renameSync(tmp, file);
+  fs39.writeFileSync(tmp, content);
+  fs39.renameSync(tmp, file);
 }
 function stem(ref) {
-  return path47.basename(ref).replace(PACK_EXT_RE, "");
+  return path50.basename(ref).replace(PACK_EXT_RE, "");
 }
 function imagePacksDir() {
   return process.env.WAIRON_IMAGE_PACKS_DIR ?? "/opt/wairon/packs";
 }
 function probeTier(dir, tier) {
   return hostCore.discoverPacks(dir).map((full) => {
-    const d = probe(full, path47.dirname(full), "global", path47.basename(full));
+    const d = probe(full, path50.dirname(full), "global", path50.basename(full));
     d.tier = tier;
     return d;
   });
@@ -29729,9 +30023,9 @@ function scanGlobalPackProfiles() {
   for (const dir of [hostCore.globalPacksDir(), imagePacksDir()]) {
     for (const full of hostCore.discoverPacks(dir)) {
       try {
-        const loaded = hostCore.loadExtensionPacks([{ ref: full, scope: "global" }], path47.dirname(full));
+        const loaded = hostCore.loadExtensionPacks([{ ref: full, scope: "global" }], path50.dirname(full));
         if (loaded.errors.length) continue;
-        const source = loaded.packNames[0] ?? path47.basename(full);
+        const source = loaded.packNames[0] ?? path50.basename(full);
         for (const [id, def] of Object.entries(loaded.profiles)) out.push({ id, source, family: def.family });
       } catch {
       }
@@ -29783,12 +30077,12 @@ function storeListProjectProfiles() {
   return out;
 }
 function readPackContent(full) {
-  const st = fs38.statSync(full);
-  if (st.isFile()) return fs38.readFileSync(full, "utf8");
+  const st = fs39.statSync(full);
+  if (st.isFile()) return fs39.readFileSync(full, "utf8");
   if (st.isDirectory()) {
     for (const entry of ["pack.yaml", "pack.yml"]) {
-      const p = path47.join(full, entry);
-      if (fs38.existsSync(p) && fs38.statSync(p).isFile()) return fs38.readFileSync(p, "utf8");
+      const p = path50.join(full, entry);
+      if (fs39.existsSync(p) && fs39.statSync(p).isFile()) return fs39.readFileSync(p, "utf8");
     }
   }
   return null;
@@ -29797,9 +30091,9 @@ function storeResolveGlobalPacks(names) {
   const index = /* @__PURE__ */ new Map();
   const indexTier = (dir, tier) => {
     for (const full of hostCore.discoverPacks(dir)) {
-      const manifestName = probe(full, path47.dirname(full), "global", path47.basename(full)).name;
+      const manifestName = probe(full, path50.dirname(full), "global", path50.basename(full)).name;
       const candidate = { full, manifestName, tier };
-      for (const key of [manifestName, stem(full), path47.basename(full)]) {
+      for (const key of [manifestName, stem(full), path50.basename(full)]) {
         if (!index.has(key)) index.set(key, candidate);
       }
     }
@@ -29826,7 +30120,7 @@ function storeInstallGlobalPack(name, content) {
   assertName(name);
   assertDeclarative(content);
   const dir = hostCore.globalPacksDir();
-  const file = path47.join(dir, `${name}.yaml`);
+  const file = path50.join(dir, `${name}.yaml`);
   writeFileAtomic(file, content);
   const descriptor = probe(file, dir, "global", `${name}.yaml`);
   descriptor.tier = "instance";
@@ -29837,7 +30131,7 @@ function storeInstallGlobalPackArchive(archive, name) {
   assertNotCodeArchive(info);
   const packName = name ?? info.name;
   assertName(packName);
-  const dir = path47.join(hostCore.globalPacksDir(), packName);
+  const dir = path50.join(hostCore.globalPacksDir(), packName);
   extractDeclarativeArchive(archive, dir);
   const descriptor = probe(dir, hostCore.globalPacksDir(), "global", packName);
   descriptor.tier = "instance";
@@ -29846,16 +30140,16 @@ function storeInstallGlobalPackArchive(archive, name) {
 function storeRemoveGlobalPack(name) {
   assertName(name);
   const dir = hostCore.globalPacksDir();
-  const match = hostCore.discoverPacks(dir).find((ref) => stem(ref) === name || path47.basename(ref) === name);
+  const match = hostCore.discoverPacks(dir).find((ref) => stem(ref) === name || path50.basename(ref) === name);
   if (!match) {
     const inImage = hostCore.discoverPacks(imagePacksDir()).some(
-      (ref) => stem(ref) === name || path47.basename(ref) === name
+      (ref) => stem(ref) === name || path50.basename(ref) === name
     );
     throw new Error(
       inImage ? `Pack "${name}" is an immutable image-layer pack (WAIRON_IMAGE_PACKS_DIR) and cannot be removed at runtime; rebuild the extension image without it.` : `No server-global instance pack named "${name}".`
     );
   }
-  fs38.rmSync(match, { recursive: true, force: true });
+  fs39.rmSync(match, { recursive: true, force: true });
 }
 function storeListProjectPacks() {
   const root = getProjectRoot();
@@ -29871,7 +30165,7 @@ function storeInstallProjectPack(name, content) {
   assertDeclarative(content);
   const root = getProjectRoot();
   const relRef = `.wai/packs/${name}.yaml`;
-  writeFileAtomic(path47.join(root, ".wai", "packs", `${name}.yaml`), content);
+  writeFileAtomic(path50.join(root, ".wai", "packs", `${name}.yaml`), content);
   const config = loadProjectConfig();
   const packs = config.extensions?.packs ?? [];
   if (!packs.includes(relRef)) {
@@ -29887,7 +30181,7 @@ function storeInstallProjectPackArchive(archive, name) {
   assertName(packName);
   const root = getProjectRoot();
   const relRef = `.wai/packs/${packName}`;
-  extractDeclarativeArchive(archive, path47.join(root, ".wai", "packs", packName));
+  extractDeclarativeArchive(archive, path50.join(root, ".wai", "packs", packName));
   const config = loadProjectConfig();
   const packs = config.extensions?.packs ?? [];
   if (!packs.includes(relRef)) {
@@ -29902,18 +30196,18 @@ function storeRemoveProjectPack(name) {
   const config = loadProjectConfig();
   const packs = config.extensions?.packs ?? [];
   const relRef = `.wai/packs/${name}.yaml`;
-  const match = packs.find((entry) => typeof entry === "string" ? entry === relRef || stem(entry) === name || path47.basename(entry) === name : entry.name === name);
+  const match = packs.find((entry) => typeof entry === "string" ? entry === relRef || stem(entry) === name || path50.basename(entry) === name : entry.name === name);
   if (!match) throw new Error(`Project has no registered pack named "${name}".`);
   config.extensions = { packs: packs.filter((entry) => entry !== match), useGlobalPacks: hostCore.globalPacksEnabled(config) };
   saveProjectConfig(config);
-  const resolved = path47.resolve(root, typeof match === "string" ? match : path47.join(".wai", "packs", match.name));
-  const vendorDir = path47.resolve(root, ".wai", "packs");
-  if (resolved.startsWith(vendorDir + path47.sep)) {
-    fs38.rmSync(resolved, { recursive: true, force: true });
+  const resolved = path50.resolve(root, typeof match === "string" ? match : path50.join(".wai", "packs", match.name));
+  const vendorDir = path50.resolve(root, ".wai", "packs");
+  if (resolved.startsWith(vendorDir + path50.sep)) {
+    fs39.rmSync(resolved, { recursive: true, force: true });
   }
 }
 function readProjectReferences(rootPath) {
-  const projectId = path47.basename(rootPath);
+  const projectId = path50.basename(rootPath);
   const empty = { projectId, packNames: [] };
   try {
     return runWithProjectRoot(rootPath, () => {
@@ -30036,9 +30330,9 @@ function installProjectPackArchive(cfg, credential, project2, archive, name) {
 }
 
 // src/server/audit.ts
-var fs39 = __toESM(require("fs"));
-var path48 = __toESM(require("path"));
-var crypto9 = __toESM(require("crypto"));
+var fs40 = __toESM(require("fs"));
+var path51 = __toESM(require("path"));
+var crypto10 = __toESM(require("crypto"));
 var LEVEL_ORDER = {
   debug: 0,
   info: 1,
@@ -30060,13 +30354,13 @@ var DEFAULT_AUDIT_POLICY = {
   metadataMode: "redacted"
 };
 function storePath9(dataDir) {
-  return path48.join(dataDir, "audit-events.json");
+  return path51.join(dataDir, "audit-events.json");
 }
 function readEvents(dataDir) {
   const p = storePath9(dataDir);
   let raw;
   try {
-    raw = fs39.readFileSync(p, "utf8");
+    raw = fs40.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read audit store at ${p}: ${e.message}`);
@@ -30081,10 +30375,10 @@ function readEvents(dataDir) {
 }
 function persistEvents(dataDir, events) {
   const p = storePath9(dataDir);
-  fs39.mkdirSync(path48.dirname(p), { recursive: true });
+  fs40.mkdirSync(path51.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs39.writeFileSync(tmp, JSON.stringify(events, null, 2) + "\n");
-  fs39.renameSync(tmp, p);
+  fs40.writeFileSync(tmp, JSON.stringify(events, null, 2) + "\n");
+  fs40.renameSync(tmp, p);
 }
 var SECRET_RE = /Bearer\s+\S/i;
 var LONG_HEX_RE = /[0-9a-fA-F]{32,}/;
@@ -30142,7 +30436,7 @@ var AuditRegistry = class {
     }
     const stamped = {
       ...event,
-      id: event.id && event.id.length > 0 ? event.id : crypto9.randomUUID(),
+      id: event.id && event.id.length > 0 ? event.id : crypto10.randomUUID(),
       timestamp: event.timestamp && event.timestamp.length > 0 ? event.timestamp : (/* @__PURE__ */ new Date()).toISOString(),
       metadata
     };
@@ -30409,10 +30703,10 @@ function unbindRole(cfg, credential, userId, roleId, scopeKind, scopeId) {
 }
 
 // src/server/identity.ts
-var crypto11 = __toESM(require("crypto"));
+var crypto12 = __toESM(require("crypto"));
 
 // src/server/idp.ts
-var crypto10 = __toESM(require("crypto"));
+var crypto11 = __toESM(require("crypto"));
 var REQUESTED_SCOPE = "openid email profile";
 var discoveryCache = /* @__PURE__ */ new Map();
 var jwksCache = /* @__PURE__ */ new Map();
@@ -30639,7 +30933,7 @@ function verifyJwtSignature(alg, signingInput, jwk, sigB64url) {
   if (!digest) return false;
   let keyObject;
   try {
-    keyObject = crypto10.createPublicKey({ key: jwk, format: "jwk" });
+    keyObject = crypto11.createPublicKey({ key: jwk, format: "jwk" });
   } catch {
     return false;
   }
@@ -30647,18 +30941,18 @@ function verifyJwtSignature(alg, signingInput, jwk, sigB64url) {
   const sig = Buffer.from(sigB64url, "base64url");
   try {
     if (alg.startsWith("RS")) {
-      return crypto10.verify(digest, data, keyObject, sig);
+      return crypto11.verify(digest, data, keyObject, sig);
     }
     if (alg.startsWith("PS")) {
-      return crypto10.verify(
+      return crypto11.verify(
         digest,
         data,
-        { key: keyObject, padding: crypto10.constants.RSA_PKCS1_PSS_PADDING, saltLength: crypto10.constants.RSA_PSS_SALTLEN_DIGEST },
+        { key: keyObject, padding: crypto11.constants.RSA_PKCS1_PSS_PADDING, saltLength: crypto11.constants.RSA_PSS_SALTLEN_DIGEST },
         sig
       );
     }
     if (alg.startsWith("ES")) {
-      return crypto10.verify(digest, data, { key: keyObject, dsaEncoding: "ieee-p1363" }, sig);
+      return crypto11.verify(digest, data, { key: keyObject, dsaEncoding: "ieee-p1363" }, sig);
     }
   } catch {
     return false;
@@ -30772,8 +31066,8 @@ function assertAllowedRedirectUri(provider, redirectUri) {
 }
 
 // src/server/policy.ts
-var fs40 = __toESM(require("fs"));
-var path49 = __toESM(require("path"));
+var fs41 = __toESM(require("fs"));
+var path52 = __toESM(require("path"));
 init_fs();
 init_yaml();
 init_loader();
@@ -30792,13 +31086,13 @@ function sendJson(res, status2, body) {
 
 // src/server/policy.ts
 function packPolicyPath(dataDir) {
-  return path49.join(dataDir, "pack-policy.json");
+  return path52.join(dataDir, "pack-policy.json");
 }
 function getPackPolicyRecord(dataDir) {
   const p = packPolicyPath(dataDir);
   let raw;
   try {
-    raw = fs40.readFileSync(p, "utf8");
+    raw = fs41.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw new Error(`Failed to read pack policy store at ${p}: ${e.message}`);
@@ -30812,14 +31106,14 @@ function getPackPolicyRecord(dataDir) {
 function setPackPolicyRecord(dataDir, policy) {
   const stored = { ...policy, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
   const p = packPolicyPath(dataDir);
-  fs40.mkdirSync(path49.dirname(p), { recursive: true });
+  fs41.mkdirSync(path52.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs40.writeFileSync(tmp, JSON.stringify(stored, null, 2) + "\n");
-  fs40.renameSync(tmp, p);
+  fs41.writeFileSync(tmp, JSON.stringify(stored, null, 2) + "\n");
+  fs41.renameSync(tmp, p);
   return stored;
 }
 function exposurePolicyPath(dataDir) {
-  return path49.join(dataDir, "exposure-policy.json");
+  return path52.join(dataDir, "exposure-policy.json");
 }
 var COMPATIBLE_DEFAULT_EXPOSURE = {
   adminApiMode: "local_only",
@@ -30836,7 +31130,7 @@ function getExposurePolicyRecord(dataDir) {
   const p = exposurePolicyPath(dataDir);
   let raw;
   try {
-    raw = fs40.readFileSync(p, "utf8");
+    raw = fs41.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw new Error(`Failed to read exposure policy store at ${p}: ${e.message}`);
@@ -30849,10 +31143,10 @@ function getExposurePolicyRecord(dataDir) {
 }
 function setExposurePolicyRecord(dataDir, policy) {
   const p = exposurePolicyPath(dataDir);
-  fs40.mkdirSync(path49.dirname(p), { recursive: true });
+  fs41.mkdirSync(path52.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs40.writeFileSync(tmp, JSON.stringify(policy, null, 2) + "\n");
-  fs40.renameSync(tmp, p);
+  fs41.writeFileSync(tmp, JSON.stringify(policy, null, 2) + "\n");
+  fs41.renameSync(tmp, p);
   return policy;
 }
 var PERMISSIVE_DEFAULT_POLICY = {
@@ -30870,7 +31164,7 @@ function effectivePolicy(dataDir) {
   return getPackPolicyRecord(dataDir) ?? PERMISSIVE_DEFAULT_POLICY;
 }
 function identityProvidersPath(dataDir) {
-  return path49.join(dataDir, "identity-providers.json");
+  return path52.join(dataDir, "identity-providers.json");
 }
 function sanitizeIdentityProvider(config) {
   const clean = {
@@ -30894,16 +31188,16 @@ function sanitizeIdentityProvider(config) {
 }
 function writeIdentityProviderRecords(dataDir, records) {
   const p = identityProvidersPath(dataDir);
-  fs40.mkdirSync(path49.dirname(p), { recursive: true });
+  fs41.mkdirSync(path52.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs40.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs40.renameSync(tmp, p);
+  fs41.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs41.renameSync(tmp, p);
 }
 function listIdentityProviderRecords(dataDir) {
   const p = identityProvidersPath(dataDir);
   let raw;
   try {
-    raw = fs40.readFileSync(p, "utf8");
+    raw = fs41.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read identity provider store at ${p}: ${e.message}`);
@@ -31530,9 +31824,9 @@ function mintToken(cfg, credential, request) {
   if (owner && owner.status !== "active") {
     throw new ForbiddenError("cannot mint a token for a deactivated user");
   }
-  const token = "wk_" + crypto11.randomBytes(24).toString("hex");
+  const token = "wk_" + crypto12.randomBytes(24).toString("hex");
   const record2 = {
-    id: crypto11.randomBytes(6).toString("hex"),
+    id: crypto12.randomBytes(6).toString("hex"),
     keyHash: hashToken(token),
     projects,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -31576,10 +31870,10 @@ function mintSelfToken(cfg, credential, projectId, write) {
   if (parsed.mounts.length > 0) {
     assertMintableNarrowingEntry(cfg.dataDir, projectId);
   }
-  const token = "wk_" + crypto11.randomBytes(24).toString("hex");
+  const token = "wk_" + crypto12.randomBytes(24).toString("hex");
   const owner = auditActor(principal);
   const record2 = {
-    id: crypto11.randomBytes(6).toString("hex"),
+    id: crypto12.randomBytes(6).toString("hex"),
     keyHash: hashToken(token),
     projects: [projectId],
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -31694,7 +31988,7 @@ function resolveEnabledProvider(cfg, providerId) {
 }
 async function startSsoLogin(cfg, providerId, redirectUri) {
   const provider = resolveEnabledProvider(cfg, providerId);
-  const nonce = crypto11.randomBytes(16).toString("hex");
+  const nonce = crypto12.randomBytes(16).toString("hex");
   const payload = { providerId, nonce, redirectUri };
   const state = signSsoState(JSON.stringify(payload));
   const endpoints = await resolveEndpoints(provider);
@@ -31745,9 +32039,9 @@ async function completeSsoLogin(cfg, state, code) {
       ...subject.email ? { email: subject.email } : {}
     });
   }
-  const token = "wk_" + crypto11.randomBytes(24).toString("hex");
+  const token = "wk_" + crypto12.randomBytes(24).toString("hex");
   const record2 = {
-    id: crypto11.randomBytes(6).toString("hex"),
+    id: crypto12.randomBytes(6).toString("hex"),
     keyHash: hashToken(token),
     projects: ["*"],
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -31879,17 +32173,17 @@ init_yaml();
 init_loader();
 
 // src/server/relations.ts
-var fs41 = __toESM(require("fs"));
-var path50 = __toESM(require("path"));
-var crypto12 = __toESM(require("crypto"));
+var fs42 = __toESM(require("fs"));
+var path53 = __toESM(require("path"));
+var crypto13 = __toESM(require("crypto"));
 function storePath10(dataDir) {
-  return path50.join(dataDir, "relations.json");
+  return path53.join(dataDir, "relations.json");
 }
 function readRelations(dataDir) {
   const p = storePath10(dataDir);
   let raw;
   try {
-    raw = fs41.readFileSync(p, "utf8");
+    raw = fs42.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read relation store at ${p}: ${e.message}`);
@@ -31904,10 +32198,10 @@ function readRelations(dataDir) {
 }
 function persistRelations(dataDir, relations) {
   const p = storePath10(dataDir);
-  fs41.mkdirSync(path50.dirname(p), { recursive: true });
+  fs42.mkdirSync(path53.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs41.writeFileSync(tmp, JSON.stringify(relations, null, 2) + "\n");
-  fs41.renameSync(tmp, p);
+  fs42.writeFileSync(tmp, JSON.stringify(relations, null, 2) + "\n");
+  fs42.renameSync(tmp, p);
 }
 var ProjectRelationStore = class {
   constructor(dataDir) {
@@ -31950,7 +32244,7 @@ var ProjectRelationRegistry = class {
     const hasStatus = typeof record2.status === "string" && record2.status.trim().length > 0;
     const stored = {
       ...record2,
-      id: hasId ? record2.id : crypto12.randomUUID(),
+      id: hasId ? record2.id : crypto13.randomUUID(),
       status: hasStatus ? record2.status : "active"
     };
     const relations = this.store.all();
@@ -32017,16 +32311,16 @@ function listProjectRelations(dataDir, sourceProjectId, targetProjectId, status2
 }
 
 // src/server/surfaces.ts
-var fs42 = __toESM(require("fs"));
-var path51 = __toESM(require("path"));
+var fs43 = __toESM(require("fs"));
+var path54 = __toESM(require("path"));
 function storePath11(dataDir) {
-  return path51.join(dataDir, "public-surfaces.json");
+  return path54.join(dataDir, "public-surfaces.json");
 }
 function readSnapshots(dataDir) {
   const p = storePath11(dataDir);
   let raw;
   try {
-    raw = fs42.readFileSync(p, "utf8");
+    raw = fs43.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read public surface store at ${p}: ${e.message}`);
@@ -32041,10 +32335,10 @@ function readSnapshots(dataDir) {
 }
 function persistSnapshots(dataDir, snapshots) {
   const p = storePath11(dataDir);
-  fs42.mkdirSync(path51.dirname(p), { recursive: true });
+  fs43.mkdirSync(path54.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs42.writeFileSync(tmp, JSON.stringify(snapshots, null, 2) + "\n");
-  fs42.renameSync(tmp, p);
+  fs43.writeFileSync(tmp, JSON.stringify(snapshots, null, 2) + "\n");
+  fs43.renameSync(tmp, p);
 }
 var PublicSurfaceStore = class {
   constructor(dataDir) {
@@ -32187,12 +32481,12 @@ function resolveVisibility(observerProjectId, units, placements) {
   const best = /* @__PURE__ */ new Map();
   for (const placement of placements) {
     if (placement.projectId === observerProjectId) continue;
-    const path64 = chainOf(placement.unitId, unitById);
-    if (!path64.length) continue;
-    const closedOk = path64.every((u) => effectivePosture(u, unitById) !== "closed" || observerInside(u.id) || grantedTo(u));
+    const path67 = chainOf(placement.unitId, unitById);
+    if (!path67.length) continue;
+    const closedOk = path67.every((u) => effectivePosture(u, unitById) !== "closed" || observerInside(u.id) || grantedTo(u));
     if (!closedOk) continue;
-    const crossTenant = !tenantRoots.has(path64[path64.length - 1].id);
-    if (crossTenant && !path64.some(grantedTo)) continue;
+    const crossTenant = !tenantRoots.has(path67[path67.length - 1].id);
+    if (crossTenant && !path67.some(grantedTo)) continue;
     if (crossTenant && directUnits.length === 0) continue;
     const distance = crossTenant ? "partner" : sameBranch(placement.unitId) ? "department" : "instance";
     const existing = best.get(placement.projectId);
@@ -32838,8 +33132,8 @@ function handleLandscapeRequest(cfg, credential, req, res, body, url) {
 }
 
 // src/server/migration.ts
-var fs43 = __toESM(require("fs"));
-var path52 = __toESM(require("path"));
+var fs44 = __toESM(require("fs"));
+var path55 = __toESM(require("path"));
 var LEGACY_CAPABILITY_MAP = {
   "mcp:read": "project:read",
   "operations:read": "project:read",
@@ -32871,16 +33165,16 @@ function scopeOf(grant) {
 }
 function readRaw(file) {
   try {
-    return JSON.parse(fs43.readFileSync(file, "utf8"));
+    return JSON.parse(fs44.readFileSync(file, "utf8"));
   } catch {
     return null;
   }
 }
 function writeRaw(file, value) {
-  fs43.mkdirSync(path52.dirname(file), { recursive: true });
+  fs44.mkdirSync(path55.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
-  fs43.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n");
-  fs43.renameSync(tmp, file);
+  fs44.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n");
+  fs44.renameSync(tmp, file);
 }
 function slugify(name) {
   return name.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "") || "unit";
@@ -32914,13 +33208,13 @@ function migratePermissionModel(dataDir, apply) {
     findings.push({ area, detail });
   };
   const grid = readRaw(
-    path52.join(dataDir, "permissions.json")
+    path55.join(dataDir, "permissions.json")
   ) ?? [];
   if (!getInstanceIdentity(dataDir)) {
     found("instance", "instance identity is not seeded \u2014 the built-in admin/dev subjects have no persisted UUIDs");
     if (apply) ensureInstanceIdentity(dataDir);
   }
-  const orgPath = path52.join(dataDir, "organization.json");
+  const orgPath = path55.join(dataDir, "organization.json");
   const org = readRaw(orgPath);
   if (org?.units?.length) {
     const units = org.units;
@@ -32974,7 +33268,7 @@ function migratePermissionModel(dataDir, apply) {
       found("units", `${remap.length} unit id(s) would be remapped across placements, exposeTo, assignments, and users`);
     }
   }
-  const usersPath = path52.join(dataDir, "users.json");
+  const usersPath = path55.join(dataDir, "users.json");
   const users = readRaw(usersPath);
   if (users) {
     let changed = false;
@@ -33001,7 +33295,7 @@ function migratePermissionModel(dataDir, apply) {
     }
     if (apply && changed) writeRaw(usersPath, users);
   }
-  const keysPath = path52.join(dataDir, "auth", "credentials.json");
+  const keysPath = path55.join(dataDir, "auth", "credentials.json");
   const keys = readRaw(keysPath);
   if (keys) {
     let changed = false;
@@ -33051,7 +33345,7 @@ function migratePermissionModel(dataDir, apply) {
     }
     if (apply && changed) writeRaw(keysPath, keys);
   }
-  const sessionsPath = path52.join(dataDir, "web-sessions.json");
+  const sessionsPath = path55.join(dataDir, "web-sessions.json");
   const sessions = readRaw(sessionsPath);
   if (sessions) {
     let changed = false;
@@ -33130,25 +33424,25 @@ function migratePermissionModel(dataDir, apply) {
 
 // src/server/http.ts
 var http2 = __toESM(require("http"));
-var fs51 = __toESM(require("fs"));
-var path60 = __toESM(require("path"));
+var fs52 = __toESM(require("fs"));
+var path63 = __toESM(require("path"));
 
 // src/server/request.ts
 var import_streamableHttp = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
 init_fs();
 
 // src/server/approvals.ts
-var fs44 = __toESM(require("fs"));
-var path53 = __toESM(require("path"));
-var crypto13 = __toESM(require("crypto"));
+var fs45 = __toESM(require("fs"));
+var path56 = __toESM(require("path"));
+var crypto14 = __toESM(require("crypto"));
 function storePath12(dataDir) {
-  return path53.join(dataDir, "approvals.json");
+  return path56.join(dataDir, "approvals.json");
 }
 function readRequests(dataDir) {
   const p = storePath12(dataDir);
   let raw;
   try {
-    raw = fs44.readFileSync(p, "utf8");
+    raw = fs45.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read approval store at ${p}: ${e.message}`);
@@ -33163,10 +33457,10 @@ function readRequests(dataDir) {
 }
 function persistRequests(dataDir, requests) {
   const p = storePath12(dataDir);
-  fs44.mkdirSync(path53.dirname(p), { recursive: true });
+  fs45.mkdirSync(path56.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs44.writeFileSync(tmp, JSON.stringify(requests, null, 2) + "\n");
-  fs44.renameSync(tmp, p);
+  fs45.writeFileSync(tmp, JSON.stringify(requests, null, 2) + "\n");
+  fs45.renameSync(tmp, p);
 }
 var SECRET_RE2 = /Bearer\s+\S/i;
 var LONG_HEX_RE2 = /[0-9a-fA-F]{32,}/;
@@ -33214,7 +33508,7 @@ var ApprovalRegistry = class {
     }
     const stored = {
       ...request,
-      id: crypto13.randomUUID(),
+      id: crypto14.randomUUID(),
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
       status: "pending"
     };
@@ -33523,23 +33817,6 @@ function lockProject2(cfg, credential, projectId, subproject) {
     }
   });
 }
-function promoteProject2(cfg, credential, projectId, subproject) {
-  return lifecycleAction(cfg, credential, projectId, {
-    action: "project:promote",
-    verb: "Promote",
-    noun: "promotion",
-    subproject,
-    execute: () => {
-      const promo = executeApprovedPromote(cfg, projectId, subproject);
-      return {
-        status: "completed",
-        action: "project:promote",
-        summary: `Promotion of project "${projectId}"${subprojectSuffix(subproject)}: ${promo.status} \u2014 ${promo.message}`,
-        promote: promo
-      };
-    }
-  });
-}
 function subprojectSuffix(subproject) {
   return subproject ? ` subproject "${subproject}"` : "";
 }
@@ -33663,11 +33940,6 @@ function executeApproved(cfg, req) {
       const lock = executeApprovedLock(cfg, req.projectId ?? "", scope);
       return `Locked project "${req.projectId}"${subprojectSuffix(scope)} (status: ${lock.status}).`;
     }
-    case "project:promote": {
-      const scope = readSubprojectScope(req);
-      const promo = executeApprovedPromote(cfg, req.projectId ?? "", scope);
-      return `Promotion of project "${req.projectId}"${subprojectSuffix(scope)}: ${promo.status} \u2014 ${promo.message}`;
-    }
     default:
       throw new Error(`Unsupported approval kind "${req.kind}".`);
   }
@@ -33709,7 +33981,7 @@ async function awaitApproval(cfg, credential, requestId, timeoutSeconds) {
   let current2 = req;
   while (current2.status === "pending" && Date.now() < deadline) {
     const remaining = deadline - Date.now();
-    await new Promise((resolve26) => setTimeout(resolve26, Math.min(AWAIT_POLL_INTERVAL_MS, remaining)));
+    await new Promise((resolve27) => setTimeout(resolve27, Math.min(AWAIT_POLL_INTERVAL_MS, remaining)));
     expirePendingApprovals(cfg.dataDir, (/* @__PURE__ */ new Date()).toISOString());
     current2 = getApprovalRequestById(cfg.dataDir, requestId) ?? current2;
   }
@@ -33977,12 +34249,12 @@ function handleOperationsRequest(cfg, credential, req, res, url) {
 }
 
 // src/server/gitbacking.ts
-var fs45 = __toESM(require("fs"));
-var path54 = __toESM(require("path"));
-var crypto14 = __toESM(require("crypto"));
+var fs46 = __toESM(require("fs"));
+var path57 = __toESM(require("path"));
+var crypto15 = __toESM(require("crypto"));
 var import_child_process4 = require("child_process");
 function storePath13(dataDir) {
-  return path54.join(dataDir, "git-backing.json");
+  return path57.join(dataDir, "git-backing.json");
 }
 var GitBackingStore = class {
   constructor(dataDir) {
@@ -33994,7 +34266,7 @@ var GitBackingStore = class {
     const p = storePath13(this.dataDir);
     let raw;
     try {
-      raw = fs45.readFileSync(p, "utf8");
+      raw = fs46.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return [];
       throw new Error(`Cannot read git-backing store at ${p}: ${err.message}`);
@@ -34013,10 +34285,10 @@ var GitBackingStore = class {
   /** Swap the persisted collection wholesale via write-temp-then-rename. */
   replaceAll(bindings) {
     const p = storePath13(this.dataDir);
-    fs45.mkdirSync(path54.dirname(p), { recursive: true });
+    fs46.mkdirSync(path57.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
-    fs45.writeFileSync(tmp, JSON.stringify(bindings, null, 2) + "\n");
-    fs45.renameSync(tmp, p);
+    fs46.writeFileSync(tmp, JSON.stringify(bindings, null, 2) + "\n");
+    fs46.renameSync(tmp, p);
   }
 };
 var GitBackingRegistry = class {
@@ -34035,7 +34307,7 @@ var GitBackingRegistry = class {
     const bindings = this.store.load();
     const stored = {
       ...binding,
-      id: binding.id || crypto14.randomUUID(),
+      id: binding.id || crypto15.randomUUID(),
       createdAt: binding.createdAt || (/* @__PURE__ */ new Date()).toISOString()
     };
     const sameScope = (b) => b.scopeKind === stored.scopeKind && (b.scopeId ?? "") === (stored.scopeId ?? "");
@@ -34121,8 +34393,8 @@ function checkoutBranch(workdir, branch) {
   }
 }
 function cloneOrOpen(remote, branch, workdir, credentialRef) {
-  if (!fs45.existsSync(path54.join(workdir, ".git"))) {
-    fs45.mkdirSync(workdir, { recursive: true });
+  if (!fs46.existsSync(path57.join(workdir, ".git"))) {
+    fs46.mkdirSync(workdir, { recursive: true });
     git2(["clone", authRemote2(remote, credentialRef), "."], workdir);
     git2(["config", "user.name", process.env["WAIRON_GIT_NAME"] || "wairon-bot"], workdir);
     git2(["config", "user.email", process.env["WAIRON_GIT_EMAIL"] || "wairon-bot@localhost"], workdir);
@@ -34134,11 +34406,11 @@ function cloneOrOpen(remote, branch, workdir, credentialRef) {
   return workdir;
 }
 function mirrorTree(sourceDir, targetDir) {
-  fs45.rmSync(targetDir, { recursive: true, force: true });
-  const stat = fs45.statSync(sourceDir, { throwIfNoEntry: false });
+  fs46.rmSync(targetDir, { recursive: true, force: true });
+  const stat = fs46.statSync(sourceDir, { throwIfNoEntry: false });
   if (!stat) return;
-  fs45.mkdirSync(path54.dirname(targetDir), { recursive: true });
-  fs45.cpSync(sourceDir, targetDir, { recursive: true });
+  fs46.mkdirSync(path57.dirname(targetDir), { recursive: true });
+  fs46.cpSync(sourceDir, targetDir, { recursive: true });
 }
 function commitAndPush(workdir, message) {
   git2(["add", "-A"], workdir);
@@ -34260,7 +34532,7 @@ function unbindScope(cfg, credential, bindingId) {
   tryAppendAudit7(cfg, buildAuditEvent6(principal, "git.backing.unbind", "security", bindingId));
 }
 function runMirrorSync(cfg, binding) {
-  const workdir = path54.join(cfg.dataDir, "git-backing", binding.id);
+  const workdir = path57.join(cfg.dataDir, "git-backing", binding.id);
   cloneOrOpen(binding.remote, binding.branch, workdir, binding.credentialRef);
   if (binding.scopeKind === "unit") {
     const units = listOrganizationUnits(cfg.dataDir);
@@ -34268,23 +34540,23 @@ function runMirrorSync(cfg, binding) {
     const placedIds = new Set(
       listProjectPlacements(cfg.dataDir).filter((p) => subtree.has(p.unitId)).map((p) => p.projectId)
     );
-    const projectsDir = path54.join(workdir, "projects");
-    fs45.rmSync(projectsDir, { recursive: true, force: true });
+    const projectsDir = path57.join(workdir, "projects");
+    fs46.rmSync(projectsDir, { recursive: true, force: true });
     for (const rec of listProjectRecords(cfg.dataDir)) {
       if (!placedIds.has(rec.id)) continue;
-      mirrorTree(path54.join(rec.rootPath, ".wai"), path54.join(projectsDir, rec.id, ".wai"));
+      mirrorTree(path57.join(rec.rootPath, ".wai"), path57.join(projectsDir, rec.id, ".wai"));
     }
   } else {
-    const instanceDir = path54.join(workdir, "instance");
-    fs45.rmSync(instanceDir, { recursive: true, force: true });
+    const instanceDir = path57.join(workdir, "instance");
+    fs46.rmSync(instanceDir, { recursive: true, force: true });
     const files = binding.includeCredentials ? INSTANCE_STRUCTURE_FILES : INSTANCE_STRUCTURE_FILES.filter((rel2) => rel2 !== "auth/credentials.json");
     for (const rel2 of files) {
-      mirrorTree(path54.join(cfg.dataDir, rel2), path54.join(instanceDir, rel2));
+      mirrorTree(path57.join(cfg.dataDir, rel2), path57.join(instanceDir, rel2));
     }
-    const projectsDir = path54.join(workdir, "projects");
-    fs45.rmSync(projectsDir, { recursive: true, force: true });
+    const projectsDir = path57.join(workdir, "projects");
+    fs46.rmSync(projectsDir, { recursive: true, force: true });
     for (const rec of listProjectRecords(cfg.dataDir)) {
-      mirrorTree(path54.join(rec.rootPath, ".wai"), path54.join(projectsDir, rec.id, ".wai"));
+      mirrorTree(path57.join(rec.rootPath, ".wai"), path57.join(projectsDir, rec.id, ".wai"));
     }
   }
   const published = commitAndPush(
@@ -34430,7 +34702,7 @@ function setExposurePolicy2(cfg, credential, exposure) {
 
 // src/server/websocket.ts
 var import_events = require("events");
-var crypto15 = __toESM(require("crypto"));
+var crypto16 = __toESM(require("crypto"));
 var WS_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
 var MAX_PAYLOAD = 1 << 20;
 var OP_CONTINUATION = 0;
@@ -34444,7 +34716,7 @@ function isWebSocketUpgrade(req) {
 function acceptWebSocket(req, socket) {
   const key = req.headers["sec-websocket-key"];
   if (!isWebSocketUpgrade(req) || typeof key !== "string") return null;
-  const accept = crypto15.createHash("sha1").update(key + WS_GUID).digest("base64");
+  const accept = crypto16.createHash("sha1").update(key + WS_GUID).digest("base64");
   socket.write(
     `HTTP/1.1 101 Switching Protocols\r
 Upgrade: websocket\r
@@ -34594,9 +34866,9 @@ function encodeFrame(opcode, payload) {
 }
 
 // src/server/web.ts
-var crypto20 = __toESM(require("crypto"));
-var fs50 = __toESM(require("fs"));
-var path59 = __toESM(require("path"));
+var crypto21 = __toESM(require("crypto"));
+var fs51 = __toESM(require("fs"));
+var path62 = __toESM(require("path"));
 
 // src/server/webadmin.ts
 function listUsers3(cfg, sessionId, project2) {
@@ -34838,26 +35110,23 @@ function createProject2(cfg, sessionId, id, unitId, profileSelection) {
 function lockProject3(cfg, sessionId, projectId) {
   return lockProject(cfg, sessionId, projectId);
 }
-function promoteProject3(cfg, sessionId, projectId) {
-  return promoteProject(cfg, sessionId, projectId);
-}
 function destroyProject2(cfg, sessionId, id) {
   destroyProject(cfg, sessionId, id);
 }
 
 // src/server/shareadmin.ts
-var crypto19 = __toESM(require("crypto"));
+var crypto20 = __toESM(require("crypto"));
 
 // src/server/sharesnapshots.ts
-var fs46 = __toESM(require("fs"));
-var path55 = __toESM(require("path"));
-var crypto16 = __toESM(require("crypto"));
+var fs47 = __toESM(require("fs"));
+var path58 = __toESM(require("path"));
+var crypto17 = __toESM(require("crypto"));
 init_fs();
 function snapshotDir(dataDir) {
-  return path55.join(dataDir, "share-snapshots");
+  return path58.join(dataDir, "share-snapshots");
 }
 function snapshotPath(dataDir, id) {
-  return path55.join(snapshotDir(dataDir), `${id}.json`);
+  return path58.join(snapshotDir(dataDir), `${id}.json`);
 }
 var ShareSnapshotStore = class {
   constructor(dataDir) {
@@ -34865,17 +35134,17 @@ var ShareSnapshotStore = class {
   }
   write(snapshot) {
     const p = snapshotPath(this.dataDir, snapshot.id);
-    if (fs46.existsSync(p)) return;
-    fs46.mkdirSync(path55.dirname(p), { recursive: true });
+    if (fs47.existsSync(p)) return;
+    fs47.mkdirSync(path58.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
-    fs46.writeFileSync(tmp, JSON.stringify(snapshot, null, 2) + "\n");
-    fs46.renameSync(tmp, p);
+    fs47.writeFileSync(tmp, JSON.stringify(snapshot, null, 2) + "\n");
+    fs47.renameSync(tmp, p);
   }
   read(snapshotId) {
     const p = snapshotPath(this.dataDir, snapshotId);
     let raw;
     try {
-      raw = fs46.readFileSync(p, "utf8");
+      raw = fs47.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw new Error(`Cannot read share snapshot at ${p}: ${err.message}`);
@@ -34894,7 +35163,7 @@ var ShareSnapshotRegistry = class {
   put(snapshot) {
     const stored = {
       ...snapshot,
-      id: snapshot.id || crypto16.randomUUID(),
+      id: snapshot.id || crypto17.randomUUID(),
       capturedAt: snapshot.capturedAt || (/* @__PURE__ */ new Date()).toISOString()
     };
     this.store.write(stored);
@@ -34967,11 +35236,11 @@ function captureSnapshot(dataDir, principal, projectId, view, artifacts) {
 }
 
 // src/server/sharelinks.ts
-var fs47 = __toESM(require("fs"));
-var path56 = __toESM(require("path"));
-var crypto17 = __toESM(require("crypto"));
+var fs48 = __toESM(require("fs"));
+var path59 = __toESM(require("path"));
+var crypto18 = __toESM(require("crypto"));
 function storePath14(dataDir) {
-  return path56.join(dataDir, "share-links.json");
+  return path59.join(dataDir, "share-links.json");
 }
 var ShareLinkStore = class {
   constructor(dataDir) {
@@ -34981,7 +35250,7 @@ var ShareLinkStore = class {
     const p = storePath14(this.dataDir);
     let raw;
     try {
-      raw = fs47.readFileSync(p, "utf8");
+      raw = fs48.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return [];
       throw new Error(`Cannot read share-link store at ${p}: ${err.message}`);
@@ -34999,10 +35268,10 @@ var ShareLinkStore = class {
   }
   replaceAll(links) {
     const p = storePath14(this.dataDir);
-    fs47.mkdirSync(path56.dirname(p), { recursive: true });
+    fs48.mkdirSync(path59.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
-    fs47.writeFileSync(tmp, JSON.stringify(links, null, 2) + "\n");
-    fs47.renameSync(tmp, p);
+    fs48.writeFileSync(tmp, JSON.stringify(links, null, 2) + "\n");
+    fs48.renameSync(tmp, p);
   }
 };
 var ShareLinkRegistry = class {
@@ -35013,7 +35282,7 @@ var ShareLinkRegistry = class {
     const links = this.store.load();
     const stored = {
       ...link,
-      id: link.id || crypto17.randomUUID(),
+      id: link.id || crypto18.randomUUID(),
       createdAt: link.createdAt || (/* @__PURE__ */ new Date()).toISOString()
     };
     this.store.replaceAll([...links, stored]);
@@ -35070,11 +35339,11 @@ function listProjectLinks(dataDir, projectId) {
 }
 
 // src/server/shareaccesslog.ts
-var fs48 = __toESM(require("fs"));
-var path57 = __toESM(require("path"));
-var crypto18 = __toESM(require("crypto"));
+var fs49 = __toESM(require("fs"));
+var path60 = __toESM(require("path"));
+var crypto19 = __toESM(require("crypto"));
 function storePath15(dataDir) {
-  return path57.join(dataDir, "share-access.json");
+  return path60.join(dataDir, "share-access.json");
 }
 var ShareAccessStore = class {
   constructor(dataDir) {
@@ -35084,7 +35353,7 @@ var ShareAccessStore = class {
     const p = storePath15(this.dataDir);
     let raw;
     try {
-      raw = fs48.readFileSync(p, "utf8");
+      raw = fs49.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return [];
       throw new Error(`Cannot read share-access store at ${p}: ${err.message}`);
@@ -35102,11 +35371,11 @@ var ShareAccessStore = class {
   }
   append(entry) {
     const p = storePath15(this.dataDir);
-    fs48.mkdirSync(path57.dirname(p), { recursive: true });
+    fs49.mkdirSync(path60.dirname(p), { recursive: true });
     const next = [...this.load(), entry];
     const tmp = `${p}.tmp`;
-    fs48.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n");
-    fs48.renameSync(tmp, p);
+    fs49.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n");
+    fs49.renameSync(tmp, p);
   }
 };
 var ShareAccessRegistry = class {
@@ -35116,7 +35385,7 @@ var ShareAccessRegistry = class {
   append(entry) {
     const stored = {
       ...entry,
-      id: entry.id || crypto18.randomUUID(),
+      id: entry.id || crypto19.randomUUID(),
       at: entry.at || (/* @__PURE__ */ new Date()).toISOString()
     };
     this.store.append(stored);
@@ -35180,7 +35449,7 @@ function createShareLink(cfg, sessionId, input) {
   const wantsOpenapi = !!input.allowDownloadOpenapi || (input.artifacts ?? []).includes("openapi");
   const artifacts = artifactsFor({ allowDownloadOpenapi: !!input.allowDownloadOpenapi }, wantsOpenapi);
   const snapshot = putSnapshot(cfg.dataDir, captureSnapshot(cfg.dataDir, principal, input.projectId, input.view, artifacts));
-  const token = crypto19.randomBytes(32).toString("base64url");
+  const token = crypto20.randomBytes(32).toString("base64url");
   const link = createLink(cfg.dataDir, {
     id: "",
     tokenHash: hashToken(token),
@@ -35257,16 +35526,16 @@ function getShareAccessLog(cfg, sessionId, linkId, limit) {
 init_fs();
 
 // src/server/swagger.ts
-var fs49 = __toESM(require("fs"));
-var path58 = __toESM(require("path"));
+var fs50 = __toESM(require("fs"));
+var path61 = __toESM(require("path"));
 var cache;
 function loadAssets() {
   if (cache !== void 0) return cache;
   try {
-    const dir = path58.dirname(require.resolve("swagger-ui-dist/package.json"));
+    const dir = path61.dirname(require.resolve("swagger-ui-dist/package.json"));
     cache = {
-      css: fs49.readFileSync(path58.join(dir, "swagger-ui.css"), "utf8"),
-      js: fs49.readFileSync(path58.join(dir, "swagger-ui-bundle.js"), "utf8")
+      css: fs50.readFileSync(path61.join(dir, "swagger-ui.css"), "utf8"),
+      js: fs50.readFileSync(path61.join(dir, "swagger-ui-bundle.js"), "utf8")
     };
   } catch {
     cache = null;
@@ -35306,7 +35575,7 @@ function getLoginOptions(cfg) {
 async function startSignIn(cfg, providerId, redirectUri) {
   const provider = resolveEnabledProvider(cfg, providerId);
   assertAllowedRedirectUri(provider, redirectUri);
-  const nonce = crypto20.randomBytes(16).toString("hex");
+  const nonce = crypto21.randomBytes(16).toString("hex");
   const payload = { providerId, nonce, redirectUri };
   const state = signSsoState(JSON.stringify(payload));
   const endpoints = await resolveEndpoints(provider);
@@ -35658,20 +35927,20 @@ function clearNonceCookie(secure) {
 }
 function nonceMatches(a, b) {
   if (!a || !b || a.length !== b.length) return false;
-  return crypto20.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+  return crypto21.timingSafeEqual(Buffer.from(a), Buffer.from(b));
 }
 function loadReactBundle() {
   const candidates = [
-    path59.resolve(__dirname, "webapp.html"),
+    path62.resolve(__dirname, "webapp.html"),
     // dist/index.js -> dist/webapp.html
-    path59.resolve(__dirname, "..", "webapp.html"),
+    path62.resolve(__dirname, "..", "webapp.html"),
     // dist/cli/index.js -> dist/webapp.html
-    path59.resolve(__dirname, "..", "..", "web", "dist", "index.html")
+    path62.resolve(__dirname, "..", "..", "web", "dist", "index.html")
     // tsx dev: src/server -> web/dist
   ];
   for (const candidate of candidates) {
     try {
-      if (fs50.existsSync(candidate)) return fs50.readFileSync(candidate, "utf8");
+      if (fs51.existsSync(candidate)) return fs51.readFileSync(candidate, "utf8");
     } catch {
     }
   }
@@ -37358,9 +37627,6 @@ details.adv summary { cursor:pointer; color:var(--dim); font-size:12px; margin-b
       Array.prototype.forEach.call(host.querySelectorAll('[data-lock]'), function (b) {
         b.addEventListener('click', function () { projectAction('/web/projects/lock', { projectId: b.getAttribute('data-lock') }, b, 'Locking\u2026', 'Lock'); });
       });
-      Array.prototype.forEach.call(host.querySelectorAll('[data-promote]'), function (b) {
-        b.addEventListener('click', function () { projectAction('/web/projects/promote', { projectId: b.getAttribute('data-promote') }, b, 'Promoting\u2026', 'Promote'); });
-      });
       Array.prototype.forEach.call(host.querySelectorAll('[data-destroy]'), function (b) {
         b.addEventListener('click', function () {
           if (!confirm('Destroy project "' + b.getAttribute('data-destroy') + '"? This removes its entire spec tree.')) return;
@@ -37664,9 +37930,6 @@ function projectCreate(cfg, sessionId, body, res) {
 function projectLock(cfg, sessionId, body, res) {
   sendJson(res, 200, lockProject3(cfg, sessionId, String(body?.projectId ?? "")));
 }
-function projectPromote(cfg, sessionId, body, res) {
-  sendJson(res, 200, promoteProject3(cfg, sessionId, String(body?.projectId ?? "")));
-}
 function projectDestroy(cfg, sessionId, body, res) {
   destroyProject2(cfg, sessionId, String(body?.id ?? ""));
   sendJson(res, 200, { ok: true });
@@ -37946,9 +38209,6 @@ async function handleWebRequest(cfg, req, res, body, url, ctx) {
       if (req.method === "POST" && parts.length === 3 && parts[2] === "lock") {
         return projectLock(cfg, sessionId, body, res);
       }
-      if (req.method === "POST" && parts.length === 3 && parts[2] === "promote") {
-        return projectPromote(cfg, sessionId, body, res);
-      }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "destroy") {
         return projectDestroy(cfg, sessionId, body, res);
       }
@@ -38203,8 +38463,8 @@ var RealtimeHub = class {
    *  complete the handshake, and register the connection. A bad path or session
    *  destroys the socket. */
   handleUpgrade(cfg, req, socket) {
-    const path64 = (req.url ?? "/").split("?")[0];
-    if (path64 !== REALTIME_PATH || !isWebSocketUpgrade(req)) {
+    const path67 = (req.url ?? "/").split("?")[0];
+    if (path67 !== REALTIME_PATH || !isWebSocketUpgrade(req)) {
       socket.destroy();
       return;
     }
@@ -38381,7 +38641,6 @@ function auditToolCall(dataDir, principal, projectId, body, outcome, subproject)
 var PROJECT_LIFECYCLE_TOOLS = /* @__PURE__ */ new Set([
   "sdd_host_initialize_project",
   "sdd_host_lock_project",
-  "sdd_host_promote_project",
   "sdd_host_get_approval_status",
   "sdd_host_await_approval"
 ]);
@@ -38439,7 +38698,6 @@ function requiredDataPlaneCapability(toolName) {
 var MUTATING_HOST_TOOLS = /* @__PURE__ */ new Set([
   "sdd_host_initialize_project",
   "sdd_host_lock_project",
-  "sdd_host_promote_project",
   "sdd_host_await_approval",
   // a decided approval may have executed the action
   "sdd_host_policy_reconcile"
@@ -38509,9 +38767,6 @@ async function dispatchProjectLifecycleTool(cfg, credential, projectId, body, su
       case "sdd_host_lock_project":
         value = lockProject2(cfg, credential, projectId, subproject);
         break;
-      case "sdd_host_promote_project":
-        value = promoteProject2(cfg, credential, projectId, subproject);
-        break;
       case "sdd_host_await_approval":
         value = await awaitApproval(
           cfg,
@@ -38977,7 +39232,6 @@ var WEB_MUTATION_PATHS = /* @__PURE__ */ new Set([
   "/web/tokens/revoke",
   "/web/projects",
   "/web/projects/lock",
-  "/web/projects/promote",
   "/web/projects/destroy"
 ]);
 function routeData(cfg, req, res) {
@@ -38989,7 +39243,7 @@ function routeData(cfg, req, res) {
   if (req.method === "GET" && url.pathname === "/readyz") {
     let ready = false;
     try {
-      fs51.accessSync(cfg.dataDir, fs51.constants.W_OK);
+      fs52.accessSync(cfg.dataDir, fs52.constants.W_OK);
       ready = true;
     } catch {
     }
@@ -39089,7 +39343,7 @@ function routeData(cfg, req, res) {
 }
 function readExposurePolicyFile(dataDir) {
   try {
-    const raw = fs51.readFileSync(path60.join(dataDir, "exposure-policy.json"), "utf8");
+    const raw = fs52.readFileSync(path63.join(dataDir, "exposure-policy.json"), "utf8");
     const parsed = JSON.parse(raw);
     return parsed && typeof parsed === "object" ? parsed : void 0;
   } catch {
@@ -39138,7 +39392,6 @@ async function routeAdmin(cfg, req, res) {
         return sendJson(res, 200, { ok: true });
       }
       if (req.method === "POST" && parts.length === 4 && parts[3] === "lock") return sendJson(res, 200, lockProject(cfg, cred, parts[2]));
-      if (req.method === "POST" && parts.length === 4 && parts[3] === "promote") return sendJson(res, 200, promoteProject(cfg, cred, parts[2]));
       if (req.method === "POST" && parts.length === 4 && parts[3] === "git") return sendJson(res, 201, enableGit(cfg, cred, parts[2], body.remote, body.branch ?? "main", body.pat));
       if (req.method === "DELETE" && parts.length === 4 && parts[3] === "git") {
         disableGit(cfg, cred, parts[2]);
@@ -39793,9 +40046,9 @@ function seedDemoTree() {
 
 // src/commands/host.ts
 function resolveHostConfig(options) {
-  const dataDir = options.dataDir || process.env["WAIRON_DATA_DIR"] || path61.join(os11.homedir(), ".wairon", "data");
+  const dataDir = options.dataDir || process.env["WAIRON_DATA_DIR"] || path64.join(os12.homedir(), ".wairon", "data");
   if (!process.env["WAIRON_PACKS_DIR"]) {
-    process.env["WAIRON_PACKS_DIR"] = path61.join(dataDir, "packs");
+    process.env["WAIRON_PACKS_DIR"] = path64.join(dataDir, "packs");
   }
   const cfg = {
     host: options.host || "0.0.0.0",
@@ -39896,11 +40149,11 @@ async function runServe(options = {}) {
   logger.info(`  data dir:    ${import_chalk17.default.gray(cfg.dataDir)}`);
   logger.blank();
   logger.info("Press Ctrl+C to stop.");
-  await new Promise((resolve26) => {
+  await new Promise((resolve27) => {
     const shutdown = () => {
       logger.info("Shutting down\u2026");
       handle.close();
-      resolve26();
+      resolve27();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -39920,14 +40173,14 @@ function openBrowser(url) {
 }
 async function runDev(options = {}) {
   const cwd = process.cwd();
-  if (!fs52.existsSync(path61.join(cwd, ".wai"))) {
+  if (!fs53.existsSync(path64.join(cwd, ".wai"))) {
     throw new WaironError(
       "No .wai/ found in the current directory. Run `wairon dev` from a wairon project root (or run `wairon init` first)."
     );
   }
-  const hash = crypto21.createHash("sha256").update(cwd).digest("hex").slice(0, 16);
-  const dataDir = path61.join(os11.tmpdir(), "wairon-dev", hash);
-  fs52.mkdirSync(dataDir, { recursive: true });
+  const hash = crypto22.createHash("sha256").update(cwd).digest("hex").slice(0, 16);
+  const dataDir = path64.join(os12.tmpdir(), "wairon-dev", hash);
+  fs53.mkdirSync(dataDir, { recursive: true });
   registerLocalDevProject(dataDir, "local", cwd);
   const port = options.port ? Number(options.port) : 8080;
   const exposurePolicy = {
@@ -39965,11 +40218,11 @@ async function runDev(options = {}) {
   logger.blank();
   logger.info("An agent edits specs; refresh the page to see the live graph. Press Ctrl+C to stop.");
   if (options.open) openBrowser(url);
-  await new Promise((resolve26) => {
+  await new Promise((resolve27) => {
     const shutdown = () => {
       logger.info("Shutting down\u2026");
       handle.close();
-      resolve26();
+      resolve27();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -40239,18 +40492,6 @@ async function runHostLock(options = {}) {
     throw mapAdminError(e);
   }
 }
-async function runHostPromote(options = {}) {
-  const cfg = resolveHostConfig(options);
-  if (!options.project) throw new WaironError("`--project <id>` is required for `host promote`.");
-  try {
-    const result = promoteProject(cfg, masterCredential(), options.project);
-    const mark = result.status === "ready" ? import_chalk17.default.green("\u2713") : import_chalk17.default.yellow("\u2717");
-    logger.info(`${mark} ${result.message}`);
-    if (result.status !== "ready") process.exitCode = 1;
-  } catch (e) {
-    throw mapAdminError(e);
-  }
-}
 async function runHostProducer(action, options = {}) {
   const cfg = resolveHostConfig(options);
   const cred = masterCredential();
@@ -40335,8 +40576,8 @@ async function runHostPacks(action, options = {}) {
       }
       case "install": {
         if (!options.file) throw new WaironError("`--file <path>` (a declarative pack YAML) is required for install.");
-        const name = options.name ?? path61.basename(options.file).replace(/\.(ya?ml)$/i, "");
-        const content = fs52.readFileSync(path61.resolve(options.file), "utf8");
+        const name = options.name ?? path64.basename(options.file).replace(/\.(ya?ml)$/i, "");
+        const content = fs53.readFileSync(path64.resolve(options.file), "utf8");
         const desc = project2 ? installProjectPack(cfg, cred, project2, name, content) : installGlobalPack(cfg, cred, name, content);
         logger.success(`Installed ${scope} pack "${desc.name}" (${desc.profiles} profile(s), ${desc.languages} language(s)).`);
         if (project2) logger.info("Committed with the project \u2014 every clone and CI will enforce it.");
@@ -40562,7 +40803,7 @@ async function runSurface(action, options = {}) {
 }
 
 // src/commands/subsystem.ts
-var path62 = __toESM(require("path"));
+var path65 = __toESM(require("path"));
 init_logger();
 init_errors();
 init_fs();
@@ -40602,9 +40843,9 @@ async function runSubsystemAdd(id, options = {}) {
     updatedAt: now
   };
   createChainedSubsystem(subsystem, displayName);
-  const childDir = path62.resolve(getProjectRoot(), options.projectPath);
+  const childDir = path65.resolve(getProjectRoot(), options.projectPath);
   logger.success(`Added external subsystem "${id}" \u2192 ${options.projectPath}`);
-  logger.info(`Scaffolded child project at ${path62.relative(process.cwd(), childDir) || "."}`);
+  logger.info(`Scaffolded child project at ${path65.relative(process.cwd(), childDir) || "."}`);
   logger.info(`Design its spec tree from this parent using namespaced ids (e.g. ${id}::<component>).`);
 }
 async function runSubsystemMove(id, options = {}) {
@@ -40627,9 +40868,9 @@ async function runSubsystemExternalize(id, options = {}) {
     throw new WaironError("--project-path (the subproject destination) is required.");
   }
   externalizeSubsystem(id, options.projectPath);
-  const childDir = path62.resolve(getProjectRoot(), options.projectPath);
+  const childDir = path65.resolve(getProjectRoot(), options.projectPath);
   logger.success(`Externalized subsystem "${id}" \u2192 ${options.projectPath}`);
-  logger.info(`Moved its specs into ${path62.relative(process.cwd(), childDir) || "."} (now a standalone subproject).`);
+  logger.info(`Moved its specs into ${path65.relative(process.cwd(), childDir) || "."} (now a standalone subproject).`);
   logger.info("Move the source code there yourself, then run `wairon validate` to confirm the tree.");
 }
 async function runSubsystemInternalize(id) {
@@ -40873,7 +41114,7 @@ async function runAgent(action, id) {
     }
     case "customize": {
       const brief = composeAgentBrief3(id);
-      const guidancePath = path63.join(AI_PATHS.root(), "agents", `${id}.md`);
+      const guidancePath = path66.join(AI_PATHS.root(), "agents", `${id}.md`);
       const relPath = `.wai/agents/${id}.md`;
       if (pathExists(guidancePath)) {
         throw new GuidanceFileExistsError(relPath);
@@ -40976,9 +41217,6 @@ hostCmd.command("key <action>").description("mint | list | revoke an API key").o
 hostCmd.command("lock").description("validate-as-complete and write the state-scoped lock record for a hosted project").requiredOption("--project <id>", "project id").option("--data-dir <path>", "data root").action(async (opts) => {
   await runHostLock({ project: opts.project, dataDir: opts.dataDir });
 });
-hostCmd.command("promote").description("promote a locked project after re-checking its StateId (never merges to production)").requiredOption("--project <id>", "project id").option("--data-dir <path>", "data root").action(async (opts) => {
-  await runHostPromote({ project: opts.project, dataDir: opts.dataDir });
-});
 hostCmd.command("git <action>").description("enable | disable | sync | commit | status | sync-config \u2014 bind a project to its REAL repo (wairon commits ONLY .wai/)").option("--project <id>", "project id").option("--remote <url>", "git remote URL (for enable)").option("--branch <name>", "default branch PRs target (for enable)", "main").option("--subsystem <id>", "narrow a commit to .wai/specs/<subsystem>/ (staging convenience \u2014 history stays per-repo)").option("-m, --message <message>", "commit message (for commit)").option("--interval <minutes>", "periodic-sync interval in minutes (for sync-config; omit to disable)").option("--no-skip-if-clean", "commit on every periodic tick even when the scoped path is clean (for sync-config)").option("--data-dir <path>", "data root").action(async (action, opts) => {
   await runHostGit(action, {
     project: opts.project,