npm - @wairon/cli - Versions diffs - 5.1.1-dev.6 → 5.1.1-dev.7 - Mend

@wairon/cli 5.1.1-dev.6 → 5.1.1-dev.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/cli/index.js CHANGED Viewed

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.6";
+    WAIRON_VERSION = "5.1.1-dev.7";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     ARCHITECT_AGENT_ID = "agent-architect";
     ARCHITECT_TEMPLATE_ID = "architect";
@@ -3976,9 +3976,9 @@ var init_surfaces = __esm({
 // src/core/rules/namespace.ts
 function isExternalNamespaceRef(ctx, ref) {
   if (ref.startsWith("::") || ref.startsWith("super::")) return true;
-  const sep6 = ref.indexOf("::");
-  if (sep6 === -1) return false;
-  return !ctx.subsystemIds.has(ref.slice(0, sep6));
+  const sep9 = ref.indexOf("::");
+  if (sep9 === -1) return false;
+  return !ctx.subsystemIds.has(ref.slice(0, sep9));
 }
 function resolveSurfaceRef(ctx, ref) {
   const local = ref.split("::").filter((seg) => seg && seg !== "super").pop();
@@ -4315,10 +4315,10 @@ function stepGraph(steps) {
     const s = byNum.get(n);
     if (s.type !== "parallel" || s.endStep === void 0 || !s.branches?.length) continue;
     const entries = s.branches.map((b) => b.step).sort((a, b) => a - b);
-    const join49 = fallNext(s.endStep);
+    const join50 = fallNext(s.endStep);
     for (let i = 0; i < entries.length; i++) {
       const armEnd = i + 1 < entries.length ? prevOf(entries[i + 1]) : s.endStep;
-      if (armEnd !== void 0 && armEnd >= entries[i]) armEndJoin.set(armEnd, join49);
+      if (armEnd !== void 0 && armEnd >= entries[i]) armEndJoin.set(armEnd, join50);
     }
   }
   const successorsOf = (n) => {
@@ -4392,7 +4392,8 @@ var init_narrative_flow = __esm({
         { code: "REGION_OVERLAP", defaultSeverity: "error", summary: "loop/try regions interleave \u2014 regions must nest or be disjoint to map onto structured code" },
         { code: "JUMP_INTO_REGION", defaultSeverity: "warning", summary: "Jump lands in the middle of a loop/try body from outside \u2014 regions are entered through their header" },
         { code: "FALLTHROUGH_INTO_HANDLER", defaultSeverity: "warning", summary: "try body falls through into its own catch/finally region on the success path" },
-        { code: "BACKWARD_JUMP", defaultSeverity: "warning", summary: "Backward jump that is not a continue to an enclosing loop header \u2014 model repetition with a loop step" }
+        { code: "BACKWARD_JUMP", defaultSeverity: "warning", summary: "Backward jump that is not a continue to an enclosing loop header \u2014 model repetition with a loop step" },
+        { code: "DUPLICATE_STEP_LABEL", defaultSeverity: "error", summary: "Two steps in one narrative share a label \u2014 the symbolic anchor later deltas address by" }
       ],
       check(ctx) {
         for (const impl of ctx.implementations) {
@@ -4401,6 +4402,23 @@ var init_narrative_flow = __esm({
             const steps = implMethod.narrative;
             if (!steps.length) continue;
             const where = `Method "${implMethod.name}" in implementation "${impl.id}": `;
+            const labelled = /* @__PURE__ */ new Map();
+            for (const step of steps) {
+              const label = step.label;
+              if (!label) continue;
+              const first = labelled.get(label);
+              if (first !== void 0) {
+                ctx.addIssue(
+                  "error",
+                  "DUPLICATE_STEP_LABEL",
+                  `${where}steps ${first} and ${step.stepNumber} share the label "${label}". A label anchors one step for later deltas to address; two steps holding it makes every symbolic reference ambiguous and blocks all further edits to this implementation. Rename one.`,
+                  impl.id,
+                  isDraftCtx
+                );
+              } else {
+                labelled.set(label, step.stepNumber);
+              }
+            }
             let sound = true;
             const malformed = (msg) => {
               sound = false;
@@ -7626,11 +7644,11 @@ var init_narrative_antipatterns = __esm({
           const memberEdges = keys.flatMap((k) => (adjacency.get(k) ?? []).filter((e) => inScc.has(e.toKey)));
           if (memberEdges.length === 0) continue;
           const anchor = [...memberEdges].sort((a, b) => a.fromKey.localeCompare(b.fromKey))[0];
-          const path64 = [...keys].sort().join(" \u2192 ");
+          const path67 = [...keys].sort().join(" \u2192 ");
           ctx.addIssue(
             "warning",
             "UNCONDITIONAL_CALL_CYCLE",
-            `Call cycle with no guard: ${path64} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
+            `Call cycle with no guard: ${path67} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
             anchor.impl.id,
             memberEdges.some((e) => ctx.isImplementationDraft(e.impl))
           );
@@ -14403,6 +14421,137 @@ var init_repository = __esm({
   }
 });
+// src/core/baseline.ts
+function diffSize(d) {
+  return d.added.length + d.changed.length + d.removed.length;
+}
+function baselineDir() {
+  return process.env["WAIRON_BASELINE_DIR"] || path17.join(os5.homedir(), ".wairon", "baselines");
+}
+function keyFor(root) {
+  const normalized = path17.resolve(root).replace(/\\/g, "/").toLowerCase();
+  return crypto3.createHash("sha256").update(normalized).digest("hex").slice(0, 16);
+}
+function baselinePath(root) {
+  return path17.join(baselineDir(), `${keyFor(root)}.json`);
+}
+function readBaseline(root = getProjectRoot()) {
+  const p = baselinePath(root);
+  if (!pathExists(p)) return null;
+  try {
+    return JSON.parse(fs13.readFileSync(p, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeBaseline(record2) {
+  const p = baselinePath(record2.projectRoot);
+  ensureDir(path17.dirname(p));
+  fs13.writeFileSync(p, `${JSON.stringify(record2, null, 2)}
+`);
+  return p;
+}
+function currentSpecs(root) {
+  const mountDirs = loadSubsystemSpecs().filter((s) => s.projectPath && !s.id.includes("::")).map((s) => `${path17.resolve(root, s.projectPath).split(path17.sep).join("/")}/`);
+  const out = {};
+  for (const [abs, content] of snapshotSpecFiles()) {
+    const normalized = path17.resolve(abs).split(path17.sep).join("/");
+    if (mountDirs.some((dir) => normalized.startsWith(dir))) continue;
+    out[path17.relative(root, abs).split(path17.sep).join("/")] = content;
+  }
+  return out;
+}
+function captureBaseline(approvedBy, children = {}, root = getProjectRoot(), scope) {
+  const system = loadSystemSpec();
+  const current2 = currentSpecs(root);
+  let specs = current2;
+  if (scope) {
+    const previous = readBaseline(root)?.specs ?? {};
+    specs = { ...previous };
+    for (const rel2 of Object.keys(previous)) {
+      if (scope.paths.has(rel2) && current2[rel2] === void 0) delete specs[rel2];
+    }
+    for (const rel2 of scope.paths) {
+      if (current2[rel2] !== void 0) specs[rel2] = current2[rel2];
+    }
+  }
+  return {
+    schemaVersion: SCHEMA_VERSION,
+    projectRoot: path17.resolve(root),
+    systemName: system?.name ?? path17.basename(root),
+    approvedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    approvedBy,
+    stateId: computeGateStateId(),
+    specs,
+    children
+  };
+}
+function diffAgainstBaseline(root = getProjectRoot()) {
+  const baseline = readBaseline(root);
+  if (!baseline) return null;
+  const current2 = currentSpecs(root);
+  const added = [];
+  const changed = [];
+  const removed = [];
+  const unchangedPaths = [];
+  for (const [rel2, content] of Object.entries(current2)) {
+    const before = baseline.specs[rel2];
+    if (before === void 0) added.push(rel2);
+    else if (before !== content) changed.push(rel2);
+    else unchangedPaths.push(rel2);
+  }
+  for (const rel2 of Object.keys(baseline.specs)) {
+    if (current2[rel2] === void 0) removed.push(rel2);
+  }
+  return {
+    added: added.sort(),
+    changed: changed.sort(),
+    removed: removed.sort(),
+    unchangedPaths: unchangedPaths.sort()
+  };
+}
+function settledSpecPaths(root = getProjectRoot()) {
+  const diff = diffAgainstBaseline(root);
+  return diff ? new Set(diff.unchangedPaths) : null;
+}
+function pinOf(stateId) {
+  return `${stateId.algorithm}:${stateId.digest}`;
+}
+function currentChildPins(mounts, root = getProjectRoot()) {
+  const pins = {};
+  for (const mount of mounts) {
+    if (!mount.projectPath || mount.id.includes("::")) continue;
+    const childRoot = path17.resolve(root, mount.projectPath);
+    const child = readBaseline(childRoot);
+    if (child) pins[mount.id] = pinOf(child.stateId);
+  }
+  return pins;
+}
+function movedChildren(mounts, root = getProjectRoot()) {
+  const baseline = readBaseline(root);
+  if (!baseline) return [];
+  const now = currentChildPins(mounts, root);
+  const moved = [];
+  for (const [id, pinned] of Object.entries(baseline.children)) {
+    const current2 = now[id] ?? null;
+    if (current2 !== pinned) moved.push({ id, pinned, now: current2 });
+  }
+  return moved;
+}
+var fs13, os5, path17, crypto3, SCHEMA_VERSION;
+var init_baseline = __esm({
+  "src/core/baseline.ts"() {
+    "use strict";
+    fs13 = __toESM(require("fs"));
+    os5 = __toESM(require("os"));
+    path17 = __toESM(require("path"));
+    crypto3 = __toESM(require("crypto"));
+    init_fs();
+    init_specs2();
+    SCHEMA_VERSION = "1.0.0";
+  }
+});
 // src/core/validation.ts
 var validation_exports = {};
 __export(validation_exports, {
@@ -14533,7 +14682,7 @@ function validateSddTree(rulesOrOptions, projectType = "backend") {
   const types = loadTypeSpecs();
   const surfaceSnapshots = loadSurfaceSnapshots();
   const codeModel = buildCodeModel(implementations, getProjectRoot());
-  const statusBearing = treatAllAsComplete ? [...subsystems, ...components, ...interfaces, ...implementations] : [];
+  const statusBearing = treatAllAsComplete ? [...subsystems, ...components, ...interfaces, ...implementations] : settledStatusBearing({ subsystems, components, interfaces, implementations });
   const statusSnapshot = statusBearing.map((s) => s.status);
   for (const s of statusBearing) s.status = "complete";
   try {
@@ -14655,10 +14804,34 @@ function validateSddTree(rulesOrOptions, projectType = "backend") {
     });
   }
 }
+function settledStatusBearing(loaded) {
+  let settled;
+  try {
+    settled = settledSpecPaths();
+  } catch {
+    return [];
+  }
+  if (!settled || settled.size === 0) return [];
+  const root = getProjectRoot();
+  const index = scanAllSpecs();
+  const rel2 = (abs) => path18.relative(root, abs).split(path18.sep).join("/");
+  const out = [];
+  const take = (specs, paths) => {
+    for (const spec of specs) {
+      const p = paths[spec.id];
+      if (p && settled.has(rel2(p))) out.push(spec);
+    }
+  };
+  take(loaded.subsystems, index.paths.subsystem);
+  take(loaded.components, index.paths.component);
+  take(loaded.interfaces, index.paths.interface);
+  take(loaded.implementations, index.paths.implementation);
+  return out;
+}
 function validateAsComplete(options) {
   return validateSddTree({ ...options ?? {}, treatAllAsComplete: true });
 }
-var SUBPROJECT_REFERENCE_CODES, SUBPROJECT_CONFORMANCE_CODES;
+var path18, SUBPROJECT_REFERENCE_CODES, SUBPROJECT_CONFORMANCE_CODES;
 var init_validation = __esm({
   "src/core/validation.ts"() {
     "use strict";
@@ -14672,6 +14845,8 @@ var init_validation = __esm({
     init_source_analysis();
     init_specs2();
     init_fs();
+    path18 = __toESM(require("path"));
+    init_baseline();
     SUBPROJECT_REFERENCE_CODES = /* @__PURE__ */ new Set([
       "UNDEFINED_TYPE_REFERENCE",
       "INVALID_DEPENDENCY_REFERENCE",
@@ -15001,8 +15176,8 @@ function generateSequenceDiagram(componentId, methodName, options) {
     const steps = [...methodImpl.narrative].sort((a, b) => a.stepNumber - b.stepNumber);
     for (const step of steps) {
       for (const par of parallelArms) {
-        const sep6 = par.sepByStep.get(step.stepNumber);
-        if (sep6 !== void 0) lines.push(`  and ${escapeLabel(sep6)}`);
+        const sep9 = par.sepByStep.get(step.stepNumber);
+        if (sep9 !== void 0) lines.push(`  and ${escapeLabel(sep9)}`);
       }
       switch (step.type) {
         case "local":
@@ -15282,6 +15457,7 @@ __export(specs_exports, {
   saveTypeSpec: () => saveTypeSpec,
   scanAllSpecs: () => scanAllSpecs,
   snapshotSpecFiles: () => snapshotSpecFiles,
+  specPathsInScope: () => specPathsInScope,
   splitNamespace: () => splitNamespace,
   updateSpec: () => updateSpec,
   workspaceFor: () => workspaceFor
@@ -15355,16 +15531,16 @@ function relativizeId(id, prefix) {
   return `${"super::".repeat(prefixParts.length - common)}${idParts.slice(common).join("::")}`;
 }
 function isWithin(dir, file) {
-  const d = path17.resolve(dir);
-  const f = path17.resolve(file);
-  return f === d || f.startsWith(d + path17.sep);
+  const d = path19.resolve(dir);
+  const f = path19.resolve(file);
+  return f === d || f.startsWith(d + path19.sep);
 }
 function projectPathEscapesRoot(projectRoot2, projectPath, resolvedChildDir) {
-  return path17.isAbsolute(projectPath) || !isWithin(projectRoot2, resolvedChildDir);
+  return path19.isAbsolute(projectPath) || !isWithin(projectRoot2, resolvedChildDir);
 }
 function assertContainedProjectPath(projectRoot2, projectPath) {
-  const root = path17.resolve(projectRoot2);
-  const resolved = path17.resolve(root, projectPath);
+  const root = path19.resolve(projectRoot2);
+  const resolved = path19.resolve(root, projectPath);
   if (projectPathEscapesRoot(root, projectPath, resolved)) {
     throw new Error(
       `projectPath "${projectPath}" must resolve within the project root "${root}", but resolves to "${resolved}"; absolute paths and ../-escaping paths are rejected so a chained subproject is always contained by its parent.`
@@ -15375,11 +15551,11 @@ function assertContainedProjectPath(projectRoot2, projectPath) {
 function findChainingParent(childRoot) {
   let childResolved;
   try {
-    childResolved = path17.resolve(childRoot);
+    childResolved = path19.resolve(childRoot);
   } catch {
     return null;
   }
-  let dir = path17.dirname(childResolved);
+  let dir = path19.dirname(childResolved);
   for (let hops = 0; hops < 32; hops++) {
     const specsDir = aiPathsAt(dir).specsDir();
     if (pathExists(specsDir)) {
@@ -15394,7 +15570,7 @@ function findChainingParent(childRoot) {
           const projectPath = raw.projectPath;
           if (typeof projectPath === "string" && projectPath.trim() !== "") {
             try {
-              if (path17.resolve(dir, projectPath) === childResolved) {
+              if (path19.resolve(dir, projectPath) === childResolved) {
                 const id = raw.id;
                 return { parentRoot: dir, subsystemId: typeof id === "string" ? id : "?" };
               }
@@ -15404,7 +15580,7 @@ function findChainingParent(childRoot) {
         }
       }
     }
-    const up = path17.dirname(dir);
+    const up = path19.dirname(dir);
     if (up === dir) break;
     dir = up;
   }
@@ -15509,18 +15685,18 @@ function findOwner(id, components) {
   }) ?? null;
 }
 function moveComponentFolder(fromDir, toDir) {
-  if (path17.normalize(fromDir) === path17.normalize(toDir)) return false;
-  if (!fs13.existsSync(fromDir) || fs13.existsSync(toDir)) return false;
-  ensureDir(path17.dirname(toDir));
-  fs13.renameSync(fromDir, toDir);
+  if (path19.normalize(fromDir) === path19.normalize(toDir)) return false;
+  if (!fs14.existsSync(fromDir) || fs14.existsSync(toDir)) return false;
+  ensureDir(path19.dirname(toDir));
+  fs14.renameSync(fromDir, toDir);
   return true;
 }
 function cleanEmptyDirs(filePath, specsRoot) {
-  let dir = path17.dirname(filePath);
+  let dir = path19.dirname(filePath);
   while (dir !== specsRoot && dir.startsWith(specsRoot)) {
-    if (fs13.existsSync(dir) && fs13.readdirSync(dir).length === 0) {
-      fs13.rmdirSync(dir);
-      dir = path17.dirname(dir);
+    if (fs14.existsSync(dir) && fs14.readdirSync(dir).length === 0) {
+      fs14.rmdirSync(dir);
+      dir = path19.dirname(dir);
     } else {
       break;
     }
@@ -15539,13 +15715,13 @@ function parseOrThrow(schema, value, kind, id) {
 function computeSpecTreeSignature(dirs) {
   const parts = [];
   for (const dir of dirs) {
-    if (!fs13.existsSync(dir)) {
+    if (!fs14.existsSync(dir)) {
       parts.push(`${dir}:missing`);
       continue;
     }
     for (const f of listFilesRecursive(dir, ".yaml")) {
       try {
-        const st = fs13.statSync(f);
+        const st = fs14.statSync(f);
         parts.push(`${f}:${st.mtimeMs}:${st.size}`);
       } catch {
         parts.push(`${f}:gone`);
@@ -15555,7 +15731,7 @@ function computeSpecTreeSignature(dirs) {
   return parts.join("|");
 }
 function workspaceFor(rootDir) {
-  const key = path17.resolve(rootDir);
+  const key = path19.resolve(rootDir);
   let ws = workspaces.get(key);
   if (!ws) {
     ws = new SpecWorkspace(key);
@@ -15694,7 +15870,7 @@ function readLockState() {
   return { state: stateIdEquals(record2.stateId, current2) ? "locked" : "stale", record: record2, current: current2 };
 }
 function computeStateIdAt(root) {
-  const resolved = path17.resolve(root);
+  const resolved = path19.resolve(root);
   return runWithProjectRoot(resolved, () => {
     workspaceFor(resolved).invalidate();
     const system = loadSystemSpec();
@@ -15724,12 +15900,15 @@ function collectPromotableSpecs(scopeSubsystem) {
 function applySpecStatus(kind, id, status2) {
   current().applySpecStatus(kind, id, status2);
 }
+function specPathsInScope(scopeSubsystem) {
+  return current().specPathsInScope(scopeSubsystem);
+}
 function snapshotSpecFiles() {
   return current().snapshotSpecFiles();
 }
 function restoreSpecFiles(snapshot) {
   for (const [file, content] of snapshot) {
-    fs13.writeFileSync(file, content);
+    fs14.writeFileSync(file, content);
   }
 }
 function findLegacySpecFiles() {
@@ -15738,12 +15917,12 @@ function findLegacySpecFiles() {
 function updateSpec(kind, id, delta, hooks) {
   return current().updateSpec(kind, id, delta, hooks);
 }
-var fs13, path17, SIGNATURE_TTL_MS, SpecWorkspace, workspaces;
+var fs14, path19, SIGNATURE_TTL_MS, SpecWorkspace, workspaces;
 var init_specs2 = __esm({
   "src/core/specs.ts"() {
     "use strict";
-    fs13 = __toESM(require("fs"));
-    path17 = __toESM(require("path"));
+    fs14 = __toESM(require("fs"));
+    path19 = __toESM(require("path"));
     init_loader();
     init_fs();
     init_statehash();
@@ -15764,7 +15943,7 @@ var init_specs2 = __esm({
         this.rootSubsystems = /* @__PURE__ */ new Set();
         this.scanVisitedSpecDirs = [];
         this.loaderIssues = [];
-        this.rootDir = path17.resolve(rootDir);
+        this.rootDir = path19.resolve(rootDir);
         this.paths = aiPathsAt(this.rootDir);
       }
       invalidate() {
@@ -15791,7 +15970,7 @@ var init_specs2 = __esm({
         this.rootSubsystems.clear();
         this.cachedRecursive = recursive;
         this.scanVisitedSpecDirs = [];
-        const visited = /* @__PURE__ */ new Set([path17.resolve(this.rootDir)]);
+        const visited = /* @__PURE__ */ new Set([path19.resolve(this.rootDir)]);
         const maxDepth = typeof recursive === "number" ? recursive : recursive ? Infinity : 0;
         this.cachedIndex = this.scanSpecsForProject(this.rootDir, "", visited, maxDepth, 0);
         this.cachedSpecDirs = this.scanVisitedSpecDirs;
@@ -15806,10 +15985,10 @@ var init_specs2 = __esm({
         this.scanVisitedSpecDirs.push(specsDir);
         if (!pathExists(specsDir)) return index;
         const files = listFilesRecursive(specsDir, ".yaml");
-        const systemYaml = path17.normalize(projectPaths.specsSystem());
+        const systemYaml = path19.normalize(projectPaths.specsSystem());
         const localSubprojects = [];
         for (const file of files) {
-          const normFile = path17.normalize(file);
+          const normFile = path19.normalize(file);
           if (normFile === systemYaml) continue;
           let detectedType = "spec";
           try {
@@ -15819,7 +15998,7 @@ var init_specs2 = __esm({
                 severity: "error",
                 code: "INVALID_YAML",
                 message: `Spec file "${file}" is not a valid YAML object or is empty.`,
-                specId: path17.basename(file, ".yaml")
+                specId: path19.basename(file, ".yaml")
               });
               continue;
             }
@@ -15851,8 +16030,8 @@ var init_specs2 = __esm({
               detectedType = "implementation";
               const parsed = ImplementationSpecSchema.parse(raw);
               if (parsed.sourcePath) {
-                const absSourcePath = path17.resolve(projectDir, parsed.sourcePath);
-                parsed.sourcePath = path17.relative(projectDir, absSourcePath).replace(/\\/g, "/");
+                const absSourcePath = path19.resolve(projectDir, parsed.sourcePath);
+                parsed.sourcePath = path19.relative(projectDir, absSourcePath).replace(/\\/g, "/");
               }
               index.implementations.push(parsed);
               index.paths.implementation[parsed.id] = file;
@@ -15874,11 +16053,11 @@ var init_specs2 = __esm({
                 severity: "error",
                 code: "UNKNOWN_SPEC_TYPE",
                 message: `Spec file "${file}" does not match any recognized L1-L4 schema structure.`,
-                specId: path17.basename(file, ".yaml")
+                specId: path19.basename(file, ".yaml")
               });
             }
           } catch (e) {
-            const filename = path17.basename(file, ".yaml");
+            const filename = path19.basename(file, ".yaml");
             this.loaderIssues.push({
               severity: "error",
               code: "SCHEMA_VALIDATION_ERROR",
@@ -15976,7 +16155,7 @@ var init_specs2 = __esm({
         }
         if (currentDepth < maxDepth) {
           for (const subproj of localSubprojects) {
-            const childDir = path17.resolve(projectDir, subproj.projectPath);
+            const childDir = path19.resolve(projectDir, subproj.projectPath);
             if (projectPathEscapesRoot(this.rootDir, subproj.projectPath, childDir)) {
               this.loaderIssues.push({
                 severity: "error",
@@ -15995,7 +16174,7 @@ var init_specs2 = __esm({
               });
               continue;
             }
-            if (!fs13.existsSync(childDir)) {
+            if (!fs14.existsSync(childDir)) {
               this.loaderIssues.push({
                 severity: "error",
                 code: "SUBPROJECT_NOT_FOUND",
@@ -16038,7 +16217,7 @@ var init_specs2 = __esm({
           const index = this.scanAll();
           const sub = index.subsystems.find((s) => s.id === currentPrefix);
           if (sub && sub.projectPath) {
-            const nextDir = path17.resolve(currentDir, sub.projectPath);
+            const nextDir = path19.resolve(currentDir, sub.projectPath);
             if (projectPathEscapesRoot(this.rootDir, sub.projectPath, nextDir)) {
               this.loaderIssues.push({
                 severity: "error",
@@ -16090,9 +16269,9 @@ var init_specs2 = __esm({
           return index.paths.subsystem[matches2[0]];
         }
         if (pathExists(this.paths.specsSubsystemsDir()) && listFiles(this.paths.specsSubsystemsDir(), ".yaml").length > 0) {
-          return path17.join(this.paths.specsSubsystemsDir(), `${id}.yaml`);
+          return path19.join(this.paths.specsSubsystemsDir(), `${id}.yaml`);
         }
-        return path17.join(this.paths.specsDir(), id, ".index.yaml");
+        return path19.join(this.paths.specsDir(), id, ".index.yaml");
       }
       getComponentPath(id, subsystemId) {
         const index = this.scanAll();
@@ -16112,21 +16291,21 @@ var init_specs2 = __esm({
         if (owner) {
           const ownerPath = index.paths.component[owner.id];
           if (ownerPath && ownerPath.endsWith(".index.yaml")) {
-            return path17.join(path17.dirname(ownerPath), id, ".index.yaml");
+            return path19.join(path19.dirname(ownerPath), id, ".index.yaml");
           }
         }
         if (subsystemId) {
           const subPath = this.getSubsystemPath(subsystemId);
-          const subDir = path17.dirname(subPath);
+          const subDir = path19.dirname(subPath);
           if (subPath.endsWith(".index.yaml")) {
-            return path17.join(subDir, id, ".index.yaml");
+            return path19.join(subDir, id, ".index.yaml");
           }
         }
         if (pathExists(this.paths.specsComponentsDir()) && listFiles(this.paths.specsComponentsDir(), ".yaml").length > 0) {
-          return path17.join(this.paths.specsComponentsDir(), `${id}.yaml`);
+          return path19.join(this.paths.specsComponentsDir(), `${id}.yaml`);
         }
         const targetSubsystem = subsystemId || "default";
-        return path17.join(this.paths.specsDir(), targetSubsystem, id, ".index.yaml");
+        return path19.join(this.paths.specsDir(), targetSubsystem, id, ".index.yaml");
       }
       getInterfacePath(id, componentId) {
         const index = this.scanAll();
@@ -16152,16 +16331,16 @@ var init_specs2 = __esm({
         }
         if (componentId) {
           const compPath = this.getComponentPath(componentId);
-          const compDir = path17.dirname(compPath);
+          const compDir = path19.dirname(compPath);
           if (compPath.endsWith(".index.yaml")) {
-            return path17.join(compDir, ".interface.yaml");
+            return path19.join(compDir, ".interface.yaml");
           }
         }
         if (pathExists(this.paths.specsInterfacesDir()) && listFiles(this.paths.specsInterfacesDir(), ".yaml").length > 0) {
-          return path17.join(this.paths.specsInterfacesDir(), `${id}.yaml`);
+          return path19.join(this.paths.specsInterfacesDir(), `${id}.yaml`);
         }
         const targetComponent = componentId || "default";
-        return path17.join(this.paths.specsDir(), "default", targetComponent, ".interface.yaml");
+        return path19.join(this.paths.specsDir(), "default", targetComponent, ".interface.yaml");
       }
       getImplementationPath(id, contractId) {
         const index = this.scanAll();
@@ -16187,16 +16366,16 @@ var init_specs2 = __esm({
         }
         if (contractId) {
           const intfPath = this.getInterfacePath(contractId);
-          const intfDir = path17.dirname(intfPath);
+          const intfDir = path19.dirname(intfPath);
           if (intfPath.endsWith(".interface.yaml")) {
-            return path17.join(intfDir, ".implementation.yaml");
+            return path19.join(intfDir, ".implementation.yaml");
           }
         }
         if (pathExists(this.paths.specsImplementationsDir()) && listFiles(this.paths.specsImplementationsDir(), ".yaml").length > 0) {
-          return path17.join(this.paths.specsImplementationsDir(), `${id}.yaml`);
+          return path19.join(this.paths.specsImplementationsDir(), `${id}.yaml`);
         }
         const targetContract = contractId ? contractId.replace(/^i/, "") : "default";
-        return path17.join(this.paths.specsDir(), "default", targetContract, ".implementation.yaml");
+        return path19.join(this.paths.specsDir(), "default", targetContract, ".implementation.yaml");
       }
       getTypePath(id, subsystemId, group) {
         const index = this.scanAll();
@@ -16227,7 +16406,7 @@ var init_specs2 = __esm({
           const groupPath = index.paths.group[targetGroup] || index.paths.group[plainGroup];
           if (groupPath) {
             const localId2 = id.split("::").pop();
-            return path17.join(path17.dirname(groupPath), `${localId2}.yaml`);
+            return path19.join(path19.dirname(groupPath), `${localId2}.yaml`);
           }
         }
         let localId = id;
@@ -16240,12 +16419,12 @@ var init_specs2 = __esm({
         }
         if (subsystemId) {
           const subPath = this.getSubsystemPath(subsystemId);
-          const subDir = path17.dirname(subPath);
+          const subDir = path19.dirname(subPath);
           if (subPath.endsWith(".index.yaml")) {
-            return path17.join(subDir, "types", `${localId}.yaml`);
+            return path19.join(subDir, "types", `${localId}.yaml`);
           }
         }
-        return path17.join(this.paths.specsTypesDir(), `${localId}.yaml`);
+        return path19.join(this.paths.specsTypesDir(), `${localId}.yaml`);
       }
       getGroupPath(id, subsystemId) {
         const index = this.scanAll();
@@ -16279,12 +16458,12 @@ var init_specs2 = __esm({
         }
         if (subsystemId) {
           const subPath = this.getSubsystemPath(subsystemId);
-          const subDir = path17.dirname(subPath);
+          const subDir = path19.dirname(subPath);
           if (subPath.endsWith(".index.yaml")) {
-            return path17.join(subDir, "types", localId, ".index.yaml");
+            return path19.join(subDir, "types", localId, ".index.yaml");
           }
         }
-        return path17.join(this.paths.specsTypesDir(), localId, ".index.yaml");
+        return path19.join(this.paths.specsTypesDir(), localId, ".index.yaml");
       }
       // -------------------------------------------------------------------------
       // Level 0: System
@@ -16307,7 +16486,7 @@ var init_specs2 = __esm({
       }
       saveSystemSpec(spec) {
         const p = this.paths.specsSystem();
-        ensureDir(path17.dirname(p));
+        ensureDir(path19.dirname(p));
         writeYamlFile(p, parseOrThrow(SystemSpecSchema, spec, "system", spec.name));
         invalidateSpecCache();
       }
@@ -16425,7 +16604,7 @@ var init_specs2 = __esm({
       }
       saveSubsystemSpec(spec) {
         const p = this.getSubsystemPath(spec.id);
-        ensureDir(path17.dirname(p));
+        ensureDir(path19.dirname(p));
         const { prefix } = splitNamespace(spec.id);
         if (!prefix && spec.projectPath && spec.projectPath.trim() !== "") {
           assertContainedProjectPath(this.rootDir, spec.projectPath);
@@ -16456,9 +16635,9 @@ var init_specs2 = __esm({
       }
       deleteSubsystemSpec(id) {
         const p = this.getSubsystemPath(id);
-        if (!fs13.existsSync(p)) return false;
-        fs13.unlinkSync(p);
-        cleanEmptyDirs(p, path17.resolve(this.paths.specsDir()));
+        if (!fs14.existsSync(p)) return false;
+        fs14.unlinkSync(p);
+        cleanEmptyDirs(p, path19.resolve(this.paths.specsDir()));
         invalidateSpecCache();
         return true;
       }
@@ -16491,7 +16670,7 @@ var init_specs2 = __esm({
       saveComponentSpec(spec, opts) {
         const notices = [];
         const p = this.getComponentPath(spec.id, spec.subsystem);
-        ensureDir(path17.dirname(p));
+        ensureDir(path19.dirname(p));
         const specToWrite = this.prepareComponentForWrite(spec);
         const existing = this.loadComponentSpec(spec.id);
         if (existing) {
@@ -16508,7 +16687,7 @@ var init_specs2 = __esm({
         const subsystemChanged = existing && existing.subsystem !== spec.subsystem && splitNamespace(existing.subsystem).localId !== splitNamespace(spec.subsystem).localId;
         if (subsystemChanged && !p.endsWith(".index.yaml")) {
           notices.push(
-            `component "${spec.id}" already exists at ${path17.relative(this.rootDir, p)} \u2014 the flat layout re-saves in place and never relocates the file. The subsystem field is now "${spec.subsystem}" (was "${existing.subsystem}").`
+            `component "${spec.id}" already exists at ${path19.relative(this.rootDir, p)} \u2014 the flat layout re-saves in place and never relocates the file. The subsystem field is now "${spec.subsystem}" (was "${existing.subsystem}").`
           );
         }
         specToWrite.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -16519,9 +16698,9 @@ var init_specs2 = __esm({
       }
       deleteComponentSpec(id) {
         const p = this.getComponentPath(id);
-        if (!fs13.existsSync(p)) return false;
-        fs13.unlinkSync(p);
-        cleanEmptyDirs(p, path17.resolve(this.paths.specsDir()));
+        if (!fs14.existsSync(p)) return false;
+        fs14.unlinkSync(p);
+        cleanEmptyDirs(p, path19.resolve(this.paths.specsDir()));
         invalidateSpecCache();
         return true;
       }
@@ -16534,12 +16713,12 @@ var init_specs2 = __esm({
         if (owner) {
           const ownerPath = index.paths.component[owner.id];
           if (ownerPath && ownerPath.endsWith(".index.yaml")) {
-            const ownerSubDir = path17.dirname(this.getSubsystemPath(owner.subsystem));
-            return path17.join(ownerSubDir, owner.id, comp.id);
+            const ownerSubDir = path19.dirname(this.getSubsystemPath(owner.subsystem));
+            return path19.join(ownerSubDir, owner.id, comp.id);
           }
         }
-        const subDir = path17.dirname(this.getSubsystemPath(comp.subsystem));
-        return path17.join(subDir, comp.id);
+        const subDir = path19.dirname(this.getSubsystemPath(comp.subsystem));
+        return path19.join(subDir, comp.id);
       }
       /**
        * Move component folders so the physical tree mirrors ownership: each owned
@@ -16555,7 +16734,7 @@ var init_specs2 = __esm({
           if (!currentPath) continue;
           const desiredDir = this.desiredComponentDir(comp, index);
           if (!desiredDir) continue;
-          if (moveComponentFolder(path17.dirname(currentPath), desiredDir)) moved.push(comp.id);
+          if (moveComponentFolder(path19.dirname(currentPath), desiredDir)) moved.push(comp.id);
         }
         if (moved.length) invalidateSpecCache();
         return moved;
@@ -16611,7 +16790,7 @@ var init_specs2 = __esm({
         if (!occupantId) return;
         if (occupantId === id || splitNamespace(occupantId).localId === splitNamespace(id).localId) return;
         throw new Error(
-          `Cannot write ${kind} "${id}": ${parentLabel} is already ${kind === "interface" ? "served by" : "implemented by"} "${occupantId}" at ${path17.relative(this.rootDir, p)}, and both ids resolve to that one file. Re-author "${occupantId}" instead, or delete it first if you meant to replace it.`
+          `Cannot write ${kind} "${id}": ${parentLabel} is already ${kind === "interface" ? "served by" : "implemented by"} "${occupantId}" at ${path19.relative(this.rootDir, p)}, and both ids resolve to that one file. Re-author "${occupantId}" instead, or delete it first if you meant to replace it.`
         );
       }
       /** Returns non-fatal placement notices (see saveTypeSpec) — empty when there is nothing to clarify. */
@@ -16619,12 +16798,12 @@ var init_specs2 = __esm({
         const notices = [];
         const p = this.getInterfacePath(spec.id, spec.component);
         this.assertPathHoldsNoOtherSpec(p, spec.id, "interface", `component "${spec.component}"`);
-        ensureDir(path17.dirname(p));
+        ensureDir(path19.dirname(p));
         const specToWrite = this.prepareInterfaceForWrite(spec);
         const existing = this.loadInterfaceSpec(spec.id);
         if (existing && existing.component !== spec.component && splitNamespace(existing.component).localId !== splitNamespace(spec.component).localId) {
           notices.push(
-            `interface "${spec.id}" already exists at ${path17.relative(this.rootDir, p)} \u2014 re-saving updates the component binding field in place (now "${spec.component}", was "${existing.component}") and never moves the file.`
+            `interface "${spec.id}" already exists at ${path19.relative(this.rootDir, p)} \u2014 re-saving updates the component binding field in place (now "${spec.component}", was "${existing.component}") and never moves the file.`
           );
         }
         if (existing) {
@@ -16647,9 +16826,9 @@ var init_specs2 = __esm({
       }
       deleteInterfaceSpec(id) {
         const p = this.getInterfacePath(id);
-        if (!fs13.existsSync(p)) return false;
-        fs13.unlinkSync(p);
-        cleanEmptyDirs(p, path17.resolve(this.paths.specsDir()));
+        if (!fs14.existsSync(p)) return false;
+        fs14.unlinkSync(p);
+        cleanEmptyDirs(p, path19.resolve(this.paths.specsDir()));
         invalidateSpecCache();
         return true;
       }
@@ -16683,12 +16862,12 @@ var init_specs2 = __esm({
         const notices = [];
         const p = this.getImplementationPath(spec.id, spec.contract);
         this.assertPathHoldsNoOtherSpec(p, spec.id, "implementation", `contract "${spec.contract}"`);
-        ensureDir(path17.dirname(p));
+        ensureDir(path19.dirname(p));
         const specToWrite = this.prepareImplementationForWrite(spec);
         const existing = this.loadImplementationSpec(spec.id);
         if (existing && existing.contract !== spec.contract && splitNamespace(existing.contract).localId !== splitNamespace(spec.contract).localId) {
           notices.push(
-            `implementation "${spec.id}" already exists at ${path17.relative(this.rootDir, p)} \u2014 re-saving updates the contract binding field in place (now "${spec.contract}", was "${existing.contract}") and never moves the file.`
+            `implementation "${spec.id}" already exists at ${path19.relative(this.rootDir, p)} \u2014 re-saving updates the contract binding field in place (now "${spec.contract}", was "${existing.contract}") and never moves the file.`
           );
         }
         if (existing) {
@@ -16704,9 +16883,9 @@ var init_specs2 = __esm({
       }
       deleteImplementationSpec(id) {
         const p = this.getImplementationPath(id);
-        if (!fs13.existsSync(p)) return false;
-        fs13.unlinkSync(p);
-        cleanEmptyDirs(p, path17.resolve(this.paths.specsDir()));
+        if (!fs14.existsSync(p)) return false;
+        fs14.unlinkSync(p);
+        cleanEmptyDirs(p, path19.resolve(this.paths.specsDir()));
         invalidateSpecCache();
         return true;
       }
@@ -16731,11 +16910,11 @@ var init_specs2 = __esm({
         const existing = this.loadTypeSpec(spec.id);
         const group = spec.group || (existing ? existing.group : void 0);
         const p = this.getTypePath(spec.id, spec.subsystem, group);
-        ensureDir(path17.dirname(p));
+        ensureDir(path19.dirname(p));
         const subsystemChanged = existing && (existing.subsystem ?? "") !== (spec.subsystem ?? "") && splitNamespace(existing.subsystem ?? "").localId !== splitNamespace(spec.subsystem ?? "").localId;
         if (subsystemChanged) {
           notices.push(
-            `type "${spec.id}" already exists at ${path17.relative(this.rootDir, p)} \u2014 re-saving updates fields in place and never relocates the file. The subsystem field is now "${spec.subsystem ?? "(none)"}" (was "${existing.subsystem ?? "(none)"}").`
+            `type "${spec.id}" already exists at ${path19.relative(this.rootDir, p)} \u2014 re-saving updates fields in place and never relocates the file. The subsystem field is now "${spec.subsystem ?? "(none)"}" (was "${existing.subsystem ?? "(none)"}").`
           );
         }
         if (spec.subsystem && (!existing || subsystemChanged) && !this.getSubsystemPath(spec.subsystem).endsWith(".index.yaml")) {
@@ -16758,9 +16937,9 @@ var init_specs2 = __esm({
       deleteTypeSpec(id) {
         const spec = this.loadTypeSpec(id);
         const p = this.getTypePath(id, spec?.subsystem, spec?.group);
-        if (!fs13.existsSync(p)) return false;
-        fs13.unlinkSync(p);
-        cleanEmptyDirs(p, path17.resolve(this.paths.specsDir()));
+        if (!fs14.existsSync(p)) return false;
+        fs14.unlinkSync(p);
+        cleanEmptyDirs(p, path19.resolve(this.paths.specsDir()));
         invalidateSpecCache();
         return true;
       }
@@ -16775,7 +16954,7 @@ var init_specs2 = __esm({
       }
       saveGroupSpec(spec) {
         const p = this.getGroupPath(spec.id);
-        ensureDir(path17.dirname(p));
+        ensureDir(path19.dirname(p));
         const specToWrite = this.prepareGroupForWrite(spec);
         const existing = this.loadGroupSpec(spec.id);
         if (existing) {
@@ -16787,9 +16966,9 @@ var init_specs2 = __esm({
       }
       deleteGroupSpec(id) {
         const p = this.getGroupPath(id);
-        if (!fs13.existsSync(p)) return false;
-        fs13.unlinkSync(p);
-        cleanEmptyDirs(p, path17.resolve(this.paths.specsDir()));
+        if (!fs14.existsSync(p)) return false;
+        fs14.unlinkSync(p);
+        cleanEmptyDirs(p, path19.resolve(this.paths.specsDir()));
         invalidateSpecCache();
         return true;
       }
@@ -16837,6 +17016,50 @@ var init_specs2 = __esm({
         }
         return out;
       }
+      /**
+       * Every spec FILE inside a subsystem scope (absolute paths), regardless of
+       * status. `collectPromotableSpecs` answers a different question — which specs
+       * are not yet complete — so it cannot stand in for this: a scoped approval
+       * must cover the specs it approves whether or not they were already settled.
+       */
+      specPathsInScope(scopeSubsystem) {
+        const index = this.scanAll();
+        const components = this.loadComponentSpecs();
+        const interfaces = this.loadInterfaceSpecs();
+        const implementations = this.loadImplementationSpecs();
+        const inScope = (specSubsystem) => {
+          if (!scopeSubsystem) return true;
+          if (!specSubsystem) return false;
+          return specSubsystem === scopeSubsystem || specSubsystem.startsWith(`${scopeSubsystem}::`);
+        };
+        const out = /* @__PURE__ */ new Set();
+        const add = (p) => {
+          if (p) out.add(path19.resolve(p));
+        };
+        for (const s of this.loadSubsystemSpecs()) {
+          if (!scopeSubsystem || s.id === scopeSubsystem || s.id.startsWith(`${scopeSubsystem}::`)) {
+            add(index.paths.subsystem[s.id]);
+          }
+        }
+        for (const c of components) {
+          if (inScope(c.subsystem)) add(index.paths.component[c.id]);
+        }
+        for (const i of interfaces) {
+          const comp = components.find((c) => c.id === i.component);
+          if (comp && inScope(comp.subsystem)) add(index.paths.interface[i.id]);
+        }
+        for (const m of implementations) {
+          const intf = interfaces.find((i) => i.id === m.contract);
+          const comp = intf ? components.find((c) => c.id === intf.component) : null;
+          if (comp && inScope(comp.subsystem)) add(index.paths.implementation[m.id]);
+        }
+        if (!scopeSubsystem) {
+          add(this.paths.specsSystem());
+          for (const p of Object.values(index.paths.type)) add(p);
+          for (const p of Object.values(index.paths.group)) add(p);
+        }
+        return [...out];
+      }
       /** Set a single spec's status (bumps updatedAt). Caller invalidates the cache. */
       applySpecStatus(kind, id, status2) {
         switch (kind) {
@@ -16874,16 +17097,16 @@ var init_specs2 = __esm({
         const files = /* @__PURE__ */ new Set();
         const sysPath = this.paths.specsSystem();
         if (pathExists(sysPath)) {
-          files.add(path17.resolve(sysPath));
+          files.add(path19.resolve(sysPath));
         }
         for (const group of Object.values(index.paths)) {
           for (const file of Object.values(group)) {
-            files.add(path17.resolve(file));
+            files.add(path19.resolve(file));
           }
         }
         for (const file of files) {
-          if (fs13.existsSync(file)) {
-            snapshot.set(file, fs13.readFileSync(file, "utf8"));
+          if (fs14.existsSync(file)) {
+            snapshot.set(file, fs14.readFileSync(file, "utf8"));
           }
         }
         return snapshot;
@@ -16897,20 +17120,20 @@ var init_specs2 = __esm({
         const files = listFilesRecursive(specsDir, ".yaml");
         const legacy = [];
         for (const f of files) {
-          const base = path17.basename(f);
-          const dir = path17.dirname(f);
+          const base = path19.basename(f);
+          const dir = path19.dirname(f);
           if (base === "system.yaml") {
-            legacy.push({ path: f, expected: path17.join(dir, ".index.yaml") });
+            legacy.push({ path: f, expected: path19.join(dir, ".index.yaml") });
           } else if (base === "subsystem.yaml") {
-            legacy.push({ path: f, expected: path17.join(dir, ".index.yaml") });
+            legacy.push({ path: f, expected: path19.join(dir, ".index.yaml") });
           } else if (base === "component.yaml") {
-            legacy.push({ path: f, expected: path17.join(dir, ".index.yaml") });
+            legacy.push({ path: f, expected: path19.join(dir, ".index.yaml") });
           } else if (base === "group.yaml") {
-            legacy.push({ path: f, expected: path17.join(dir, ".index.yaml") });
+            legacy.push({ path: f, expected: path19.join(dir, ".index.yaml") });
           } else if (base === "interface.yaml") {
-            legacy.push({ path: f, expected: path17.join(dir, ".interface.yaml") });
+            legacy.push({ path: f, expected: path19.join(dir, ".interface.yaml") });
           } else if (base === "implementation.yaml") {
-            legacy.push({ path: f, expected: path17.join(dir, ".implementation.yaml") });
+            legacy.push({ path: f, expected: path19.join(dir, ".implementation.yaml") });
           }
         }
         return legacy;
@@ -17405,7 +17628,7 @@ function provisionProject(name) {
 function ensureProjectInitialized(fallbackName) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const paths = aiPathsAt(getProjectRoot());
-  const hasSystem = fs14.existsSync(paths.specsSystem());
+  const hasSystem = fs15.existsSync(paths.specsSystem());
   let name = fallbackName;
   if (hasSystem) {
     const existing = loadSystemSpec();
@@ -17413,7 +17636,7 @@ function ensureProjectInitialized(fallbackName) {
   }
   let wroteConfig = false;
   let wroteSystem = false;
-  if (!fs14.existsSync(paths.projectConfig())) {
+  if (!fs15.existsSync(paths.projectConfig())) {
     saveProjectConfig(defaultProjectConfig(name, now));
     wroteConfig = true;
   }
@@ -17442,11 +17665,11 @@ function promoteAllComplete() {
 function walkChainedSubprojects(projectRoot2, onChild) {
   const visited = /* @__PURE__ */ new Set();
   const walk = (dir) => {
-    const resolved = path18.resolve(dir);
+    const resolved = path20.resolve(dir);
     if (visited.has(resolved)) return;
     visited.add(resolved);
     const specsDir = aiPathsAt(dir).specsDir();
-    if (!fs14.existsSync(specsDir)) return;
+    if (!fs15.existsSync(specsDir)) return;
     for (const file of listFilesRecursive(specsDir, ".yaml")) {
       let raw;
       try {
@@ -17464,7 +17687,7 @@ function walkChainedSubprojects(projectRoot2, onChild) {
         continue;
       }
       const id = raw.id;
-      onChild(childDir, typeof id === "string" ? id : path18.basename(childDir));
+      onChild(childDir, typeof id === "string" ? id : path20.basename(childDir));
       walk(childDir);
     }
   };
@@ -17473,7 +17696,7 @@ function walkChainedSubprojects(projectRoot2, onChild) {
 function listDirectChainedSubprojects(projectRoot2) {
   const out = [];
   const specsDir = aiPathsAt(projectRoot2).specsDir();
-  if (!fs14.existsSync(specsDir)) return out;
+  if (!fs15.existsSync(specsDir)) return out;
   for (const file of listFilesRecursive(specsDir, ".yaml")) {
     let raw;
     try {
@@ -17491,12 +17714,12 @@ function listDirectChainedSubprojects(projectRoot2) {
       continue;
     }
     const id = raw.id;
-    out.push({ dir, subsystemId: typeof id === "string" ? id : path18.basename(dir) });
+    out.push({ dir, subsystemId: typeof id === "string" ? id : path20.basename(dir) });
   }
   return out;
 }
 function childHasSpecsButNoConfig(childDir) {
-  return fs14.existsSync(aiPathsAt(childDir).specsDir()) && !fs14.existsSync(aiPathsAt(childDir).projectConfig());
+  return fs15.existsSync(aiPathsAt(childDir).specsDir()) && !fs15.existsSync(aiPathsAt(childDir).projectConfig());
 }
 function findChainingSubprojectsMissingConfig(projectRoot2) {
   const missing = [];
@@ -17545,14 +17768,14 @@ function moveSubsystemProject(subsystemId, newProjectPath) {
   const oldDir = assertContainedProjectPath(root, sub.projectPath);
   const newDir = assertContainedProjectPath(root, nextPath);
   if (oldDir !== newDir) {
-    if (!fs14.existsSync(oldDir)) {
+    if (!fs15.existsSync(oldDir)) {
       throw new WaironError(`Subproject directory not found at its current path: ${oldDir}`);
     }
-    if (fs14.existsSync(newDir)) {
+    if (fs15.existsSync(newDir)) {
       throw new WaironError(`Target directory already exists: ${newDir}`);
     }
-    ensureDir(path18.dirname(newDir));
-    fs14.renameSync(oldDir, newDir);
+    ensureDir(path20.dirname(newDir));
+    fs15.renameSync(oldDir, newDir);
   }
   saveSubsystemSpec({ ...sub, projectPath: nextPath, updatedAt: (/* @__PURE__ */ new Date()).toISOString() });
   invalidateSpecCache();
@@ -17561,9 +17784,9 @@ function toPosixPath(p) {
   return p.replace(/\\/g, "/");
 }
 function isWithinDir(dir, file) {
-  const d = path18.resolve(dir);
-  const f = path18.resolve(file);
-  return f === d || f.startsWith(d + path18.sep);
+  const d = path20.resolve(dir);
+  const f = path20.resolve(file);
+  return f === d || f.startsWith(d + path20.sep);
 }
 function externalizeSubsystem(subsystemId, projectPath) {
   if (subsystemId.includes("::")) {
@@ -17575,14 +17798,14 @@ function externalizeSubsystem(subsystemId, projectPath) {
   }
   const parentRoot = getProjectRoot();
   const parentSpecsDir = aiPathsAt(parentRoot).specsDir();
-  const fooDir = path18.join(parentSpecsDir, subsystemId);
-  if (!fs14.existsSync(fooDir)) {
+  const fooDir = path20.join(parentSpecsDir, subsystemId);
+  if (!fs15.existsSync(fooDir)) {
     throw new WaironError(`subsystem specs directory not found: ${fooDir}`);
   }
   const relPath = toPosixPath(projectPath);
   const childDir = assertContainedProjectPath(parentRoot, relPath);
-  const childFooDir = path18.join(childDir, ".wai", "specs", subsystemId);
-  if (fs14.existsSync(childFooDir)) {
+  const childFooDir = path20.join(childDir, ".wai", "specs", subsystemId);
+  if (fs15.existsSync(childFooDir)) {
     throw new WaironError(`target already contains a "${subsystemId}" subsystem: ${childFooDir}`);
   }
   const renameMap = buildRenameMap(
@@ -17592,17 +17815,17 @@ function externalizeSubsystem(subsystemId, projectPath) {
   );
   const childSystemName = foo.name || subsystemId;
   runWithProjectRoot(childDir, () => {
-    ensureDir(path18.join(childDir, ".wai", "specs"));
+    ensureDir(path20.join(childDir, ".wai", "specs"));
     provisionProject(childSystemName);
   });
-  ensureDir(path18.dirname(childFooDir));
-  fs14.renameSync(fooDir, childFooDir);
-  patchSubsystemIndex(path18.join(childFooDir, ".index.yaml"), (s) => {
+  ensureDir(path20.dirname(childFooDir));
+  fs15.renameSync(fooDir, childFooDir);
+  patchSubsystemIndex(path20.join(childFooDir, ".index.yaml"), (s) => {
     s.parentSystem = childSystemName;
     delete s.projectPath;
   });
   ensureDir(fooDir);
-  writeYamlFile(path18.join(fooDir, ".index.yaml"), {
+  writeYamlFile(path20.join(fooDir, ".index.yaml"), {
     id: subsystemId,
     name: foo.name,
     description: foo.description,
@@ -17628,9 +17851,9 @@ function internalizeSubsystem(subsystemId) {
   const parentRoot = getProjectRoot();
   const parentSpecsDir = aiPathsAt(parentRoot).specsDir();
   const childDir = assertContainedProjectPath(parentRoot, foo.projectPath);
-  const childWai = path18.join(childDir, ".wai");
-  const childFooDir = path18.join(childDir, ".wai", "specs", subsystemId);
-  if (!fs14.existsSync(childFooDir)) {
+  const childWai = path20.join(childDir, ".wai");
+  const childFooDir = path20.join(childDir, ".wai", "specs", subsystemId);
+  if (!fs15.existsSync(childFooDir)) {
     throw new WaironError(`external subproject missing subsystem "${subsystemId}": ${childFooDir}`);
   }
   const childOwnSubs = runWithProjectRoot(childDir, () => loadSubsystemSpecs()).filter((s) => !s.id.includes("::"));
@@ -17643,15 +17866,15 @@ function internalizeSubsystem(subsystemId) {
     false
   );
   const parentSystemName = loadSystemSpec()?.name ?? foo.parentSystem;
-  const fooDir = path18.join(parentSpecsDir, subsystemId);
-  fs14.rmSync(fooDir, { recursive: true, force: true });
-  ensureDir(path18.dirname(fooDir));
-  fs14.renameSync(childFooDir, fooDir);
-  patchSubsystemIndex(path18.join(fooDir, ".index.yaml"), (s) => {
+  const fooDir = path20.join(parentSpecsDir, subsystemId);
+  fs15.rmSync(fooDir, { recursive: true, force: true });
+  ensureDir(path20.dirname(fooDir));
+  fs15.renameSync(childFooDir, fooDir);
+  patchSubsystemIndex(path20.join(fooDir, ".index.yaml"), (s) => {
     s.parentSystem = parentSystemName;
     delete s.projectPath;
   });
-  fs14.rmSync(childWai, { recursive: true, force: true });
+  fs15.rmSync(childWai, { recursive: true, force: true });
   rewriteRefsInDir(parentSpecsDir, renameMap, fooDir);
   invalidateSpecCache();
 }
@@ -17748,18 +17971,18 @@ function rewriteRefsInDir(specsDir, renameMap, excludeDir) {
   }
 }
 function patchSubsystemIndex(indexPath, mutate) {
-  if (!fs14.existsSync(indexPath)) return;
+  if (!fs15.existsSync(indexPath)) return;
   const raw = readYamlFile(indexPath);
   mutate(raw);
   raw.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
   writeYamlFile(indexPath, raw);
 }
-var fs14, path18;
+var fs15, path20;
 var init_provision = __esm({
   "src/core/provision.ts"() {
     "use strict";
-    fs14 = __toESM(require("fs"));
-    path18 = __toESM(require("path"));
+    fs15 = __toESM(require("fs"));
+    path20 = __toESM(require("path"));
     init_specs2();
     init_loader();
     init_fs();
@@ -17800,18 +18023,18 @@ __export(ai_guide_exports, {
   writeRootGuideDelegator: () => writeRootGuideDelegator
 });
 function globalGuideFilePath(targetType) {
-  if (targetType === "claude") return path19.join(process.env["CLAUDE_CONFIG_DIR"] || path19.join(os5.homedir(), ".claude"), "CLAUDE.md");
-  if (targetType === "gemini") return path19.join(process.env["GEMINI_CONFIG_DIR"] || path19.join(os5.homedir(), ".gemini"), "GEMINI.md");
+  if (targetType === "claude") return path21.join(process.env["CLAUDE_CONFIG_DIR"] || path21.join(os6.homedir(), ".claude"), "CLAUDE.md");
+  if (targetType === "gemini") return path21.join(process.env["GEMINI_CONFIG_DIR"] || path21.join(os6.homedir(), ".gemini"), "GEMINI.md");
   return null;
 }
 function localGuideFilePath(projectRoot2, targetType) {
-  if (targetType === "claude") return path19.join(projectRoot2, ".claude", "CLAUDE.md");
-  if (targetType === "gemini" || targetType === "agy") return path19.join(projectRoot2, ".gemini", "GEMINI.md");
+  if (targetType === "claude") return path21.join(projectRoot2, ".claude", "CLAUDE.md");
+  if (targetType === "gemini" || targetType === "agy") return path21.join(projectRoot2, ".gemini", "GEMINI.md");
   return null;
 }
 function hasWaironGuide(filePath) {
-  if (!fs15.existsSync(filePath)) return false;
-  return fs15.readFileSync(filePath, "utf-8").includes(GUIDE_MARKER_START);
+  if (!fs16.existsSync(filePath)) return false;
+  return fs16.readFileSync(filePath, "utf-8").includes(GUIDE_MARKER_START);
 }
 function injectGuide(filePath, scope) {
   const body = scope === "global" ? GLOBAL_GUIDE_BODY : LOCAL_GUIDE_BODY;
@@ -17822,11 +18045,11 @@ ${versionStamp()}
 ${body}
 ${GUIDE_MARKER_END}
 `;
-  const existing = fs15.existsSync(filePath) ? fs15.readFileSync(filePath, "utf-8") : "";
+  const existing = fs16.existsSync(filePath) ? fs16.readFileSync(filePath, "utf-8") : "";
   const stripped = stripGuideSection(existing);
   const newContent = stripped.trimEnd() + section;
-  fs15.mkdirSync(path19.dirname(filePath), { recursive: true });
-  fs15.writeFileSync(filePath, newContent, "utf-8");
+  fs16.mkdirSync(path21.dirname(filePath), { recursive: true });
+  fs16.writeFileSync(filePath, newContent, "utf-8");
 }
 function stripGuideSection(content) {
   const start = content.indexOf(GUIDE_MARKER_START);
@@ -17836,7 +18059,7 @@ function stripGuideSection(content) {
 }
 function writeRootGuideDelegator(projectRoot2, targetType) {
   if (targetType === "claude") {
-    const filePath = path19.join(projectRoot2, "CLAUDE.md");
+    const filePath = path21.join(projectRoot2, "CLAUDE.md");
     const content = `@.claude/CLAUDE.md
 # Wairon SDD Project
@@ -17849,42 +18072,42 @@ To design or modify the system, invoke the **\`sdd-architect\`** skill
 (in \`.claude/skills/\`). Author and validate specs with the \`sdd_*\` MCP tools;
 the \`wairon\` CLI is the human developer's tool, not yours.
 `;
-    fs15.writeFileSync(filePath, content, "utf-8");
+    fs16.writeFileSync(filePath, content, "utf-8");
   } else if (targetType === "gemini" || targetType === "agy") {
-    const filePath = path19.join(projectRoot2, "GEMINI.md");
+    const filePath = path21.join(projectRoot2, "GEMINI.md");
     const content = `# Wairon SDD Project
 ${GUIDE_MARKER_START}
 ${versionStamp()}
 ${LOCAL_GUIDE_BODY}
 ${GUIDE_MARKER_END}
 `;
-    fs15.writeFileSync(filePath, content, "utf-8");
+    fs16.writeFileSync(filePath, content, "utf-8");
   } else if (targetType === "cursor") {
-    const filePath = path19.join(projectRoot2, ".cursorrules");
+    const filePath = path21.join(projectRoot2, ".cursorrules");
     const content = `# Wairon SDD Project
 This project uses the Wairon Spec-Driven Development (SDD) framework.
 Refer to the rules in [.cursor/rules/](.cursor/rules/) for full instructions.
 `;
-    fs15.writeFileSync(filePath, content, "utf-8");
+    fs16.writeFileSync(filePath, content, "utf-8");
   } else if (targetType === "copilot") {
-    const filePath = path19.join(projectRoot2, ".github", "copilot-instructions.md");
-    fs15.mkdirSync(path19.dirname(filePath), { recursive: true });
+    const filePath = path21.join(projectRoot2, ".github", "copilot-instructions.md");
+    fs16.mkdirSync(path21.dirname(filePath), { recursive: true });
     const content = `# Wairon SDD Project
 This project uses the Wairon Spec-Driven Development (SDD) framework.
 Refer to the prompts in [.github/prompts/](.github/prompts/) for instructions.
 `;
-    fs15.writeFileSync(filePath, content, "utf-8");
+    fs16.writeFileSync(filePath, content, "utf-8");
   } else if (targetType === "codex") {
-    const filePath = path19.join(projectRoot2, ".codexrules");
+    const filePath = path21.join(projectRoot2, ".codexrules");
     const content = `# Wairon SDD Project
 Refer to [.codex/agents/](.codex/agents/) for full instructions.
 `;
-    fs15.writeFileSync(filePath, content, "utf-8");
+    fs16.writeFileSync(filePath, content, "utf-8");
   }
 }
 function reinjectLocalGuides(projectRoot2, targetTypes) {
@@ -17900,13 +18123,13 @@ function reinjectLocalGuides(projectRoot2, targetTypes) {
   }
   return written;
 }
-var fs15, os5, path19, GUIDE_MARKER_START, GUIDE_MARKER_END, GLOBAL_GUIDE_BODY, LOCAL_GUIDE_BODY, GUIDE_TARGETS;
+var fs16, os6, path21, GUIDE_MARKER_START, GUIDE_MARKER_END, GLOBAL_GUIDE_BODY, LOCAL_GUIDE_BODY, GUIDE_TARGETS;
 var init_ai_guide = __esm({
   "src/utils/ai-guide.ts"() {
     "use strict";
-    fs15 = __toESM(require("fs"));
-    os5 = __toESM(require("os"));
-    path19 = __toESM(require("path"));
+    fs16 = __toESM(require("fs"));
+    os6 = __toESM(require("os"));
+    path21 = __toESM(require("path"));
     init_stamp();
     GUIDE_MARKER_START = "<!-- wairon-guide-start -->";
     GUIDE_MARKER_END = "<!-- wairon-guide-end -->";
@@ -17968,7 +18191,7 @@ __export(domains_exports, {
   resolveDomains: () => resolveDomains
 });
 function rel(p) {
-  return path24.relative(process.cwd(), p).replace(/\\/g, "/");
+  return path26.relative(process.cwd(), p).replace(/\\/g, "/");
 }
 function deriveSubsystemDomains() {
   const subsystems = loadSubsystemSpecs();
@@ -18018,11 +18241,11 @@ function removeFreeStandingDomain(id) {
   config.domains.splice(idx, 1);
   saveTopologyConfig(config);
 }
-var path24;
+var path26;
 var init_domains = __esm({
   "src/core/domains.ts"() {
     "use strict";
-    path24 = __toESM(require("path"));
+    path26 = __toESM(require("path"));
     init_loader();
     init_specs2();
     init_errors();
@@ -18178,16 +18401,16 @@ function packNamespace(pack) {
   return pack.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function extensionsFor(builtin, packSkills) {
-  return packSkills.filter((s) => s.extends === builtin && fs17.existsSync(s.sourcePath));
+  return packSkills.filter((s) => s.extends === builtin && fs18.existsSync(s.sourcePath));
 }
 function composeBuiltinSkill(name, packSkills) {
   const srcPath = skillTemplatePath(name);
-  const base = fs17.existsSync(srcPath) ? fs17.readFileSync(srcPath, "utf-8") : "";
+  const base = fs18.existsSync(srcPath) ? fs18.readFileSync(srcPath, "utf-8") : "";
   const sections = extensionsFor(name, packSkills);
   if (sections.length === 0) return base;
   const parts = [base.trimEnd()];
   for (const section of sections) {
-    const body = fs17.readFileSync(section.sourcePath, "utf-8").replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, "");
+    const body = fs18.readFileSync(section.sourcePath, "utf-8").replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, "");
     parts.push(`## Platform: ${section.pack}`, body.trim());
   }
   return `${parts.join("\n\n")}
@@ -18203,16 +18426,16 @@ function readFrontmatter(raw, fallbackName) {
   return { name: field("name") || fallbackName, description: field("description") };
 }
 function builtinSkillsDir() {
-  return path25.resolve(__dirname, "..", "templates", "skills");
+  return path27.resolve(__dirname, "..", "templates", "skills");
 }
 function skillTemplatePath(name) {
-  return path25.join(builtinSkillsDir(), `${name}.md`);
+  return path27.join(builtinSkillsDir(), `${name}.md`);
 }
 function skillDestPath(type, destDir, name) {
   if (type === "claude" || type === "codex" || type === "gemini" || type === "agy") {
-    return path25.join(destDir, name, "SKILL.md");
+    return path27.join(destDir, name, "SKILL.md");
   }
-  return path25.join(destDir, `${name}.md`);
+  return path27.join(destDir, `${name}.md`);
 }
 function skillsDirForTarget(type) {
   switch (type) {
@@ -18247,22 +18470,22 @@ function exportSddSkills(targetTypes) {
     ensureDir(destDir);
     destinations.push(destDir);
     for (const name of SKILL_NAMES) {
-      if (!fs17.existsSync(skillTemplatePath(name))) continue;
+      if (!fs18.existsSync(skillTemplatePath(name))) continue;
       const content = composeBuiltinSkill(name, packSkills.filter((s) => s.targets.includes(type)));
       const destPath = skillDestPath(type, destDir, name);
-      ensureDir(path25.dirname(destPath));
-      fs17.writeFileSync(destPath, content, "utf-8");
+      ensureDir(path27.dirname(destPath));
+      fs18.writeFileSync(destPath, content, "utf-8");
       fileCount++;
     }
     for (const skill of packSkills) {
       if (skill.extends !== void 0) continue;
       if (!skill.targets.includes(type)) continue;
-      if (!fs17.existsSync(skill.sourcePath)) continue;
+      if (!fs18.existsSync(skill.sourcePath)) continue;
       const id = packSkillId(skill);
-      const content = fs17.readFileSync(skill.sourcePath, "utf-8");
+      const content = fs18.readFileSync(skill.sourcePath, "utf-8");
       const destPath = skillDestPath(type, destDir, id);
-      ensureDir(path25.dirname(destPath));
-      fs17.writeFileSync(destPath, content, "utf-8");
+      ensureDir(path27.dirname(destPath));
+      fs18.writeFileSync(destPath, content, "utf-8");
       fileCount++;
     }
   }
@@ -18275,12 +18498,12 @@ function checkSkillFreshness(type) {
   const packSkills = loadProjectExtensions2().skills.filter((s) => s.targets.includes(type));
   for (const name of SKILL_NAMES) {
     const destPath = skillDestPath(type, dir, name);
-    if (!fs17.existsSync(destPath)) {
+    if (!fs18.existsSync(destPath)) {
       result.missing.push(name);
       continue;
     }
     const want = composeBuiltinSkill(name, packSkills);
-    const have = fs17.readFileSync(destPath, "utf-8");
+    const have = fs18.readFileSync(destPath, "utf-8");
     if (have === want) result.ok.push(name);
     else result.stale.push(name);
   }
@@ -18292,7 +18515,7 @@ function activeTargetTypes() {
   return config.targets.filter((t) => !("enabled" in t) || t.enabled).map((t) => typeof t === "string" ? t : t.type);
 }
 function readSkillFrontmatter(name) {
-  return readFrontmatter(fs17.readFileSync(skillTemplatePath(name), "utf-8"), name);
+  return readFrontmatter(fs18.readFileSync(skillTemplatePath(name), "utf-8"), name);
 }
 function listSkillResources() {
   const builtin = RESOURCE_SKILL_IDS.map((id) => {
@@ -18306,9 +18529,9 @@ function listSkillResources() {
       defaultForHostedMcp: true
     };
   });
-  const pack = loadProjectExtensions2().skills.filter((s) => s.extends === void 0 && fs17.existsSync(s.sourcePath)).map((skill) => {
+  const pack = loadProjectExtensions2().skills.filter((s) => s.extends === void 0 && fs18.existsSync(s.sourcePath)).map((skill) => {
     const id = packSkillId(skill);
-    const fm = readFrontmatter(fs17.readFileSync(skill.sourcePath, "utf-8"), id);
+    const fm = readFrontmatter(fs18.readFileSync(skill.sourcePath, "utf-8"), id);
     return {
       id,
       name: fm.name,
@@ -18324,8 +18547,8 @@ function readSkillResource(resourceId) {
   const packSkills = loadProjectExtensions2().skills;
   if (SKILL_NAMES.includes(resourceId)) return composeBuiltinSkill(resourceId, packSkills);
   const packSkill = packSkills.find((s) => s.extends === void 0 && packSkillId(s) === resourceId);
-  if (packSkill) return fs17.readFileSync(packSkill.sourcePath, "utf-8");
-  return fs17.readFileSync(skillTemplatePath(resourceId), "utf-8");
+  if (packSkill) return fs18.readFileSync(packSkill.sourcePath, "utf-8");
+  return fs18.readFileSync(skillTemplatePath(resourceId), "utf-8");
 }
 function listResources() {
   return listSkillResources();
@@ -18338,12 +18561,12 @@ function readResource(resourceId) {
   if (!known) throw new SkillResourceNotFoundError(resourceId);
   return readSkillResource(resourceId);
 }
-var path25, fs17, SKILL_NAMES, SKILL_RESOURCE_SCHEME, RESOURCE_SKILL_IDS, SkillResourceNotFoundError;
+var path27, fs18, SKILL_NAMES, SKILL_RESOURCE_SCHEME, RESOURCE_SKILL_IDS, SkillResourceNotFoundError;
 var init_skills = __esm({
   "src/core/skills.ts"() {
     "use strict";
-    path25 = __toESM(require("path"));
-    fs17 = __toESM(require("fs"));
+    path27 = __toESM(require("path"));
+    fs18 = __toESM(require("fs"));
     init_fs();
     init_defaults();
     init_extensions();
@@ -18570,23 +18793,34 @@ async function runStatus(options = {}) {
   const lock = lockLine().trim();
   if (lock) {
     logger.blank();
-    if (lock.includes("STALE")) logger.warn(lock);
+    if (lock.includes("changed since approval")) logger.warn(lock);
     else logger.info(lock);
   }
   logger.blank();
 }
 function lockLine() {
   try {
-    const { state, record: record2 } = readLockState();
-    if (state === "unlocked") return "";
-    if (state === "locked") {
+    const baseline = readBaseline();
+    if (!baseline) return "";
+    const moved = movedChildren(loadSubsystemSpecs());
+    const childNote = moved.length ? `
+${moved.length} chained child project(s) moved since approval: ${moved.map((m) => m.id).join(", ")}.` : "";
+    const diff = diffAgainstBaseline();
+    if (!diff || diffSize(diff) === 0) {
       return `
-Lock: FROZEN at ${record2.lockedAt} by ${record2.lockedBy} (wairon ${record2.validatorVersion}).
+Approved: ${baseline.approvedAt} by ${baseline.approvedBy} \u2014 no spec has changed since.${childNote}
 `;
     }
+    const parts = [];
+    if (diff.changed.length) parts.push(`${diff.changed.length} changed`);
+    if (diff.added.length) parts.push(`${diff.added.length} added`);
+    if (diff.removed.length) parts.push(`${diff.removed.length} removed`);
+    const named = [...diff.changed, ...diff.added, ...diff.removed].slice(0, 5);
+    const rest = diffSize(diff) - named.length;
     return `
-Lock: STALE \u2014 the specs or the governing doctrine changed since ${record2.lockedAt}, so this lock no longer holds and promotion will refuse it. Re-run \`wairon lock\` to freeze the current state.
-`;
+${diffSize(diff)} spec(s) changed since approval (${parts.join(", ")}) \u2014 approved ${baseline.approvedAt} by ${baseline.approvedBy}:
+` + named.map((p) => `  ${p}`).join("\n") + (rest > 0 ? `
+  \u2026 and ${rest} more` : "") + childNote + "\n";
   } catch {
     return "";
   }
@@ -18713,6 +18947,7 @@ var init_status = __esm({
     init_loader();
     init_fs();
     init_specs2();
+    init_baseline();
   }
 });
@@ -18761,7 +18996,7 @@ function errText(message) {
 }
 function captureBuildStamp(entryPath) {
   try {
-    const s = fs18.statSync(entryPath);
+    const s = fs19.statSync(entryPath);
     return { path: entryPath, mtimeMs: s.mtimeMs, size: s.size };
   } catch {
     return null;
@@ -18770,7 +19005,7 @@ function captureBuildStamp(entryPath) {
 function isBuildStale(stamp) {
   if (!stamp) return false;
   try {
-    const s = fs18.statSync(stamp.path);
+    const s = fs19.statSync(stamp.path);
     return s.mtimeMs !== stamp.mtimeMs || s.size !== stamp.size;
   } catch {
     return false;
@@ -19988,10 +20223,6 @@ NOTICE:
       description: "Hosted project lifecycle (execute-primary): LOCK the bound project (validate-as-complete gate + commit-scoped lock record). Executes directly when your resolved permission is yes and returns the completed outcome; when it is approval, a pending approval request is created instead (await it with sdd_host_await_approval).",
       inputSchema: {}
     }, hostedStub);
-    reg(server, "sdd_host_promote_project", {
-      description: "Hosted project lifecycle (execute-primary): PROMOTE the bound, locked project after a StateId re-check. Executes directly when your resolved permission is yes; when it is approval, a pending approval request is created instead.",
-      inputSchema: {}
-    }, hostedStub);
     reg(server, "sdd_host_initialize_project", {
       description: "Hosted project lifecycle (execute-primary): initialize a new hosted project into its REQUIRED owner organization unit (with an optional profile selection). Executes directly when your resolved permission is yes; when it is approval, a pending approval request is created instead.",
       inputSchema: {
@@ -20077,7 +20308,7 @@ async function scopeToClientWorkspace(server) {
     } catch {
       dir = null;
     }
-    if (dir && (fs18.existsSync(path27.join(dir, ".wai")) || fs18.existsSync(path27.join(dir, ".wairon")))) {
+    if (dir && (fs19.existsSync(path29.join(dir, ".wai")) || fs19.existsSync(path29.join(dir, ".wairon")))) {
       setProjectRoot(dir);
       process.stderr.write(`[wairon mcp] scoped to client workspace root: ${dir}
 `);
@@ -20101,7 +20332,7 @@ async function startMcpServer() {
   } catch {
   }
 }
-var import_mcp, import_stdio, import_zod9, import_types3, fs18, path27, import_url, SERVER_BUILD_STAMP, STALE_SERVER_WARNING, SPEC_WRITE_TOOLS, listChangedEmitters, STORE_MANAGED_FIELDS, ALWAYS_CARRIED_FIELDS, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
+var import_mcp, import_stdio, import_zod9, import_types3, fs19, path29, import_url, SERVER_BUILD_STAMP, STALE_SERVER_WARNING, SPEC_WRITE_TOOLS, listChangedEmitters, STORE_MANAGED_FIELDS, ALWAYS_CARRIED_FIELDS, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
 var init_server = __esm({
   "src/mcp/server.ts"() {
     "use strict";
@@ -20109,8 +20340,8 @@ var init_server = __esm({
     import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
     import_zod9 = require("zod");
     import_types3 = require("@modelcontextprotocol/sdk/types.js");
-    fs18 = __toESM(require("fs"));
-    path27 = __toESM(require("path"));
+    fs19 = __toESM(require("fs"));
+    path29 = __toESM(require("path"));
     import_url = require("url");
     init_fs();
     init_defaults();
@@ -20161,34 +20392,34 @@ __export(mcp_exports, {
   validateConfigDir: () => validateConfigDir
 });
 function geminiGlobalDir(override) {
-  return override || process.env["GEMINI_CONFIG_DIR"] || path28.join(os6.homedir(), ".gemini");
+  return override || process.env["GEMINI_CONFIG_DIR"] || path30.join(os7.homedir(), ".gemini");
 }
 function claudeMcpConfigPath(useGlobal, override) {
-  if (!useGlobal) return path28.join(process.cwd(), ".mcp.json");
+  if (!useGlobal) return path30.join(process.cwd(), ".mcp.json");
   const dir = override || process.env["CLAUDE_CONFIG_DIR"];
-  return dir ? path28.join(dir, ".claude.json") : path28.join(os6.homedir(), ".claude.json");
+  return dir ? path30.join(dir, ".claude.json") : path30.join(os7.homedir(), ".claude.json");
 }
 function validateConfigDir(dir, backend) {
-  const resolved = path28.resolve(dir);
+  const resolved = path30.resolve(dir);
   const agent = backend === "claude" ? "Claude" : "Gemini/Antigravity";
-  if (!fs19.existsSync(resolved)) {
-    const parent = path28.dirname(resolved);
-    if (!fs19.existsSync(parent)) {
+  if (!fs20.existsSync(resolved)) {
+    const parent = path30.dirname(resolved);
+    if (!fs20.existsSync(parent)) {
       throw new WaironError(`--config-dir "${dir}" does not exist and its parent is missing \u2014 check the path.`);
     }
     logger.warn(`Config dir "${resolved}" does not exist yet; it will be created.`);
     return;
   }
-  if (!fs19.statSync(resolved).isDirectory()) {
+  if (!fs20.statSync(resolved).isDirectory()) {
     throw new WaironError(`--config-dir "${dir}" is not a directory.`);
   }
   const markers = backend === "claude" ? ["settings.json", "settings.local.json", ".credentials.json", "projects", "statsig", "todos", "shell-snapshots", "CLAUDE.md"] : ["settings.json", "GEMINI.md", "oauth_creds.json", "antigravity-cli", "tmp"];
-  const entries = fs19.readdirSync(resolved);
+  const entries = fs20.readdirSync(resolved);
   if (entries.length === 0) {
     logger.warn(`Config dir "${resolved}" is empty; proceeding (treating it as a fresh ${agent} config dir).`);
     return;
   }
-  if (!markers.some((m) => fs19.existsSync(path28.join(resolved, m)))) {
+  if (!markers.some((m) => fs20.existsSync(path30.join(resolved, m)))) {
     throw new WaironError(
       `"${dir}" does not look like a ${agent} config directory (none of ${markers.slice(0, 4).join(", ")} found). Point --config-dir at the agent's config directory.`
     );
@@ -20196,12 +20427,12 @@ function validateConfigDir(dir, backend) {
 }
 async function runMcpServe() {
   const { setProjectRoot: setProjectRoot2, getProjectRoot: getProjectRoot2, findProjectRoot: findProjectRoot2 } = await Promise.resolve().then(() => (init_fs(), fs_exports));
-  const cwd = path28.resolve(process.cwd());
+  const cwd = path30.resolve(process.cwd());
   const envDir = process.env["WAIRON_PROJECT_DIR"];
   let resolved;
   let how;
-  if (envDir && fs19.existsSync(path28.join(envDir, ".wai"))) {
-    resolved = path28.resolve(envDir);
+  if (envDir && fs20.existsSync(path30.join(envDir, ".wai"))) {
+    resolved = path30.resolve(envDir);
     how = "WAIRON_PROJECT_DIR (pinned at install)";
   } else {
     const found = findProjectRoot2(cwd);
@@ -20264,20 +20495,20 @@ async function runMcpInstall(options = {}) {
     let settingsPath;
     if (backend === "gemini") {
       if (useGlobal) {
-        configBase = path28.join(geminiGlobalDir(options.configDir), "antigravity-cli");
-        settingsPath = path28.join(configBase, "mcp_config.json");
+        configBase = path30.join(geminiGlobalDir(options.configDir), "antigravity-cli");
+        settingsPath = path30.join(configBase, "mcp_config.json");
       } else {
-        configBase = path28.join(process.cwd(), ".gemini");
-        settingsPath = path28.join(configBase, "settings.json");
+        configBase = path30.join(process.cwd(), ".gemini");
+        settingsPath = path30.join(configBase, "settings.json");
       }
     } else {
       settingsPath = claudeMcpConfigPath(useGlobal, options.configDir);
-      configBase = path28.dirname(settingsPath);
+      configBase = path30.dirname(settingsPath);
     }
     let settings = {};
-    if (fs19.existsSync(settingsPath)) {
+    if (fs20.existsSync(settingsPath)) {
       try {
-        settings = JSON.parse(fs19.readFileSync(settingsPath, "utf8"));
+        settings = JSON.parse(fs20.readFileSync(settingsPath, "utf8"));
       } catch {
         logger.warn(`Could not parse ${settingsPath} \u2014 starting fresh.`);
       }
@@ -20285,7 +20516,7 @@ async function runMcpInstall(options = {}) {
     const mcpServers = settings["mcpServers"] ?? {};
     const agentLabel = backend === "gemini" ? "Antigravity" : "Claude";
     const isPackaged = typeof process.pkg !== "undefined";
-    const scriptPath = process.argv[1] ? path28.resolve(process.argv[1]).replace(/\\/g, "/") : null;
+    const scriptPath = process.argv[1] ? path30.resolve(process.argv[1]).replace(/\\/g, "/") : null;
     const useDirectNode = !isPackaged && scriptPath && (scriptPath.endsWith(".js") || scriptPath.endsWith(".ts"));
     const env = useGlobal ? {} : { WAIRON_PROJECT_DIR: process.cwd().replace(/\\/g, "/") };
     const desiredEntry = useDirectNode ? { command: "node", args: [scriptPath, "mcp", "serve"], env } : { command: "wairon", args: ["mcp", "serve"], env };
@@ -20297,8 +20528,8 @@ async function runMcpInstall(options = {}) {
     const wasStale = !!existingEntry;
     mcpServers["wairon"] = desiredEntry;
     settings["mcpServers"] = mcpServers;
-    if (!fs19.existsSync(configBase)) fs19.mkdirSync(configBase, { recursive: true });
-    fs19.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    if (!fs20.existsSync(configBase)) fs20.mkdirSync(configBase, { recursive: true });
+    fs20.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
     logger.success(`wairon MCP server ${wasStale ? "updated (was stale)" : "registered"} for ${agentLabel} in ${import_chalk4.default.cyan(settingsPath)}.`);
     logger.blank();
     logger.info("AI tools using this config will have access to these wairon tools:");
@@ -20323,8 +20554,8 @@ async function runMcpStatus() {
   const projectConfig = loadProjectConfig();
   const claudeProject = claudeMcpConfigPath(false);
   const claudeGlobal = claudeMcpConfigPath(true);
-  const geminiProject = path28.join(process.cwd(), ".gemini", "settings.json");
-  const geminiGlobal = path28.join(geminiGlobalDir(), "antigravity-cli", "mcp_config.json");
+  const geminiProject = path30.join(process.cwd(), ".gemini", "settings.json");
+  const geminiGlobal = path30.join(geminiGlobalDir(), "antigravity-cli", "mcp_config.json");
   logger.blank();
   logger.info(`${import_chalk4.default.bold("wairon MCP Server")}`);
   logger.blank();
@@ -20335,12 +20566,12 @@ async function runMcpStatus() {
     { label: "Antigravity (global)", filePath: geminiGlobal, fallbackName: "mcp_config.json" }
   ];
   for (const { label, filePath, fallbackName } of checks) {
-    if (!fs19.existsSync(filePath)) {
+    if (!fs20.existsSync(filePath)) {
       console.log(`  ${label}: ${import_chalk4.default.gray(`${fallbackName} not found`)}`);
       continue;
     }
     try {
-      const s = JSON.parse(fs19.readFileSync(filePath, "utf8"));
+      const s = JSON.parse(fs20.readFileSync(filePath, "utf8"));
       const registered = !!s["mcpServers"]?.["wairon"];
       const mark = registered ? import_chalk4.default.green("\u2713 registered") : import_chalk4.default.gray("not registered");
       console.log(`  ${label}: ${mark}  ${import_chalk4.default.gray(filePath)}`);
@@ -20356,16 +20587,16 @@ async function runMcpStatus() {
   logger.info(`To start manually: ${import_chalk4.default.bold("wairon mcp serve")}`);
   logger.blank();
   const mcpDir = aiDir("mcp");
-  if (fs19.existsSync(mcpDir)) {
+  if (fs20.existsSync(mcpDir)) {
     logger.info(`MCP state dir: ${import_chalk4.default.gray(mcpDir)}`);
   }
 }
 function removeLegacyGlobalPlugin() {
-  const home = process.env["USERPROFILE"] ?? process.env["HOME"] ?? os6.homedir();
-  const pluginDir = path28.join(home, ".gemini", "config", "plugins", "wairon");
+  const home = process.env["USERPROFILE"] ?? process.env["HOME"] ?? os7.homedir();
+  const pluginDir = path30.join(home, ".gemini", "config", "plugins", "wairon");
   try {
-    if (fs19.existsSync(pluginDir)) {
-      fs19.rmSync(pluginDir, { recursive: true, force: true });
+    if (fs20.existsSync(pluginDir)) {
+      fs20.rmSync(pluginDir, { recursive: true, force: true });
       logger.info(`Removed legacy global Antigravity plugin at ${import_chalk4.default.gray(pluginDir)} (it collides with the wairon MCP server).`);
       return true;
     }
@@ -20374,13 +20605,13 @@ function removeLegacyGlobalPlugin() {
   }
   return false;
 }
-var fs19, os6, path28, import_chalk4;
+var fs20, os7, path30, import_chalk4;
 var init_mcp = __esm({
   "src/commands/mcp.ts"() {
     "use strict";
-    fs19 = __toESM(require("fs"));
-    os6 = __toESM(require("os"));
-    path28 = __toESM(require("path"));
+    fs20 = __toESM(require("fs"));
+    os7 = __toESM(require("os"));
+    path30 = __toESM(require("path"));
     import_chalk4 = __toESM(require("chalk"));
     init_logger();
     init_loader();
@@ -23215,8 +23446,8 @@ var require_dist = __commonJS({
     function slug(name) {
       return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
     }
-    var fs53 = __toESM2(require("fs"));
-    var path64 = __toESM2(require("path"));
+    var fs54 = __toESM2(require("fs"));
+    var path67 = __toESM2(require("path"));
     var import_fflate = require_node();
     var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".hg", ".svn"]);
     function listEntries(archive) {
@@ -23254,9 +23485,9 @@ var require_dist = __commonJS({
     }
     function writeTree(destDir, files) {
       for (const file of files) {
-        const absolute = path64.join(destDir, file.path);
-        fs53.mkdirSync(path64.dirname(absolute), { recursive: true });
-        fs53.writeFileSync(absolute, file.contents);
+        const absolute = path67.join(destDir, file.path);
+        fs54.mkdirSync(path67.dirname(absolute), { recursive: true });
+        fs54.writeFileSync(absolute, file.contents);
       }
     }
     function classifyKind(name, symlinks) {
@@ -23265,14 +23496,14 @@ var require_dist = __commonJS({
       return "file";
     }
     function walkPackDir(root, current2, out) {
-      for (const entry of fs53.readdirSync(current2, { withFileTypes: true })) {
+      for (const entry of fs54.readdirSync(current2, { withFileTypes: true })) {
         if (entry.isDirectory()) {
           if (SKIP_DIRS.has(entry.name)) continue;
-          walkPackDir(root, path64.join(current2, entry.name), out);
+          walkPackDir(root, path67.join(current2, entry.name), out);
         } else if (entry.isFile()) {
-          const absolute = path64.join(current2, entry.name);
-          const relative22 = path64.relative(root, absolute).split(path64.sep).join("/");
-          out.push({ path: relative22, contents: fs53.readFileSync(absolute) });
+          const absolute = path67.join(current2, entry.name);
+          const relative22 = path67.relative(root, absolute).split(path67.sep).join("/");
+          out.push({ path: relative22, contents: fs54.readFileSync(absolute) });
         }
       }
     }
@@ -23441,7 +23672,7 @@ var require_dist = __commonJS({
 });
 // src/cli/index.ts
-var path63 = __toESM(require("path"));
+var path66 = __toESM(require("path"));
 var import_commander = require("commander");
 init_defaults();
 init_logger();
@@ -23668,7 +23899,7 @@ function isSupportedAlias(name) {
 }
 // src/commands/init.ts
-var path29 = __toESM(require("path"));
+var path31 = __toESM(require("path"));
 var import_chalk5 = __toESM(require("chalk"));
 var import_inquirer = __toESM(require("inquirer"));
 init_logger();
@@ -23689,7 +23920,7 @@ var WAIRON_MANAGED_MARKER = "wairon:managed";
 var WAIRON_MANAGED_BANNER = `<!-- ${WAIRON_MANAGED_MARKER} \u2014 generated by \`wairon generate\`; do not edit, changes are overwritten -->`;
 // src/exporters/claude.ts
-var path20 = __toESM(require("path"));
+var path22 = __toESM(require("path"));
 init_fs();
 var ClaudeExporter = class {
   constructor() {
@@ -23698,7 +23929,7 @@ var ClaudeExporter = class {
   outputPath(ctx) {
     const { agent, target, projectRoot: projectRoot2 } = ctx;
     const outputDir = "outputDir" in target ? target.outputDir : ".claude/agents";
-    return path20.resolve(projectRoot2, outputDir, `${agent.id.replace(/::/g, "--")}.md`);
+    return path22.resolve(projectRoot2, outputDir, `${agent.id.replace(/::/g, "--")}.md`);
   }
   export(ctx) {
     const { agent, renderedInstructions } = ctx;
@@ -23719,7 +23950,7 @@ var ClaudeExporter = class {
 };
 // src/exporters/custom.ts
-var path21 = __toESM(require("path"));
+var path23 = __toESM(require("path"));
 init_fs();
 var CustomExporter = class {
   constructor() {
@@ -23730,7 +23961,7 @@ var CustomExporter = class {
     if (!("outputDir" in target)) {
       throw new Error("CustomExporter requires target.outputDir");
     }
-    return path21.resolve(projectRoot2, target.outputDir, `${agent.id.replace(/::/g, "--")}.md`);
+    return path23.resolve(projectRoot2, target.outputDir, `${agent.id.replace(/::/g, "--")}.md`);
   }
   export(ctx) {
     const { agent, target, renderedInstructions } = ctx;
@@ -23753,7 +23984,7 @@ var CustomExporter = class {
 };
 // src/exporters/gemini.ts
-var path22 = __toESM(require("path"));
+var path24 = __toESM(require("path"));
 init_fs();
 var GeminiExporter = class {
   constructor() {
@@ -23762,7 +23993,7 @@ var GeminiExporter = class {
   outputPath(ctx) {
     const { agent, target, projectRoot: projectRoot2 } = ctx;
     const outputDir = "outputDir" in target ? target.outputDir : ".gemini/agents";
-    return path22.resolve(projectRoot2, outputDir, `${agent.id.replace(/::/g, "--")}.yaml`);
+    return path24.resolve(projectRoot2, outputDir, `${agent.id.replace(/::/g, "--")}.yaml`);
   }
   export(ctx) {
     const { agent, renderedInstructions } = ctx;
@@ -23787,11 +24018,11 @@ function yamlString(value) {
 }
 // src/exporters/generate.ts
-var path26 = __toESM(require("path"));
+var path28 = __toESM(require("path"));
 // src/core/detection.ts
-var fs16 = __toESM(require("fs"));
-var path23 = __toESM(require("path"));
+var fs17 = __toESM(require("fs"));
+var path25 = __toESM(require("path"));
 init_defaults();
 var PACKAGE_MARKERS = [
   "package.json",
@@ -23843,7 +24074,7 @@ function deduplicateIds(candidates, existingIds = /* @__PURE__ */ new Set()) {
   });
 }
 function parseGitmodules(filePath) {
-  const content = fs16.readFileSync(filePath, "utf-8");
+  const content = fs17.readFileSync(filePath, "utf-8");
   const entries = [];
   let current2 = {};
   for (const line2 of content.split("\n")) {
@@ -23865,8 +24096,8 @@ function parseGitmodules(filePath) {
   return entries;
 }
 function detectGitSubmodules(projectRoot2) {
-  const gitmodulesPath = path23.join(projectRoot2, ".gitmodules");
-  if (!fs16.existsSync(gitmodulesPath)) return [];
+  const gitmodulesPath = path25.join(projectRoot2, ".gitmodules");
+  if (!fs17.existsSync(gitmodulesPath)) return [];
   return parseGitmodules(gitmodulesPath).map((entry) => ({
     suggestedId: pathToId(entry.path),
     suggestedName: pathToName(entry.path),
@@ -23884,18 +24115,18 @@ function walkForGit(projectRoot2, currentDir, depth, results) {
   if (depth > MAX_SCAN_DEPTH) return;
   let entries;
   try {
-    entries = fs16.readdirSync(currentDir, { withFileTypes: true });
+    entries = fs17.readdirSync(currentDir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     if (SCAN_EXCLUDE_DIRS.has(entry.name)) continue;
-    const fullPath = path23.join(currentDir, entry.name);
-    const relPath = normalizePath3(path23.relative(projectRoot2, fullPath));
+    const fullPath = path25.join(currentDir, entry.name);
+    const relPath = normalizePath3(path25.relative(projectRoot2, fullPath));
     if (relPath === "" || relPath === ".") continue;
-    const gitPath = path23.join(fullPath, ".git");
-    if (fs16.existsSync(gitPath)) {
+    const gitPath = path25.join(fullPath, ".git");
+    if (fs17.existsSync(gitPath)) {
       results.push({
         suggestedId: pathToId(relPath),
         suggestedName: pathToName(relPath),
@@ -23917,17 +24148,17 @@ function walkForPackages(projectRoot2, currentDir, depth, results) {
   if (depth > MAX_SCAN_DEPTH) return;
   let entries;
   try {
-    entries = fs16.readdirSync(currentDir, { withFileTypes: true });
+    entries = fs17.readdirSync(currentDir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
     if (SCAN_EXCLUDE_DIRS.has(entry.name)) continue;
-    const fullPath = path23.join(currentDir, entry.name);
-    const relPath = normalizePath3(path23.relative(projectRoot2, fullPath));
+    const fullPath = path25.join(currentDir, entry.name);
+    const relPath = normalizePath3(path25.relative(projectRoot2, fullPath));
     if (relPath === "" || relPath === ".") continue;
-    const hasMarker = PACKAGE_MARKERS.some((m) => fs16.existsSync(path23.join(fullPath, m)));
+    const hasMarker = PACKAGE_MARKERS.some((m) => fs17.existsSync(path25.join(fullPath, m)));
     if (hasMarker) {
       results.push({
         suggestedId: pathToId(relPath),
@@ -23941,8 +24172,8 @@ function walkForPackages(projectRoot2, currentDir, depth, results) {
   }
 }
 function pathToId(relPath) {
-  const basename13 = path23.basename(relPath);
-  return basename13.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+  const basename14 = path25.basename(relPath);
+  return basename14.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
 }
 function pathToName(relPath) {
   const id = pathToId(relPath);
@@ -24169,7 +24400,7 @@ function resolveExpectedOutputPaths(agents, projectConfig, projectRoot2 = getPro
       const targetConfig = resolveTargetConfig(agentTarget, projectConfig);
       if (!targetConfig) continue;
       const ctx = { agent, projectRoot: projectRoot2, target: targetConfig };
-      expected.add(path26.resolve(getExporter(targetConfig).outputPath(ctx)));
+      expected.add(path28.resolve(getExporter(targetConfig).outputPath(ctx)));
     }
   }
   return expected;
@@ -24187,7 +24418,7 @@ async function runInit(options = {}) {
   logger.header("wairon init");
   const cwd = process.cwd();
   const ancestorRoot = findSystemRoot(cwd);
-  if (ancestorRoot && path29.resolve(ancestorRoot) === path29.resolve(cwd)) {
+  if (ancestorRoot && path31.resolve(ancestorRoot) === path31.resolve(cwd)) {
     logger.info("Project already initialized.");
     logger.info("Design your spec tree with the SDD architect skill, then run `wairon generate`.");
     return;
@@ -24203,8 +24434,8 @@ async function runInit(options = {}) {
   await runInitInteractive();
 }
 async function runInitAsExternalSubsystem(parentRoot, cwd, options) {
-  const relPath = path29.relative(parentRoot, cwd) || ".";
-  const defaultId = path29.basename(cwd);
+  const relPath = path31.relative(parentRoot, cwd) || ".";
+  const defaultId = path31.basename(cwd);
   logger.info(`Detected a parent wairon project at ${parentRoot}`);
   logger.info(`This directory ("${relPath}") is not yet a wairon project.`);
   if (!options.yes) {
@@ -24264,7 +24495,7 @@ async function runInitAsExternalSubsystem(parentRoot, cwd, options) {
 }
 async function runInitNonInteractive() {
   const cwd = process.cwd();
-  const projectName = path29.basename(cwd);
+  const projectName = path31.basename(cwd);
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const targets = [defaultTargetConfig("claude"), defaultTargetConfig("agy")];
   const projectConfig = buildProjectConfig(projectName, targets, now, "backend");
@@ -24286,7 +24517,7 @@ async function runInitNonInteractive() {
 }
 async function runInitInteractive() {
   const cwd = process.cwd();
-  const defaultProjectName = path29.basename(cwd);
+  const defaultProjectName = path31.basename(cwd);
   const { projectName } = await import_inquirer.default.prompt([
     {
       type: "input",
@@ -24446,7 +24677,7 @@ async function executeInit(projectName, targets, projectConfig, guidePlan, now)
         projectRoot: projectRoot2,
         target: targetConfig
       });
-      logger.success(`Generated: ${path29.relative(cwd, result.outputPath)}`);
+      logger.success(`Generated: ${path31.relative(cwd, result.outputPath)}`);
     }
   }
   writeStarterDocs(projectName);
@@ -24461,7 +24692,7 @@ async function executeInit(projectName, targets, projectConfig, guidePlan, now)
   if (guidePlan.claudeLocal) {
     const p = localGuideFilePath(projectRoot2, "claude");
     injectGuide(p, "local");
-    logger.success(`Injected wairon guide into ${path29.relative(cwd, p)}`);
+    logger.success(`Injected wairon guide into ${path31.relative(cwd, p)}`);
     writeRootGuideDelegator(projectRoot2, "claude");
     logger.success(`Created root CLAUDE.md delegator pointing to .claude/CLAUDE.md`);
   }
@@ -24473,7 +24704,7 @@ async function executeInit(projectName, targets, projectConfig, guidePlan, now)
   if (guidePlan.geminiLocal) {
     const p = localGuideFilePath(projectRoot2, "gemini");
     injectGuide(p, "local");
-    logger.success(`Injected wairon guide into ${path29.relative(cwd, p)}`);
+    logger.success(`Injected wairon guide into ${path31.relative(cwd, p)}`);
     writeRootGuideDelegator(projectRoot2, "gemini");
     logger.success(`Created root GEMINI.md delegator pointing to .gemini/GEMINI.md`);
   }
@@ -24706,8 +24937,8 @@ A new project initialized with Wairon.
 }
 // src/commands/generate.ts
-var fs20 = __toESM(require("fs"));
-var path30 = __toESM(require("path"));
+var fs21 = __toESM(require("fs"));
+var path32 = __toESM(require("path"));
 init_logger();
 init_loader();
 init_fs();
@@ -24715,29 +24946,29 @@ init_provision();
 init_specs2();
 var WAIRON_AGENT_FILE = /-(owner|implementer|architect)\.md$/;
 function pruneStaleAgents(expectedPaths, scanDirs) {
-  const dirs = new Set(scanDirs ?? [...expectedPaths].map((p) => path30.dirname(p)));
+  const dirs = new Set(scanDirs ?? [...expectedPaths].map((p) => path32.dirname(p)));
   let pruned = 0;
   for (const dir of dirs) {
     let entries;
     try {
-      entries = fs20.readdirSync(dir);
+      entries = fs21.readdirSync(dir);
     } catch {
       continue;
     }
     for (const name of entries) {
       if (!name.endsWith(".md")) continue;
-      const full = path30.resolve(dir, name);
+      const full = path32.resolve(dir, name);
       if (expectedPaths.has(full)) continue;
       let owned = WAIRON_AGENT_FILE.test(name);
       if (!owned) {
         try {
-          owned = fs20.readFileSync(full, "utf8").includes(WAIRON_MANAGED_MARKER);
+          owned = fs21.readFileSync(full, "utf8").includes(WAIRON_MANAGED_MARKER);
         } catch {
           owned = false;
         }
       }
       if (!owned) continue;
-      fs20.unlinkSync(full);
+      fs21.unlinkSync(full);
       pruned++;
       logger.verbose(`Pruned stale: ${full}`);
     }
@@ -24751,7 +24982,7 @@ async function runGenerate(options = {}) {
   const children = listDirectChainedSubprojects(getProjectRoot());
   for (const child of children) {
     logger.blank();
-    logger.info(`\u21B3 Chained subproject "${child.subsystemId}" \u2014 generating its layer in ${path30.relative(getProjectRoot(), child.dir) || "."}/`);
+    logger.info(`\u21B3 Chained subproject "${child.subsystemId}" \u2014 generating its layer in ${path32.relative(getProjectRoot(), child.dir) || "."}/`);
     await runWithProjectRoot(child.dir, async () => {
       ensureProjectInitialized(child.subsystemId);
       invalidateSpecCache();
@@ -24772,7 +25003,7 @@ async function generateLayer(options = {}) {
   } else if (options.dryRun) {
     logger.info("Dry run \u2014 rules.materializeAgentFiles is off: no agent files are written; leftover managed files would be removed.");
   } else if (options.prune !== false) {
-    const candidateDirs = [...resolveExpectedOutputPaths(registry.agents, projectConfig)].map((p) => path30.dirname(p));
+    const candidateDirs = [...resolveExpectedOutputPaths(registry.agents, projectConfig)].map((p) => path32.dirname(p));
     const removed = pruneStaleAgents(/* @__PURE__ */ new Set(), candidateDirs);
     if (removed > 0) {
       logger.info(`Removed ${removed} previously materialized agent file(s) \u2014 agents are served as live briefs (sdd_get_agent_brief); opt back in with rules.materializeAgentFiles: true.`);
@@ -24859,22 +25090,34 @@ function materializeAgentLayer(agents, projectConfig, options) {
 }
 // src/commands/lock.ts
-var os7 = __toESM(require("os"));
+var os8 = __toESM(require("os"));
 var import_inquirer2 = __toESM(require("inquirer"));
 init_logger();
+init_baseline();
 init_defaults();
+var path33 = __toESM(require("path"));
+init_fs();
 async function runLock(options = {}, gate) {
-  const promotable = collectPromotableSpecs(options.subsystem);
-  if (promotable.length === 0) {
-    logger.info("All specs are already complete \u2014 this will re-validate and regenerate the agent topology.");
+  const diff = diffAgainstBaseline();
+  if (!diff) {
+    logger.info("First approval of this tree \u2014 the whole spec tree becomes the approved baseline.");
+  } else if (diffSize(diff) === 0) {
+    logger.info("Nothing has changed since the last approval \u2014 this will re-validate and regenerate the agent topology.");
   } else {
-    logger.info(`${promotable.length} spec(s) will be frozen as complete:`);
-    for (const p of promotable) {
-      logger.info(`  \u2022 ${p.kind.padEnd(14)} ${p.id}  (${p.status} \u2192 complete)`);
+    logger.info(`${diffSize(diff)} spec(s) changed since the last approval:`);
+    for (const p of diff.changed) logger.info(`  ~ ${p}`);
+    for (const p of diff.added) logger.info(`  + ${p}`);
+    for (const p of diff.removed) logger.info(`  - ${p}`);
+  }
+  const moved = movedChildren(loadSubsystemSpecs());
+  if (moved.length > 0) {
+    logger.info(`${moved.length} chained child project(s) moved since the last approval:`);
+    for (const m of moved) {
+      logger.info(`  ${m.id}: ${m.pinned.slice(0, 19)}\u2026 \u2192 ${m.now ? `${m.now.slice(0, 19)}\u2026` : "(no approval)"}`);
     }
   }
   logger.blank();
-  logger.warn("This freezes the design as the source of truth and (re)generates the agent topology.");
+  logger.warn("This records the current design as approved and (re)generates the agent topology.");
   if (!options.yes) {
     if (!process.stdin.isTTY) {
       logger.error("Non-interactive shell \u2014 re-run with --yes to confirm the lock.");
@@ -24884,24 +25127,15 @@ async function runLock(options = {}, gate) {
       {
         type: "confirm",
         name: "confirmed",
-        message: "Lock these specs and generate the agent topology? This freezes the design.",
+        message: "Approve this design and generate the agent topology?",
         default: false
       }
     ]);
     if (!confirmed) return null;
   }
-  if (options.subsystem) {
-    for (const p of promotable) applySpecStatus(p.kind, p.id, "complete");
-    invalidateSpecCache();
-  } else {
-    promoteAllComplete();
-  }
-  if (promotable.length > 0) {
-    logger.success(`Locked ${promotable.length} spec(s) as complete.`);
-  }
   let lockedBy = "local";
   try {
-    lockedBy = `local:${os7.userInfo().username}`;
+    lockedBy = `local:${os8.userInfo().username}`;
   } catch {
   }
   const record2 = {
@@ -24917,6 +25151,13 @@ async function runLock(options = {}, gate) {
     status: "ready"
   };
   writeLockRecord(record2);
+  const root = getProjectRoot();
+  const scope = options.subsystem ? {
+    paths: new Set(
+      specPathsInScope(options.subsystem).map((p) => path33.relative(root, p).split(path33.sep).join("/"))
+    )
+  } : void 0;
+  writeBaseline(captureBaseline(lockedBy, currentChildPins(loadSubsystemSpecs(), root), root, scope));
   return record2;
 }
@@ -25173,29 +25414,29 @@ init_mcp();
 // src/commands/update.ts
 var https2 = __toESM(require("https"));
-var fs22 = __toESM(require("fs"));
-var path31 = __toESM(require("path"));
-var os8 = __toESM(require("os"));
-var crypto3 = __toESM(require("crypto"));
+var fs23 = __toESM(require("fs"));
+var path34 = __toESM(require("path"));
+var os9 = __toESM(require("os"));
+var crypto4 = __toESM(require("crypto"));
 var import_child_process2 = require("child_process");
 init_logger();
 init_defaults();
 init_version();
 // src/utils/download.ts
-var fs21 = __toESM(require("fs"));
+var fs22 = __toESM(require("fs"));
 var http = __toESM(require("http"));
 var https = __toESM(require("https"));
 init_defaults();
 function downloadFile(url, dest) {
-  return new Promise((resolve26, reject) => {
-    const file = fs21.createWriteStream(dest);
+  return new Promise((resolve27, reject) => {
+    const file = fs22.createWriteStream(dest);
     const get4 = url.startsWith("https://") ? https.get : http.get;
     get4(url, { headers: { "User-Agent": `wairon/${WAIRON_VERSION}` }, agent: false }, (res) => {
       if (res.statusCode === 301 || res.statusCode === 302) {
         file.close();
         res.destroy();
-        downloadFile(res.headers.location, dest).then(resolve26).catch(reject);
+        downloadFile(res.headers.location, dest).then(resolve27).catch(reject);
         return;
       }
       if (res.statusCode !== 200) {
@@ -25207,16 +25448,16 @@ function downloadFile(url, dest) {
       res.pipe(file);
       file.on("finish", () => {
         res.destroy();
-        file.close(() => resolve26());
+        file.close(() => resolve27());
       });
       file.on("error", (err) => {
         res.destroy();
-        fs21.unlink(dest, () => {
+        fs22.unlink(dest, () => {
         });
         reject(err);
       });
     }).on("error", (err) => {
-      fs21.unlink(dest, () => {
+      fs22.unlink(dest, () => {
       });
       reject(err);
     });
@@ -25282,8 +25523,8 @@ async function runUpdate(options = {}) {
     logger.info(`Download manually from: ${release.html_url}`);
     process.exit(1);
   }
-  const tmpDir = os8.tmpdir();
-  const tmpFile = path31.join(tmpDir, assetName);
+  const tmpDir = os9.tmpdir();
+  const tmpFile = path34.join(tmpDir, assetName);
   logger.info(`Downloading ${assetName}...`);
   try {
     await downloadFile(asset.browser_download_url, tmpFile);
@@ -25300,16 +25541,16 @@ async function runUpdate(options = {}) {
   const checksumAssetName = assetName + ".sha256";
   const checksumAsset = release.assets.find((a) => a.name === checksumAssetName);
   if (checksumAsset) {
-    const tmpChecksum = path31.join(tmpDir, checksumAssetName);
+    const tmpChecksum = path34.join(tmpDir, checksumAssetName);
     logger.info(`Verifying checksum...`);
     try {
       await downloadFile(checksumAsset.browser_download_url, tmpChecksum);
       verifyChecksum(tmpFile, tmpChecksum, assetName);
-      fs22.unlinkSync(tmpChecksum);
+      fs23.unlinkSync(tmpChecksum);
     } catch (err) {
       logger.error(`Checksum verification failed: ${err.message}`);
       try {
-        fs22.unlinkSync(tmpFile);
+        fs23.unlinkSync(tmpFile);
       } catch {
       }
       process.exit(1);
@@ -25344,7 +25585,7 @@ function releaseChannelLabel(tag) {
   return "stable";
 }
 function fetchReleases(repo) {
-  return new Promise((resolve26, reject) => {
+  return new Promise((resolve27, reject) => {
     const url = `https://api.github.com/repos/${repo}/releases?per_page=20`;
     const options = {
       headers: {
@@ -25364,7 +25605,7 @@ function fetchReleases(repo) {
           return;
         }
         try {
-          resolve26(JSON.parse(data));
+          resolve27(JSON.parse(data));
         } catch {
           reject(new Error("Failed to parse GitHub API response"));
         }
@@ -25374,10 +25615,10 @@ function fetchReleases(repo) {
   });
 }
 function verifyChecksum(filePath, checksumFile, expectedFilename) {
-  const checksumContent = fs22.readFileSync(checksumFile, "utf-8").trim();
+  const checksumContent = fs23.readFileSync(checksumFile, "utf-8").trim();
   const expectedHash = checksumContent.split(/\s+/)[0].toLowerCase();
-  const fileBuffer = fs22.readFileSync(filePath);
-  const actualHash = crypto3.createHash("sha256").update(fileBuffer).digest("hex").toLowerCase();
+  const fileBuffer = fs23.readFileSync(filePath);
+  const actualHash = crypto4.createHash("sha256").update(fileBuffer).digest("hex").toLowerCase();
   if (actualHash !== expectedHash) {
     throw new Error(
       `SHA-256 mismatch for ${expectedFilename}
@@ -25407,9 +25648,9 @@ function isPkgBinary2() {
 function installBinary(tmpFile, destPath) {
   const platform = process.platform;
   const isZip = tmpFile.endsWith(".zip");
-  const extractDir = path31.join(os8.tmpdir(), "wairon-extract");
-  if (fs22.existsSync(extractDir)) fs22.rmSync(extractDir, { recursive: true });
-  fs22.mkdirSync(extractDir, { recursive: true });
+  const extractDir = path34.join(os9.tmpdir(), "wairon-extract");
+  if (fs23.existsSync(extractDir)) fs23.rmSync(extractDir, { recursive: true });
+  fs23.mkdirSync(extractDir, { recursive: true });
   if (isZip) {
     (0, import_child_process2.execSync)(
       `powershell -NoProfile -NonInteractive -Command "Expand-Archive -Path '${tmpFile}' -DestinationPath '${extractDir}' -Force"`,
@@ -25419,18 +25660,18 @@ function installBinary(tmpFile, destPath) {
     (0, import_child_process2.execSync)(`tar -xzf "${tmpFile}" -C "${extractDir}"`, { stdio: ["ignore", "pipe", "pipe"] });
   }
   const binaryName = platform === "win32" ? "wairon.exe" : "wairon";
-  const extractedBinary = path31.join(extractDir, binaryName);
-  if (!fs22.existsSync(extractedBinary)) {
+  const extractedBinary = path34.join(extractDir, binaryName);
+  if (!fs23.existsSync(extractedBinary)) {
     throw new Error(`Extracted binary not found at ${extractedBinary}`);
   }
   if (platform === "win32") {
     const oldPath = destPath + ".old";
     try {
       cleanStaleBinary(oldPath);
-      fs22.renameSync(destPath, oldPath);
-      fs22.copyFileSync(extractedBinary, destPath);
+      fs23.renameSync(destPath, oldPath);
+      fs23.copyFileSync(extractedBinary, destPath);
       try {
-        fs22.unlinkSync(oldPath);
+        fs23.unlinkSync(oldPath);
       } catch {
       }
     } catch (err) {
@@ -25444,25 +25685,25 @@ function installBinary(tmpFile, destPath) {
     }
   } else {
     const tmpDest = destPath + ".new";
-    fs22.copyFileSync(extractedBinary, tmpDest);
-    fs22.chmodSync(tmpDest, 493);
-    fs22.renameSync(tmpDest, destPath);
+    fs23.copyFileSync(extractedBinary, tmpDest);
+    fs23.chmodSync(tmpDest, 493);
+    fs23.renameSync(tmpDest, destPath);
   }
   try {
-    fs22.unlinkSync(tmpFile);
+    fs23.unlinkSync(tmpFile);
   } catch {
   }
   try {
-    fs22.rmSync(extractDir, { recursive: true });
+    fs23.rmSync(extractDir, { recursive: true });
   } catch {
   }
 }
 function cleanStaleBinary(oldPath) {
   const target = oldPath ?? (isPkgBinary2() ? process.execPath + ".old" : null);
   if (!target) return;
-  if (fs22.existsSync(target)) {
+  if (fs23.existsSync(target)) {
     try {
-      fs22.unlinkSync(target);
+      fs23.unlinkSync(target);
     } catch {
     }
   }
@@ -25539,7 +25780,7 @@ async function filteredCheckbox(config) {
     32,
     Math.max(...items.map((i) => i.label.length))
   );
-  return new Promise((resolve26) => {
+  return new Promise((resolve27) => {
     const checked = /* @__PURE__ */ new Set();
     let cursor = 0;
     let filterIdx = 0;
@@ -25606,7 +25847,7 @@ async function filteredCheckbox(config) {
       );
       teardown();
       const result = items.filter((_, idx) => checked.has(idx)).map((i) => i.value);
-      resolve26(result);
+      resolve27(result);
     }
     function abort() {
       process.stdout.write("\n");
@@ -25878,9 +26119,9 @@ async function runSkillsInstall() {
 }
 // src/commands/doctor.ts
-var fs23 = __toESM(require("fs"));
-var os9 = __toESM(require("os"));
-var path32 = __toESM(require("path"));
+var fs24 = __toESM(require("fs"));
+var os10 = __toESM(require("os"));
+var path35 = __toESM(require("path"));
 var import_chalk12 = __toESM(require("chalk"));
 init_logger();
 init_defaults();
@@ -25911,10 +26152,10 @@ function stampVerdict(content) {
   return { mark: "warn", note: `v${v} \u2014 stale, installed is v${WAIRON_VERSION}` };
 }
 function mcpEntryHealth(settingsPath) {
-  if (!fs23.existsSync(settingsPath)) return { mark: "warn", note: "not registered" };
+  if (!fs24.existsSync(settingsPath)) return { mark: "warn", note: "not registered" };
   let entry;
   try {
-    const s = JSON.parse(fs23.readFileSync(settingsPath, "utf8"));
+    const s = JSON.parse(fs24.readFileSync(settingsPath, "utf8"));
     entry = s.mcpServers?.["wairon"];
   } catch {
     return { mark: "error", note: "parse error" };
@@ -25922,7 +26163,7 @@ function mcpEntryHealth(settingsPath) {
   if (!entry) return { mark: "warn", note: "not registered" };
   if (entry.command === "node" && Array.isArray(entry.args) && typeof entry.args[0] === "string") {
     const scriptPath = entry.args[0];
-    if (!fs23.existsSync(scriptPath)) {
+    if (!fs24.existsSync(scriptPath)) {
       return { mark: "error", note: `registered but the server path is missing \u2014 ${scriptPath}` };
     }
   }
@@ -25974,7 +26215,7 @@ async function runDoctor(options = {}) {
     const { findChainingSubprojectsMissingConfig: findChainingSubprojectsMissingConfig2 } = (init_provision(), __toCommonJS(provision_exports));
     const missing = findChainingSubprojectsMissingConfig2(getProjectRoot());
     if (missing.length > 0) {
-      line(tally, "warn", `${missing.length} chained subproject(s) have specs but no project.yaml (un-runnable standalone): ${missing.map((d) => path32.relative(getProjectRoot(), d) || ".").join(", ")}. Run \`wairon doctor --fix\` to initialize them.`);
+      line(tally, "warn", `${missing.length} chained subproject(s) have specs but no project.yaml (un-runnable standalone): ${missing.map((d) => path35.relative(getProjectRoot(), d) || ".").join(", ")}. Run \`wairon doctor --fix\` to initialize them.`);
     }
   } catch {
   }
@@ -26012,7 +26253,7 @@ async function runDoctor(options = {}) {
     const gp = localGuideFilePath(process.cwd(), t);
     if (!gp || seenGuides.has(gp)) continue;
     seenGuides.add(gp);
-    const rel2 = path32.relative(process.cwd(), gp).replace(/\\/g, "/");
+    const rel2 = path35.relative(process.cwd(), gp).replace(/\\/g, "/");
     if (!pathExists(gp)) {
       line(tally, "warn", `${rel2} guide \u2014 not injected (run \`wairon generate\`)`);
       continue;
@@ -26094,17 +26335,17 @@ async function runDoctor(options = {}) {
     line(tally, h.mark, `Claude (project .mcp.json): ${h.note}${h.mark === "ok" ? "" : " \u2014 run `wairon mcp install --backend claude`"}`);
   }
   if (wantGemini) {
-    const globalCfg = path32.join(os9.homedir(), ".gemini", "antigravity-cli", "mcp_config.json");
+    const globalCfg = path35.join(os10.homedir(), ".gemini", "antigravity-cli", "mcp_config.json");
     const hg = mcpEntryHealth(globalCfg);
     line(tally, hg.mark, `Antigravity (global mcp_config.json): ${hg.note}${hg.mark === "ok" ? "" : " \u2014 run `wairon mcp install --backend gemini --global`"}`);
     const projPath = fromProjectRoot(".gemini", "settings.json");
-    if (fs23.existsSync(projPath)) {
+    if (fs24.existsSync(projPath)) {
       const hp = mcpEntryHealth(projPath);
       line(tally, hp.mark === "error" ? "error" : "ok", `Gemini CLI (project): ${hp.note} ${import_chalk12.default.gray("(Antigravity ignores this file)")}`);
     }
   }
-  const pluginDir = path32.join(os9.homedir(), ".gemini", "config", "plugins", "wairon");
-  if (fs23.existsSync(pluginDir)) {
+  const pluginDir = path35.join(os10.homedir(), ".gemini", "config", "plugins", "wairon");
+  if (fs24.existsSync(pluginDir)) {
     line(tally, "warn", `Legacy Antigravity plugin present (${pluginDir}) \u2014 it collides with the wairon MCP server. Remove it with \`wairon doctor --fix\`.`);
   }
   logger.blank();
@@ -26143,7 +26384,7 @@ async function applyFixes() {
     const legacySpecs = findLegacySpecFiles();
     if (legacySpecs.length > 0) {
       for (const { path: oldPath, expected: newPath } of legacySpecs) {
-        fs23.renameSync(oldPath, newPath);
+        fs24.renameSync(oldPath, newPath);
       }
       console.log(`  ${icon("ok")} Migrated ${legacySpecs.length} legacy spec file(s) to the new dot-prefixed unified schema.`);
     }
@@ -26197,8 +26438,8 @@ function printSummary(tally) {
 }
 // src/commands/diagram.ts
-var fs24 = __toESM(require("fs"));
-var path33 = __toESM(require("path"));
+var fs25 = __toESM(require("fs"));
+var path36 = __toESM(require("path"));
 init_logger();
 init_loader();
 init_fs();
@@ -26233,71 +26474,71 @@ function collectIssues() {
 }
 function writeCanvas(dest) {
   const model = buildCanvasModel(collectIssues());
-  ensureDir(path33.dirname(path33.resolve(dest)));
-  fs24.writeFileSync(dest, renderCanvasHtml(model), "utf-8");
+  ensureDir(path36.dirname(path36.resolve(dest)));
+  fs25.writeFileSync(dest, renderCanvasHtml(model), "utf-8");
 }
 function parseSequenceRef(ref) {
-  const sep6 = ref.includes(":") ? ref.lastIndexOf(":") : ref.lastIndexOf(".");
-  if (sep6 <= 0 || sep6 === ref.length - 1) {
+  const sep9 = ref.includes(":") ? ref.lastIndexOf(":") : ref.lastIndexOf(".");
+  if (sep9 <= 0 || sep9 === ref.length - 1) {
     throw new WaironError(
       `Invalid --sequence reference "${ref}". Use <componentId>:<methodName> (e.g. billing-portal:authorize).`
     );
   }
-  return { component: ref.slice(0, sep6), method: ref.slice(sep6 + 1) };
+  return { component: ref.slice(0, sep9), method: ref.slice(sep9 + 1) };
 }
 async function runDiagram(rawOptions = {}) {
   assertProjectInitialized();
   const options = applyFormat(rawOptions);
   if (options.canvas && !options.all) {
-    const dest2 = options.out ?? path33.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
+    const dest2 = options.out ?? path36.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
     writeCanvas(dest2);
     logger.success(`Interactive canvas written to ${dest2}`);
     logger.info("Open it in a browser \u2014 fully self-contained (works offline).");
     return;
   }
   if (options.drawio && !options.all) {
-    const dest2 = options.out ?? path33.join(AI_PATHS.docsDir(), "diagrams", "architecture.drawio");
-    ensureDir(path33.dirname(path33.resolve(dest2)));
-    fs24.writeFileSync(dest2, generateDrawioXml(buildCanvasModel()), "utf-8");
+    const dest2 = options.out ?? path36.join(AI_PATHS.docsDir(), "diagrams", "architecture.drawio");
+    ensureDir(path36.dirname(path36.resolve(dest2)));
+    fs25.writeFileSync(dest2, generateDrawioXml(buildCanvasModel()), "utf-8");
     logger.success(`draw.io diagram written to ${dest2}`);
     logger.info("Open with draw.io / diagrams.net (or import into tools that accept the format).");
     return;
   }
   if (options.excalidraw && !options.all) {
-    const dest2 = options.out ?? path33.join(AI_PATHS.docsDir(), "diagrams", "architecture.excalidraw");
-    ensureDir(path33.dirname(path33.resolve(dest2)));
-    fs24.writeFileSync(dest2, generateExcalidrawScene(buildCanvasModel()), "utf-8");
+    const dest2 = options.out ?? path36.join(AI_PATHS.docsDir(), "diagrams", "architecture.excalidraw");
+    ensureDir(path36.dirname(path36.resolve(dest2)));
+    fs25.writeFileSync(dest2, generateExcalidrawScene(buildCanvasModel()), "utf-8");
     logger.success(`Excalidraw scene written to ${dest2}`);
     logger.info("Open with excalidraw.com or the VS Code extension.");
     return;
   }
   const wantsMermaid = options.format?.toLowerCase().startsWith("mermaid") || !!options.subsystem || !!options.sequence;
   if (!options.all && !options.sequence && !wantsMermaid) {
-    const dest2 = options.out ?? path33.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
+    const dest2 = options.out ?? path36.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
     writeCanvas(dest2);
     logger.success(`Interactive canvas written to ${dest2}`);
     logger.info("Open it in a browser \u2014 fully self-contained (works offline). Other formats: --format mermaid|drawio|excalidraw.");
     return;
   }
   if (options.all) {
-    const outDir = options.out ?? path33.join(AI_PATHS.docsDir(), "diagrams");
+    const outDir = options.out ?? path36.join(AI_PATHS.docsDir(), "diagrams");
     const files = generateDiagramSet();
     if (files.length === 0) {
       logger.warn("No diagrams to generate \u2014 the spec tree has no components yet.");
       return;
     }
     for (const file of files) {
-      const dest2 = path33.join(outDir, file.relPath);
-      ensureDir(path33.dirname(dest2));
-      fs24.writeFileSync(dest2, toMarkdown(file), "utf-8");
+      const dest2 = path36.join(outDir, file.relPath);
+      ensureDir(path36.dirname(dest2));
+      fs25.writeFileSync(dest2, toMarkdown(file), "utf-8");
     }
-    writeCanvas(path33.join(outDir, "canvas.html"));
+    writeCanvas(path36.join(outDir, "canvas.html"));
     const exportModel = buildCanvasModel();
-    fs24.writeFileSync(path33.join(outDir, "architecture.drawio"), generateDrawioXml(exportModel), "utf-8");
-    fs24.writeFileSync(path33.join(outDir, "architecture.excalidraw"), generateExcalidrawScene(exportModel), "utf-8");
+    fs25.writeFileSync(path36.join(outDir, "architecture.drawio"), generateDrawioXml(exportModel), "utf-8");
+    fs25.writeFileSync(path36.join(outDir, "architecture.excalidraw"), generateExcalidrawScene(exportModel), "utf-8");
     const graph = loadSpecGraph();
-    const indexPath = path33.join(outDir, "README.md");
-    fs24.writeFileSync(indexPath, diagramSetIndex(files, graph.systemName), "utf-8");
+    const indexPath = path36.join(outDir, "README.md");
+    fs25.writeFileSync(indexPath, diagramSetIndex(files, graph.systemName), "utf-8");
     logger.success(`Generated ${files.length} diagram(s) + interactive canvas.html + index into ${outDir}`);
     for (const file of files.slice(0, 12)) {
       logger.info(`  ${file.relPath}`);
@@ -26308,26 +26549,26 @@ async function runDiagram(rawOptions = {}) {
   let mermaid;
   let title;
   let defaultDest;
-  const diagramsDir = path33.join(AI_PATHS.docsDir(), "diagrams");
+  const diagramsDir = path36.join(AI_PATHS.docsDir(), "diagrams");
   if (options.sequence) {
     const { component, method: method2 } = parseSequenceRef(options.sequence);
     mermaid = generateSequenceDiagram(component, method2, { depth: options.depth });
     title = `${component}.${method2} \u2014 narrative sequence`;
-    defaultDest = path33.join(diagramsDir, "sequences", `${component.replace(/::/g, "--")}.${method2}.md`);
+    defaultDest = path36.join(diagramsDir, "sequences", `${component.replace(/::/g, "--")}.${method2}.md`);
   } else if (options.subsystem) {
     mermaid = generateComponentDiagram({ subsystem: options.subsystem });
     title = `${options.subsystem} \u2014 components`;
-    defaultDest = path33.join(diagramsDir, "subsystems", `${options.subsystem.replace(/::/g, "--")}.md`);
+    defaultDest = path36.join(diagramsDir, "subsystems", `${options.subsystem.replace(/::/g, "--")}.md`);
   } else {
     mermaid = generateComponentDiagram();
     title = "Component architecture";
-    defaultDest = path33.join(diagramsDir, "system.md");
+    defaultDest = path36.join(diagramsDir, "system.md");
   }
   const dest = options.out ?? defaultDest;
-  ensureDir(path33.dirname(path33.resolve(dest)));
+  ensureDir(path36.dirname(path36.resolve(dest)));
   const content = dest.endsWith(".mmd") ? `${mermaid}
 ` : toMarkdown({ relPath: dest, title, mermaid });
-  fs24.writeFileSync(dest, content, "utf-8");
+  fs25.writeFileSync(dest, content, "utf-8");
   logger.success(`Mermaid diagram written to ${dest}`);
   logger.info("Renders on GitHub/IDE previews; use a .mmd --out path for raw Mermaid.");
 }
@@ -26436,9 +26677,9 @@ Component variants (${variants.length})
 }
 // src/commands/packs.ts
-var fs25 = __toESM(require("fs"));
-var os10 = __toESM(require("os"));
-var path34 = __toESM(require("path"));
+var fs26 = __toESM(require("fs"));
+var os11 = __toESM(require("os"));
+var path37 = __toESM(require("path"));
 var import_chalk16 = __toESM(require("chalk"));
 var import_sdk = __toESM(require_dist());
 init_logger();
@@ -26464,11 +26705,11 @@ function describe(probe2) {
   return parts.join(", ");
 }
 function resolveSourceUnit(source) {
-  const abs = path34.resolve(source);
-  if (!fs25.existsSync(abs)) {
+  const abs = path37.resolve(source);
+  if (!fs26.existsSync(abs)) {
     throw new Error(`Pack source "${source}" does not exist.`);
   }
-  const isDir = fs25.statSync(abs).isDirectory();
+  const isDir = fs26.statSync(abs).isDirectory();
   if (isDir && !packDirEntry(abs)) {
     throw new Error(`"${source}" is a directory without a pack entry file (pack.yaml | pack.cjs | index.cjs | ...).`);
   }
@@ -26484,7 +26725,7 @@ async function addPack(source, options = {}) {
   }
   const { abs } = resolveSourceUnit(source);
   const scope = options.global ? "global" : "project";
-  const probe2 = probePack(abs, path34.dirname(abs), scope);
+  const probe2 = probePack(abs, path37.dirname(abs), scope);
   if (probe2.error) {
     logger.error(probe2.error);
     process.exitCode = 1;
@@ -26492,10 +26733,10 @@ async function addPack(source, options = {}) {
   }
   if (options.global) {
     const destDir = globalPacksDir();
-    const dest2 = path34.join(destDir, path34.basename(abs));
-    if (path34.resolve(dest2) !== abs) {
-      fs25.mkdirSync(destDir, { recursive: true });
-      fs25.cpSync(abs, dest2, { recursive: true, force: true });
+    const dest2 = path37.join(destDir, path37.basename(abs));
+    if (path37.resolve(dest2) !== abs) {
+      fs26.mkdirSync(destDir, { recursive: true });
+      fs26.cpSync(abs, dest2, { recursive: true, force: true });
     }
     logger.success(`Installed pack "${probe2.name}" globally: ${dest2}`);
     logger.info(`${describe(probe2)} \u2014 auto-loaded for every project on this machine (WAIRON_PACKS_DIR / ~/.wairon/packs).`);
@@ -26508,11 +26749,11 @@ async function addPack(source, options = {}) {
     return;
   }
   const root = getProjectRoot();
-  const relRef = `.wai/packs/${path34.basename(abs)}`;
-  const dest = path34.join(root, ".wai", "packs", path34.basename(abs));
-  if (path34.resolve(dest) !== abs) {
-    fs25.mkdirSync(path34.dirname(dest), { recursive: true });
-    fs25.cpSync(abs, dest, { recursive: true, force: true });
+  const relRef = `.wai/packs/${path37.basename(abs)}`;
+  const dest = path37.join(root, ".wai", "packs", path37.basename(abs));
+  if (path37.resolve(dest) !== abs) {
+    fs26.mkdirSync(path37.dirname(dest), { recursive: true });
+    fs26.cpSync(abs, dest, { recursive: true, force: true });
   }
   const config = loadProjectConfig();
   const packs = config.extensions?.packs ?? [];
@@ -26521,14 +26762,14 @@ async function addPack(source, options = {}) {
     saveProjectConfig(config);
     logger.success(`Vendored pack "${probe2.name}" into ${relRef} and registered it in .wai/project.yaml.`);
   } else {
-    fs25.cpSync(abs, dest, { recursive: true, force: true });
+    fs26.cpSync(abs, dest, { recursive: true, force: true });
     logger.success(`Pack "${probe2.name}" already registered \u2014 refreshed ${relRef} from the source.`);
   }
   logger.info(`${describe(probe2)} \u2014 commit .wai/ so CI and every clone enforce it.`);
 }
 async function addPackFromArchive(source, options) {
-  const abs = path34.resolve(source);
-  if (!fs25.existsSync(abs) || !fs25.statSync(abs).isFile()) {
+  const abs = path37.resolve(source);
+  if (!fs26.existsSync(abs) || !fs26.statSync(abs).isFile()) {
     logger.error(`Pack archive "${source}" does not exist.`);
     process.exitCode = 1;
     return;
@@ -26543,27 +26784,27 @@ async function addPackFromArchive(source, options) {
       process.exitCode = 1;
       return;
     }
-    baseDir = path34.join(getProjectRoot(), ".wai", "packs");
+    baseDir = path37.join(getProjectRoot(), ".wai", "packs");
   }
-  const bytes = fs25.readFileSync(abs);
-  fs25.mkdirSync(baseDir, { recursive: true });
-  const staging = fs25.mkdtempSync(path34.join(baseDir, ".wpack-staging-"));
+  const bytes = fs26.readFileSync(abs);
+  fs26.mkdirSync(baseDir, { recursive: true });
+  const staging = fs26.mkdtempSync(path37.join(baseDir, ".wpack-staging-"));
   let result;
   try {
     result = (0, import_sdk.extractPack)(bytes, staging);
   } catch (err) {
-    fs25.rmSync(staging, { recursive: true, force: true });
-    logger.error(`Failed to extract pack archive "${path34.basename(abs)}": ${err instanceof Error ? err.message : String(err)}`);
+    fs26.rmSync(staging, { recursive: true, force: true });
+    logger.error(`Failed to extract pack archive "${path37.basename(abs)}": ${err instanceof Error ? err.message : String(err)}`);
     process.exitCode = 1;
     return;
   }
   const name = result.name;
-  const destDir = path34.join(baseDir, name);
-  if (fs25.existsSync(destDir)) fs25.rmSync(destDir, { recursive: true, force: true });
-  fs25.renameSync(staging, destDir);
-  const probe2 = probePack(destDir, path34.dirname(destDir), scope);
+  const destDir = path37.join(baseDir, name);
+  if (fs26.existsSync(destDir)) fs26.rmSync(destDir, { recursive: true, force: true });
+  fs26.renameSync(staging, destDir);
+  const probe2 = probePack(destDir, path37.dirname(destDir), scope);
   if (probe2.error) {
-    fs25.rmSync(destDir, { recursive: true, force: true });
+    fs26.rmSync(destDir, { recursive: true, force: true });
     logger.error(probe2.error);
     process.exitCode = 1;
     return;
@@ -26581,7 +26822,7 @@ async function addPackFromArchive(source, options) {
     saveProjectConfig(config);
     logger.success(`Installed pack "${probe2.name ?? name}" into ${relRef} and registered it in .wai/project.yaml.`);
   } else {
-    logger.success(`Pack "${probe2.name ?? name}" already registered \u2014 refreshed ${relRef} from ${path34.basename(abs)}.`);
+    logger.success(`Pack "${probe2.name ?? name}" already registered \u2014 refreshed ${relRef} from ${path37.basename(abs)}.`);
   }
   logger.info(`${describe(probe2)} \u2014 commit .wai/ so CI and every clone enforce it.`);
 }
@@ -26602,7 +26843,7 @@ async function buildPack(source, options = {}) {
   const sourceDir = source && source.length > 0 ? source : ".";
   const result = (0, import_sdk.buildPack)(sourceDir);
   const outPath = options.out ?? result.suggestedFileName;
-  fs25.writeFileSync(outPath, result.archive);
+  fs26.writeFileSync(outPath, result.archive);
   logger.success(`Built pack "${result.info.name}" v${result.info.version} \u2192 ${outPath} (${result.archive.byteLength} bytes)`);
   logger.info(`Install it with \`wairon pack add ${outPath}\`, or upload it to a hosted instance.`);
 }
@@ -26613,8 +26854,8 @@ function expandSource(source, version) {
   return source.replace(/\{version\}/g, version ?? "").replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, name) => process.env[name] ?? "");
 }
 async function fetchArchive(url) {
-  const dir = fs25.mkdtempSync(path34.join(os10.tmpdir(), "wairon-packdl-"));
-  const dest = path34.join(dir, "pack.wpack");
+  const dir = fs26.mkdtempSync(path37.join(os11.tmpdir(), "wairon-packdl-"));
+  const dest = path37.join(dir, "pack.wpack");
   await downloadFile(url, dest);
   return dest;
 }
@@ -26633,7 +26874,7 @@ async function installPack(source) {
     }
     const extracted = extractArchiveToTemp(archive);
     try {
-      fs25.rmSync(path34.dirname(archive), { recursive: true, force: true });
+      fs26.rmSync(path37.dirname(archive), { recursive: true, force: true });
     } catch {
     }
     if (!extracted) return;
@@ -26645,7 +26886,7 @@ async function installPack(source) {
       process.exitCode = 1;
     } finally {
       try {
-        fs25.rmSync(extracted.dir, { recursive: true, force: true });
+        fs26.rmSync(extracted.dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -26656,7 +26897,7 @@ async function installPack(source) {
     if (!extracted) return;
     sourceDir = extracted.dir;
     cleanup = extracted.dir;
-    origin = path34.resolve(source);
+    origin = path37.resolve(source);
   } else {
     let unit;
     try {
@@ -26682,7 +26923,7 @@ async function installPack(source) {
   } finally {
     if (cleanup) {
       try {
-        fs25.rmSync(cleanup, { recursive: true, force: true });
+        fs26.rmSync(cleanup, { recursive: true, force: true });
       } catch {
       }
     }
@@ -26699,20 +26940,20 @@ function reportInstalled(installed, origin) {
   }
 }
 function extractArchiveToTemp(source) {
-  const abs = path34.resolve(source);
-  if (!fs25.existsSync(abs)) {
+  const abs = path37.resolve(source);
+  if (!fs26.existsSync(abs)) {
     logger.error(`Pack archive "${source}" does not exist.`);
     process.exitCode = 1;
     return null;
   }
-  const tempDir = fs25.mkdtempSync(path34.join(os10.tmpdir(), "wairon-packinstall-"));
+  const tempDir = fs26.mkdtempSync(path37.join(os11.tmpdir(), "wairon-packinstall-"));
   try {
-    const result = (0, import_sdk.extractPack)(new Uint8Array(fs25.readFileSync(abs)), tempDir);
+    const result = (0, import_sdk.extractPack)(new Uint8Array(fs26.readFileSync(abs)), tempDir);
     void result;
     return { dir: tempDir };
   } catch (e) {
     try {
-      fs25.rmSync(tempDir, { recursive: true, force: true });
+      fs26.rmSync(tempDir, { recursive: true, force: true });
     } catch {
     }
     logger.error(`Could not extract "${source}": ${e instanceof Error ? e.message : String(e)}`);
@@ -26858,7 +27099,7 @@ async function fetchAndInstall(selection, url) {
   const archive = await fetchArchive(url);
   const extracted = extractArchiveToTemp(archive);
   try {
-    fs25.rmSync(path34.dirname(archive), { recursive: true, force: true });
+    fs26.rmSync(path37.dirname(archive), { recursive: true, force: true });
   } catch {
   }
   if (!extracted) return null;
@@ -26870,7 +27111,7 @@ async function fetchAndInstall(selection, url) {
     return pack;
   } finally {
     try {
-      fs25.rmSync(extracted.dir, { recursive: true, force: true });
+      fs26.rmSync(extracted.dir, { recursive: true, force: true });
     } catch {
     }
   }
@@ -26881,10 +27122,10 @@ function bundleTargets(selections, name, all) {
   return selections.filter((s) => s.bundle === true);
 }
 function writeBundle(root, resolved) {
-  const dest = path34.join(root, ".wai", "packs", resolved.name, resolved.version);
-  fs25.rmSync(dest, { recursive: true, force: true });
-  fs25.mkdirSync(path34.dirname(dest), { recursive: true });
-  fs25.cpSync(resolved.path, dest, { recursive: true });
+  const dest = path37.join(root, ".wai", "packs", resolved.name, resolved.version);
+  fs26.rmSync(dest, { recursive: true, force: true });
+  fs26.mkdirSync(path37.dirname(dest), { recursive: true });
+  fs26.cpSync(resolved.path, dest, { recursive: true });
   return dest;
 }
 async function bundlePack(name, options = {}) {
@@ -26915,7 +27156,7 @@ async function bundlePack(name, options = {}) {
     selection.version = resolved.version;
     selection.bundle = true;
     bundled.push(`${resolved.name}@${resolved.version}`);
-    console.log(`  ${import_chalk16.default.green("+")} ${import_chalk16.default.dim(path34.relative(root, dest).replace(/\\/g, "/"))}`);
+    console.log(`  ${import_chalk16.default.green("+")} ${import_chalk16.default.dim(path37.relative(root, dest).replace(/\\/g, "/"))}`);
   }
   if (bundled.length === 0) return;
   config.extensions = { packs: entries, useGlobalPacks: globalPacksEnabled(config) };
@@ -26957,9 +27198,9 @@ async function listPacks() {
   console.log(import_chalk16.default.bold.cyan(`\u25A0 Global (${globalPacksDir()})${useGlobal ? "" : import_chalk16.default.yellow("  [disabled: extensions.useGlobalPacks: false]")}`));
   if (globalRefs.length === 0) console.log(import_chalk16.default.dim("  (none)"));
   for (const ref of globalRefs) {
-    const probe2 = probePack(ref, path34.dirname(ref), "global");
-    if (probe2.error) console.log(`  ${import_chalk16.default.red("\u2716")} ${path34.basename(ref)} \u2014 ${import_chalk16.default.red(probe2.error)}`);
-    else console.log(`  ${import_chalk16.default.green("\u25CF")} ${import_chalk16.default.bold(probe2.name ?? path34.basename(ref))}  ${import_chalk16.default.dim(describe(probe2))}`);
+    const probe2 = probePack(ref, path37.dirname(ref), "global");
+    if (probe2.error) console.log(`  ${import_chalk16.default.red("\u2716")} ${path37.basename(ref)} \u2014 ${import_chalk16.default.red(probe2.error)}`);
+    else console.log(`  ${import_chalk16.default.green("\u25CF")} ${import_chalk16.default.bold(probe2.name ?? path37.basename(ref))}  ${import_chalk16.default.dim(describe(probe2))}`);
   }
   console.log("");
   if (!inProject) {
@@ -26987,9 +27228,9 @@ async function listPacks() {
 async function removePack(name, options = {}) {
   if (options.global) {
     for (const ref of discoverPacks(globalPacksDir())) {
-      const probe2 = probePack(ref, path34.dirname(ref), "global");
-      if (probe2.name === name || path34.basename(ref) === name) {
-        fs25.rmSync(ref, { recursive: true, force: true });
+      const probe2 = probePack(ref, path37.dirname(ref), "global");
+      if (probe2.name === name || path37.basename(ref) === name) {
+        fs26.rmSync(ref, { recursive: true, force: true });
         logger.success(`Removed global pack "${probe2.name ?? name}" (${ref}).`);
         return;
       }
@@ -27010,16 +27251,16 @@ async function removePack(name, options = {}) {
     if (typeof entry !== "string") continue;
     const ref = entry;
     const probe2 = probePack(ref, root, "project");
-    if (probe2.name === name || ref === name || path34.basename(ref) === name) {
+    if (probe2.name === name || ref === name || path37.basename(ref) === name) {
       config.extensions = {
         packs: packs.filter((p) => p !== ref),
         useGlobalPacks: globalPacksEnabled(config)
       };
       saveProjectConfig(config);
-      const resolved = path34.resolve(root, ref);
-      const vendorDir = path34.resolve(root, ".wai", "packs");
-      if (resolved.startsWith(vendorDir + path34.sep)) {
-        fs25.rmSync(resolved, { recursive: true, force: true });
+      const resolved = path37.resolve(root, ref);
+      const vendorDir = path37.resolve(root, ".wai", "packs");
+      if (resolved.startsWith(vendorDir + path37.sep)) {
+        fs26.rmSync(resolved, { recursive: true, force: true });
         logger.success(`Deregistered pack "${probe2.name ?? name}" and deleted ${ref}.`);
       } else {
         logger.success(`Deregistered pack "${probe2.name ?? name}" (files at ${ref} left in place).`);
@@ -27032,22 +27273,22 @@ async function removePack(name, options = {}) {
 }
 // src/commands/host.ts
-var fs52 = __toESM(require("fs"));
-var path61 = __toESM(require("path"));
-var os11 = __toESM(require("os"));
-var crypto21 = __toESM(require("crypto"));
+var fs53 = __toESM(require("fs"));
+var path64 = __toESM(require("path"));
+var os12 = __toESM(require("os"));
+var crypto22 = __toESM(require("crypto"));
 var import_child_process5 = require("child_process");
 var import_chalk17 = __toESM(require("chalk"));
 init_logger();
 init_errors();
 // src/server/admin.ts
-var crypto8 = __toESM(require("crypto"));
+var crypto9 = __toESM(require("crypto"));
 init_fs();
 init_defaults();
 // src/server/auth.ts
-var crypto6 = __toESM(require("crypto"));
+var crypto7 = __toESM(require("crypto"));
 // src/server/types.ts
 var SSO_ADMIN_ROLE_ID = "sso-admin";
@@ -27060,35 +27301,35 @@ var UNAUTHENTICATED = {
 var WEB_SESSION_PREFIX = "ws_";
 // src/server/credentials.ts
-var fs26 = __toESM(require("fs"));
-var path35 = __toESM(require("path"));
-var crypto4 = __toESM(require("crypto"));
+var fs27 = __toESM(require("fs"));
+var path38 = __toESM(require("path"));
+var crypto5 = __toESM(require("crypto"));
 var HASH_NS = "wairon:token:v1";
 function hashToken(token) {
-  return crypto4.createHash("sha256").update(`${HASH_NS}:${token}`).digest("hex");
+  return crypto5.createHash("sha256").update(`${HASH_NS}:${token}`).digest("hex");
 }
 function storePath(dataDir) {
-  return path35.join(dataDir, "auth", "credentials.json");
+  return path38.join(dataDir, "auth", "credentials.json");
 }
 function load3(dataDir) {
   try {
-    return JSON.parse(fs26.readFileSync(storePath(dataDir), "utf8"));
+    return JSON.parse(fs27.readFileSync(storePath(dataDir), "utf8"));
   } catch {
     return [];
   }
 }
 function save(dataDir, records) {
   const p = storePath(dataDir);
-  fs26.mkdirSync(path35.dirname(p), { recursive: true });
+  fs27.mkdirSync(path38.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs26.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs26.renameSync(tmp, p);
+  fs27.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs27.renameSync(tmp, p);
 }
 function digestEquals(a, b) {
   const ab = Buffer.from(a, "hex");
   const bb = Buffer.from(b, "hex");
   if (ab.length === 0 || ab.length !== bb.length) return false;
-  return crypto4.timingSafeEqual(ab, bb);
+  return crypto5.timingSafeEqual(ab, bb);
 }
 function findByTokenHash(dataDir, tokenHash) {
   return load3(dataDir).find((r) => digestEquals(r.keyHash, tokenHash)) ?? null;
@@ -27127,17 +27368,17 @@ function listByOwner(dataDir, ownerUserId) {
 }
 // src/server/websessions.ts
-var fs27 = __toESM(require("fs"));
-var path36 = __toESM(require("path"));
-var crypto5 = __toESM(require("crypto"));
+var fs28 = __toESM(require("fs"));
+var path39 = __toESM(require("path"));
+var crypto6 = __toESM(require("crypto"));
 function storePath2(dataDir) {
-  return path36.join(dataDir, "web-sessions.json");
+  return path39.join(dataDir, "web-sessions.json");
 }
 function readSessions(dataDir) {
   const p = storePath2(dataDir);
   let raw;
   try {
-    raw = fs27.readFileSync(p, "utf8");
+    raw = fs28.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read web session store at ${p}: ${e.message}`);
@@ -27152,13 +27393,13 @@ function readSessions(dataDir) {
 }
 function persistSessions(dataDir, sessions) {
   const p = storePath2(dataDir);
-  fs27.mkdirSync(path36.dirname(p), { recursive: true });
+  fs28.mkdirSync(path39.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs27.writeFileSync(tmp, JSON.stringify(sessions, null, 2) + "\n");
-  fs27.renameSync(tmp, p);
+  fs28.writeFileSync(tmp, JSON.stringify(sessions, null, 2) + "\n");
+  fs28.renameSync(tmp, p);
 }
 function mintSessionId() {
-  return `${WEB_SESSION_PREFIX}${crypto5.randomBytes(24).toString("hex")}`;
+  return `${WEB_SESSION_PREFIX}${crypto6.randomBytes(24).toString("hex")}`;
 }
 var WebSessionStore = class {
   constructor(dataDir) {
@@ -27316,17 +27557,17 @@ function listWebSessionsBySubject(dataDir, userId) {
 }
 // src/server/users.ts
-var fs28 = __toESM(require("fs"));
-var path37 = __toESM(require("path"));
+var fs29 = __toESM(require("fs"));
+var path40 = __toESM(require("path"));
 var VALID_STATUSES = ["active", "inactive", "suspended", "deactivated", "disabled"];
 function storePath3(dataDir) {
-  return path37.join(dataDir, "users.json");
+  return path40.join(dataDir, "users.json");
 }
 function loadStore(dataDir) {
   const p = storePath3(dataDir);
   let raw;
   try {
-    raw = fs28.readFileSync(p, "utf8");
+    raw = fs29.readFileSync(p, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw new Error(`Cannot read hosted-user store at ${p}: ${err.message}`);
@@ -27344,10 +27585,10 @@ function loadStore(dataDir) {
 }
 function replaceAll(dataDir, records) {
   const p = storePath3(dataDir);
-  fs28.mkdirSync(path37.dirname(p), { recursive: true });
+  fs29.mkdirSync(path40.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs28.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs28.renameSync(tmp, p);
+  fs29.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs29.renameSync(tmp, p);
 }
 function registryUpsert(dataDir, record2) {
   const records = loadStore(dataDir);
@@ -27449,11 +27690,11 @@ function remapUnitReferences(dataDir, remap, removedScopeIds) {
 }
 // src/server/instance.ts
-var fs29 = __toESM(require("fs"));
-var path38 = __toESM(require("path"));
+var fs30 = __toESM(require("fs"));
+var path41 = __toESM(require("path"));
 var import_crypto = require("crypto");
 function storePath4(dataDir) {
-  return path38.join(dataDir, "instance.json");
+  return path41.join(dataDir, "instance.json");
 }
 var InstanceIdentityStore = class {
   constructor(dataDir) {
@@ -27470,7 +27711,7 @@ var InstanceIdentityStore = class {
     const p = storePath4(this.dataDir);
     let raw;
     try {
-      raw = fs29.readFileSync(p, "utf8");
+      raw = fs30.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw new Error(`Cannot read instance identity at ${p}: ${err.message}`);
@@ -27493,10 +27734,10 @@ var InstanceIdentityStore = class {
    *  never truncates the file. Only called by the registry's create-once seed. */
   replace(identity) {
     const p = storePath4(this.dataDir);
-    fs29.mkdirSync(path38.dirname(p), { recursive: true });
+    fs30.mkdirSync(path41.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
-    fs29.writeFileSync(tmp, JSON.stringify(identity, null, 2) + "\n");
-    fs29.renameSync(tmp, p);
+    fs30.writeFileSync(tmp, JSON.stringify(identity, null, 2) + "\n");
+    fs30.renameSync(tmp, p);
   }
 };
 var InstanceIdentityRegistry = class {
@@ -27552,8 +27793,8 @@ function getInstanceIdentity(dataDir) {
 }
 // src/utils/secrets.ts
-var fs30 = __toESM(require("fs"));
-var path39 = __toESM(require("path"));
+var fs31 = __toESM(require("fs"));
+var path42 = __toESM(require("path"));
 var ENV_FALLBACK = {
   "git-token": ["WAIRON_GIT_TOKEN"],
   "notion-token": ["WAIRON_NOTION_TOKEN"],
@@ -27562,13 +27803,13 @@ var ENV_FALLBACK = {
 };
 function storePath5() {
   const dataDir = process.env["WAIRON_DATA_DIR"];
-  return dataDir ? path39.join(dataDir, "auth", "secrets.json") : null;
+  return dataDir ? path42.join(dataDir, "auth", "secrets.json") : null;
 }
 function readStore() {
   const p = storePath5();
   if (!p) return {};
   try {
-    return JSON.parse(fs30.readFileSync(p, "utf8"));
+    return JSON.parse(fs31.readFileSync(p, "utf8"));
   } catch {
     return {};
   }
@@ -27593,10 +27834,10 @@ function setSecret(key, value) {
   if (!p) throw new Error("WAIRON_DATA_DIR is not set \u2014 a running server needs it to store secrets.");
   const store = readStore();
   store[key] = value;
-  fs30.mkdirSync(path39.dirname(p), { recursive: true });
+  fs31.mkdirSync(path42.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs30.writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n");
-  fs30.renameSync(tmp, p);
+  fs31.writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n");
+  fs31.renameSync(tmp, p);
 }
 function listSecretKeys() {
   return Object.keys(readStore());
@@ -27674,7 +27915,7 @@ function masterMatches(credential) {
   if (!master || !credential) return false;
   const a = Buffer.from(hashToken(credential), "hex");
   const b = Buffer.from(hashToken(master), "hex");
-  return a.length === b.length && crypto6.timingSafeEqual(a, b);
+  return a.length === b.length && crypto7.timingSafeEqual(a, b);
 }
 function bootstrapAdminPrincipal() {
   const subject = {
@@ -27722,7 +27963,7 @@ function authenticateMaster(token) {
 function hashedEquals(a, b) {
   const ha = Buffer.from(hashToken(a), "hex");
   const hb = Buffer.from(hashToken(b), "hex");
-  return ha.length === hb.length && crypto6.timingSafeEqual(ha, hb);
+  return ha.length === hb.length && crypto7.timingSafeEqual(ha, hb);
 }
 function verifyBuiltinAdmin(cfg, user, password) {
   const configuredUser = cfg.builtinAdminUser ?? "";
@@ -27771,16 +28012,16 @@ function signingKey() {
 }
 function signViewToken(project2, format) {
   const body = Buffer.from(JSON.stringify({ project: project2, format, exp: Date.now() + VIEW_TTL_MS })).toString("base64url");
-  const sig = crypto6.createHmac("sha256", signingKey()).update(body).digest("base64url");
+  const sig = crypto7.createHmac("sha256", signingKey()).update(body).digest("base64url");
   return `${body}.${sig}`;
 }
 function verifyViewToken(token) {
   const [body, sig] = String(token).split(".");
   if (!body || !sig) throw new Error("invalid view token");
-  const expected = crypto6.createHmac("sha256", signingKey()).update(body).digest("base64url");
+  const expected = crypto7.createHmac("sha256", signingKey()).update(body).digest("base64url");
   const a = Buffer.from(sig);
   const b = Buffer.from(expected);
-  if (a.length !== b.length || !crypto6.timingSafeEqual(a, b)) throw new Error("invalid view token");
+  if (a.length !== b.length || !crypto7.timingSafeEqual(a, b)) throw new Error("invalid view token");
   const payload = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
   if (Date.now() > payload.exp) throw new Error("expired view token");
   return { project: payload.project, format: payload.format, expiresAt: new Date(payload.exp).toISOString() };
@@ -27788,33 +28029,33 @@ function verifyViewToken(token) {
 var SSO_STATE_TTL_MS = 10 * 60 * 1e3;
 function signSsoState(payload) {
   const body = Buffer.from(JSON.stringify({ payload, exp: Date.now() + SSO_STATE_TTL_MS })).toString("base64url");
-  const sig = crypto6.createHmac("sha256", signingKey()).update(body).digest("base64url");
+  const sig = crypto7.createHmac("sha256", signingKey()).update(body).digest("base64url");
   return `${body}.${sig}`;
 }
 function verifySsoState(state) {
   const [body, sig] = String(state).split(".");
   if (!body || !sig) throw new Error("invalid SSO state");
-  const expected = crypto6.createHmac("sha256", signingKey()).update(body).digest("base64url");
+  const expected = crypto7.createHmac("sha256", signingKey()).update(body).digest("base64url");
   const a = Buffer.from(sig);
   const b = Buffer.from(expected);
-  if (a.length !== b.length || !crypto6.timingSafeEqual(a, b)) throw new Error("invalid SSO state");
+  if (a.length !== b.length || !crypto7.timingSafeEqual(a, b)) throw new Error("invalid SSO state");
   const parsed = JSON.parse(Buffer.from(body, "base64url").toString("utf8"));
   if (Date.now() > parsed.exp) throw new Error("expired SSO state");
   return parsed.payload;
 }
 // src/server/organization.ts
-var fs31 = __toESM(require("fs"));
-var path40 = __toESM(require("path"));
-var crypto7 = __toESM(require("crypto"));
+var fs32 = __toESM(require("fs"));
+var path43 = __toESM(require("path"));
+var crypto8 = __toESM(require("crypto"));
 function storePath6(dataDir) {
-  return path40.join(dataDir, "organization.json");
+  return path43.join(dataDir, "organization.json");
 }
 function readState(dataDir) {
   const p = storePath6(dataDir);
   let raw;
   try {
-    raw = fs31.readFileSync(p, "utf8");
+    raw = fs32.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return { units: [], placements: [] };
     throw new Error(`Failed to read organization store at ${p}: ${e.message}`);
@@ -27831,10 +28072,10 @@ function readState(dataDir) {
 }
 function persistState(dataDir, state) {
   const p = storePath6(dataDir);
-  fs31.mkdirSync(path40.dirname(p), { recursive: true });
+  fs32.mkdirSync(path43.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs31.writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n");
-  fs31.renameSync(tmp, p);
+  fs32.writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n");
+  fs32.renameSync(tmp, p);
 }
 var SLUG_PATTERN = /^[a-z0-9-]+$/;
 var UNIT_KINDS = ["business_entity", "department", "team", "group"];
@@ -28129,7 +28370,7 @@ var OrganizationRegistry = class {
       createdAt: placements[existingIdx].createdAt
     } : {
       ...placement,
-      id: placement.id || crypto7.randomUUID(),
+      id: placement.id || crypto8.randomUUID(),
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     const next = isUpdate ? placements.map((p, i) => i === existingIdx ? stored : p) : [...placements, stored];
@@ -28210,11 +28451,11 @@ function getOrganizationUnit(dataDir, id) {
 }
 // src/server/permissions.ts
-var fs32 = __toESM(require("fs"));
-var path41 = __toESM(require("path"));
+var fs33 = __toESM(require("fs"));
+var path44 = __toESM(require("path"));
 var import_crypto2 = require("crypto");
 function storePath7(dataDir) {
-  return path41.join(dataDir, "permissions.json");
+  return path44.join(dataDir, "permissions.json");
 }
 function assignmentKey(a) {
   return [a.subjectKind, a.subjectId ?? "", a.scopeKind, a.scopeId ?? "", a.capability].join("|");
@@ -28223,7 +28464,7 @@ function load4(dataDir) {
   const p = storePath7(dataDir);
   let raw;
   try {
-    raw = fs32.readFileSync(p, "utf8");
+    raw = fs33.readFileSync(p, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw new Error(`Cannot read permission store at ${p}: ${err.message}`);
@@ -28241,10 +28482,10 @@ function load4(dataDir) {
 }
 function replaceAll2(dataDir, assignments) {
   const p = storePath7(dataDir);
-  fs32.mkdirSync(path41.dirname(p), { recursive: true });
+  fs33.mkdirSync(path44.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs32.writeFileSync(tmp, JSON.stringify(assignments, null, 2) + "\n");
-  fs32.renameSync(tmp, p);
+  fs33.writeFileSync(tmp, JSON.stringify(assignments, null, 2) + "\n");
+  fs33.renameSync(tmp, p);
 }
 function registrySet(dataDir, assignment) {
   const assignments = load4(dataDir);
@@ -28330,8 +28571,8 @@ function getAssignment(dataDir, assignmentId) {
 }
 // src/server/roles.ts
-var fs33 = __toESM(require("fs"));
-var path42 = __toESM(require("path"));
+var fs34 = __toESM(require("fs"));
+var path45 = __toESM(require("path"));
 var BUILTIN_ROLES = [
   {
     id: SSO_ADMIN_ROLE_ID,
@@ -28349,13 +28590,13 @@ function isBuiltinRoleId(roleId) {
   return BUILTIN_ROLE_IDS.has(roleId);
 }
 function storePath8(dataDir) {
-  return path42.join(dataDir, "roles.json");
+  return path45.join(dataDir, "roles.json");
 }
 function load5(dataDir) {
   const p = storePath8(dataDir);
   let raw;
   try {
-    raw = fs33.readFileSync(p, "utf8");
+    raw = fs34.readFileSync(p, "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return [];
     throw new Error(`Cannot read role store at ${p}: ${err.message}`);
@@ -28373,10 +28614,10 @@ function load5(dataDir) {
 }
 function replaceAll3(dataDir, roles) {
   const p = storePath8(dataDir);
-  fs33.mkdirSync(path42.dirname(p), { recursive: true });
+  fs34.mkdirSync(path45.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs33.writeFileSync(tmp, JSON.stringify(roles, null, 2) + "\n");
-  fs33.renameSync(tmp, p);
+  fs34.writeFileSync(tmp, JSON.stringify(roles, null, 2) + "\n");
+  fs34.renameSync(tmp, p);
 }
 function registryCreate(dataDir, role) {
   if (isBuiltinRoleId(role.id)) {
@@ -28610,8 +28851,8 @@ function actionableUnitIds(scopes) {
 }
 // src/server/projects.ts
-var fs37 = __toESM(require("fs"));
-var path46 = __toESM(require("path"));
+var fs38 = __toESM(require("fs"));
+var path49 = __toESM(require("path"));
 init_loader();
 init_yaml();
 init_fs();
@@ -28630,37 +28871,37 @@ init_types();
 init_server();
 // src/git/config.ts
-var fs34 = __toESM(require("fs"));
-var path43 = __toESM(require("path"));
+var fs35 = __toESM(require("fs"));
+var path46 = __toESM(require("path"));
 init_fs();
 function configPath() {
   return aiDir("git.json");
 }
 function readGitConfig() {
   try {
-    return JSON.parse(fs34.readFileSync(configPath(), "utf8"));
+    return JSON.parse(fs35.readFileSync(configPath(), "utf8"));
   } catch {
     return null;
   }
 }
 function writeGitConfig(config) {
   const p = configPath();
-  fs34.mkdirSync(path43.dirname(p), { recursive: true });
+  fs35.mkdirSync(path46.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs34.writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n");
-  fs34.renameSync(tmp, p);
+  fs35.writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n");
+  fs35.renameSync(tmp, p);
 }
 function clearGitConfig() {
   try {
-    fs34.rmSync(configPath(), { force: true });
+    fs35.rmSync(configPath(), { force: true });
   } catch {
   }
 }
 // src/git/adapter.ts
 var import_child_process3 = require("child_process");
-var fs35 = __toESM(require("fs"));
-var path44 = __toESM(require("path"));
+var fs36 = __toESM(require("fs"));
+var path47 = __toESM(require("path"));
 init_fs();
 function git(args, cwd) {
   return (0, import_child_process3.execFileSync)("git", args, {
@@ -28712,10 +28953,10 @@ function compareUrl(remote, defaultBranch, workingBranch) {
   return `${web}/compare/${encodeURIComponent(defaultBranch)}...${encodeURIComponent(workingBranch)}`;
 }
 function excludeLocalFiles() {
-  const excludePath = path44.join(getProjectRoot(), ".git", "info", "exclude");
+  const excludePath = path47.join(getProjectRoot(), ".git", "info", "exclude");
   try {
-    fs35.mkdirSync(path44.dirname(excludePath), { recursive: true });
-    fs35.appendFileSync(excludePath, "\n.wai/lock.json\n.wai/git.json\n");
+    fs36.mkdirSync(path47.dirname(excludePath), { recursive: true });
+    fs36.appendFileSync(excludePath, "\n.wai/lock.json\n.wai/git.json\n");
   } catch {
   }
 }
@@ -28780,25 +29021,25 @@ function configureSync(periodicSyncMinutes, skipIfClean) {
 }
 // src/producers/config.ts
-var fs36 = __toESM(require("fs"));
-var path45 = __toESM(require("path"));
+var fs37 = __toESM(require("fs"));
+var path48 = __toESM(require("path"));
 init_fs();
 function configPath2() {
   return aiDir("producers.json");
 }
 function load6() {
   try {
-    return JSON.parse(fs36.readFileSync(configPath2(), "utf8"));
+    return JSON.parse(fs37.readFileSync(configPath2(), "utf8"));
   } catch {
     return [];
   }
 }
 function save2(configs) {
   const p = configPath2();
-  fs36.mkdirSync(path45.dirname(p), { recursive: true });
+  fs37.mkdirSync(path48.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs36.writeFileSync(tmp, JSON.stringify(configs, null, 2) + "\n");
-  fs36.renameSync(tmp, p);
+  fs37.writeFileSync(tmp, JSON.stringify(configs, null, 2) + "\n");
+  fs37.renameSync(tmp, p);
 }
 function readProducerConfig(target) {
   return load6().find((c) => c.target === target) ?? null;
@@ -29216,24 +29457,24 @@ function isValidProjectId(id) {
   return typeof id === "string" && ID_RE.test(id);
 }
 function registryPath(dataDir) {
-  return path46.join(dataDir, "projects.json");
+  return path49.join(dataDir, "projects.json");
 }
 function load7(dataDir) {
   try {
-    return JSON.parse(fs37.readFileSync(registryPath(dataDir), "utf8"));
+    return JSON.parse(fs38.readFileSync(registryPath(dataDir), "utf8"));
   } catch {
     return [];
   }
 }
 function save3(dataDir, records) {
   const p = registryPath(dataDir);
-  fs37.mkdirSync(path46.dirname(p), { recursive: true });
+  fs38.mkdirSync(path49.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs37.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs37.renameSync(tmp, p);
+  fs38.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs38.renameSync(tmp, p);
 }
 function projectRoot(dataDir, id) {
-  return path46.join(dataDir, "projects", id);
+  return path49.join(dataDir, "projects", id);
 }
 function existingProjectRoot(dataDir, id) {
   if (!isValidProjectId(id)) return null;
@@ -29249,7 +29490,7 @@ function createProjectRecord(dataDir, id) {
     throw new Error(`Project "${id}" already exists.`);
   }
   const root = projectRoot(dataDir, id);
-  fs37.mkdirSync(root, { recursive: true });
+  fs38.mkdirSync(root, { recursive: true });
   const record2 = {
     id,
     rootPath: root,
@@ -29284,7 +29525,7 @@ function removeProjectRecord(dataDir, id) {
   const rec = records.find((r) => r.id === id);
   if (rec) {
     try {
-      fs37.rmSync(rec.rootPath, { recursive: true, force: true });
+      fs38.rmSync(rec.rootPath, { recursive: true, force: true });
     } catch {
     }
   }
@@ -29300,7 +29541,7 @@ function parseQualifiedSelector(value) {
 }
 function findSubsystemSpec(root, subsystemId) {
   const specsDir = aiPathsAt(root).specsDir();
-  if (!fs37.existsSync(specsDir)) return null;
+  if (!fs38.existsSync(specsDir)) return null;
   for (const file of listFilesRecursive(specsDir, ".yaml")) {
     let raw;
     try {
@@ -29478,9 +29719,9 @@ function mintKey(cfg, credential, project2, role) {
       "instance-wide super-admin (*:*) keys cannot be minted \u2014 the built-in admin account (WAIRON_ADMIN_USER) is the only super-admin"
     );
   }
-  const token = "wk_" + crypto8.randomBytes(24).toString("hex");
+  const token = "wk_" + crypto9.randomBytes(24).toString("hex");
   const record2 = {
-    id: crypto8.randomBytes(6).toString("hex"),
+    id: crypto9.randomBytes(6).toString("hex"),
     keyHash: hashToken(token),
     role,
     projects: project2 === "*" ? ["*"] : [project2],
@@ -29676,31 +29917,10 @@ function diagramViewLink(cfg, credential, project2) {
   if (!existingProjectRoot(cfg.dataDir, project2)) throw new Error(`Unknown project "${project2}".`);
   return `/view/diagram?token=${signViewToken(project2, "canvas")}`;
 }
-function promoteProject(cfg, credential, project2) {
-  const principal = requirePrincipal(cfg, credential);
-  if (authorize(cfg.dataDir, principal, "project:write", "project", project2).value !== "yes") {
-    throw new AdminAuthError("Forbidden \u2014 promoting a project requires project:write over it");
-  }
-  return executeApprovedPromote(cfg, project2);
-}
-function executeApprovedPromote(cfg, projectId, subproject) {
-  const root = boundLifecycleRoot(cfg, projectId, subproject);
-  return runWithProjectRoot(root, () => {
-    const { state, record: lock, current: current2 } = hostCore.readLockState();
-    if (state === "unlocked" || !lock) {
-      return { status: "not-locked", message: "Project is not locked; run lock first." };
-    }
-    if (state === "stale") {
-      return { status: "stale", stateId: current2, message: "Spec tree or governing doctrine changed since lock; re-lock required." };
-    }
-    hostCore.writeLockRecord({ ...lock, status: "promoted" });
-    return { status: "ready", stateId: current2, message: "Locked state matches; change-set marked ready for promotion." };
-  });
-}
 // src/server/packs.ts
-var fs38 = __toESM(require("fs"));
-var path47 = __toESM(require("path"));
+var fs39 = __toESM(require("fs"));
+var path50 = __toESM(require("path"));
 init_fs();
 init_yaml();
 init_loader();
@@ -29746,19 +29966,19 @@ function assertNotCodeArchive(info) {
 function extractDeclarativeArchive(archive, destDir) {
   const result = hostSdk.extractArchive(archive, destDir, HOSTED_STRICT_LIMITS);
   try {
-    assertDeclarative(fs38.readFileSync(path47.join(result.directory, result.entryPath), "utf8"));
+    assertDeclarative(fs39.readFileSync(path50.join(result.directory, result.entryPath), "utf8"));
   } catch (e) {
-    fs38.rmSync(destDir, { recursive: true, force: true });
+    fs39.rmSync(destDir, { recursive: true, force: true });
     throw e;
   }
 }
 function probe(loadRef, baseRoot, scope, displayRef) {
   const loaded = hostCore.loadExtensionPacks([{ ref: loadRef, scope }], baseRoot);
   if (loaded.errors.length) {
-    return { name: path47.basename(displayRef), scope, ref: displayRef, profiles: 0, languages: 0, rules: 0, error: loaded.errors[0] };
+    return { name: path50.basename(displayRef), scope, ref: displayRef, profiles: 0, languages: 0, rules: 0, error: loaded.errors[0] };
   }
   return {
-    name: loaded.packNames[0] ?? path47.basename(displayRef),
+    name: loaded.packNames[0] ?? path50.basename(displayRef),
     scope,
     ref: displayRef,
     profiles: Object.keys(loaded.profiles).length,
@@ -29772,20 +29992,20 @@ function probe(loadRef, baseRoot, scope, displayRef) {
   };
 }
 function writeFileAtomic(file, content) {
-  fs38.mkdirSync(path47.dirname(file), { recursive: true });
+  fs39.mkdirSync(path50.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
-  fs38.writeFileSync(tmp, content);
-  fs38.renameSync(tmp, file);
+  fs39.writeFileSync(tmp, content);
+  fs39.renameSync(tmp, file);
 }
 function stem(ref) {
-  return path47.basename(ref).replace(PACK_EXT_RE, "");
+  return path50.basename(ref).replace(PACK_EXT_RE, "");
 }
 function imagePacksDir() {
   return process.env.WAIRON_IMAGE_PACKS_DIR ?? "/opt/wairon/packs";
 }
 function probeTier(dir, tier) {
   return hostCore.discoverPacks(dir).map((full) => {
-    const d = probe(full, path47.dirname(full), "global", path47.basename(full));
+    const d = probe(full, path50.dirname(full), "global", path50.basename(full));
     d.tier = tier;
     return d;
   });
@@ -29803,9 +30023,9 @@ function scanGlobalPackProfiles() {
   for (const dir of [hostCore.globalPacksDir(), imagePacksDir()]) {
     for (const full of hostCore.discoverPacks(dir)) {
       try {
-        const loaded = hostCore.loadExtensionPacks([{ ref: full, scope: "global" }], path47.dirname(full));
+        const loaded = hostCore.loadExtensionPacks([{ ref: full, scope: "global" }], path50.dirname(full));
         if (loaded.errors.length) continue;
-        const source = loaded.packNames[0] ?? path47.basename(full);
+        const source = loaded.packNames[0] ?? path50.basename(full);
         for (const [id, def] of Object.entries(loaded.profiles)) out.push({ id, source, family: def.family });
       } catch {
       }
@@ -29857,12 +30077,12 @@ function storeListProjectProfiles() {
   return out;
 }
 function readPackContent(full) {
-  const st = fs38.statSync(full);
-  if (st.isFile()) return fs38.readFileSync(full, "utf8");
+  const st = fs39.statSync(full);
+  if (st.isFile()) return fs39.readFileSync(full, "utf8");
   if (st.isDirectory()) {
     for (const entry of ["pack.yaml", "pack.yml"]) {
-      const p = path47.join(full, entry);
-      if (fs38.existsSync(p) && fs38.statSync(p).isFile()) return fs38.readFileSync(p, "utf8");
+      const p = path50.join(full, entry);
+      if (fs39.existsSync(p) && fs39.statSync(p).isFile()) return fs39.readFileSync(p, "utf8");
     }
   }
   return null;
@@ -29871,9 +30091,9 @@ function storeResolveGlobalPacks(names) {
   const index = /* @__PURE__ */ new Map();
   const indexTier = (dir, tier) => {
     for (const full of hostCore.discoverPacks(dir)) {
-      const manifestName = probe(full, path47.dirname(full), "global", path47.basename(full)).name;
+      const manifestName = probe(full, path50.dirname(full), "global", path50.basename(full)).name;
       const candidate = { full, manifestName, tier };
-      for (const key of [manifestName, stem(full), path47.basename(full)]) {
+      for (const key of [manifestName, stem(full), path50.basename(full)]) {
         if (!index.has(key)) index.set(key, candidate);
       }
     }
@@ -29900,7 +30120,7 @@ function storeInstallGlobalPack(name, content) {
   assertName(name);
   assertDeclarative(content);
   const dir = hostCore.globalPacksDir();
-  const file = path47.join(dir, `${name}.yaml`);
+  const file = path50.join(dir, `${name}.yaml`);
   writeFileAtomic(file, content);
   const descriptor = probe(file, dir, "global", `${name}.yaml`);
   descriptor.tier = "instance";
@@ -29911,7 +30131,7 @@ function storeInstallGlobalPackArchive(archive, name) {
   assertNotCodeArchive(info);
   const packName = name ?? info.name;
   assertName(packName);
-  const dir = path47.join(hostCore.globalPacksDir(), packName);
+  const dir = path50.join(hostCore.globalPacksDir(), packName);
   extractDeclarativeArchive(archive, dir);
   const descriptor = probe(dir, hostCore.globalPacksDir(), "global", packName);
   descriptor.tier = "instance";
@@ -29920,16 +30140,16 @@ function storeInstallGlobalPackArchive(archive, name) {
 function storeRemoveGlobalPack(name) {
   assertName(name);
   const dir = hostCore.globalPacksDir();
-  const match = hostCore.discoverPacks(dir).find((ref) => stem(ref) === name || path47.basename(ref) === name);
+  const match = hostCore.discoverPacks(dir).find((ref) => stem(ref) === name || path50.basename(ref) === name);
   if (!match) {
     const inImage = hostCore.discoverPacks(imagePacksDir()).some(
-      (ref) => stem(ref) === name || path47.basename(ref) === name
+      (ref) => stem(ref) === name || path50.basename(ref) === name
     );
     throw new Error(
       inImage ? `Pack "${name}" is an immutable image-layer pack (WAIRON_IMAGE_PACKS_DIR) and cannot be removed at runtime; rebuild the extension image without it.` : `No server-global instance pack named "${name}".`
     );
   }
-  fs38.rmSync(match, { recursive: true, force: true });
+  fs39.rmSync(match, { recursive: true, force: true });
 }
 function storeListProjectPacks() {
   const root = getProjectRoot();
@@ -29945,7 +30165,7 @@ function storeInstallProjectPack(name, content) {
   assertDeclarative(content);
   const root = getProjectRoot();
   const relRef = `.wai/packs/${name}.yaml`;
-  writeFileAtomic(path47.join(root, ".wai", "packs", `${name}.yaml`), content);
+  writeFileAtomic(path50.join(root, ".wai", "packs", `${name}.yaml`), content);
   const config = loadProjectConfig();
   const packs = config.extensions?.packs ?? [];
   if (!packs.includes(relRef)) {
@@ -29961,7 +30181,7 @@ function storeInstallProjectPackArchive(archive, name) {
   assertName(packName);
   const root = getProjectRoot();
   const relRef = `.wai/packs/${packName}`;
-  extractDeclarativeArchive(archive, path47.join(root, ".wai", "packs", packName));
+  extractDeclarativeArchive(archive, path50.join(root, ".wai", "packs", packName));
   const config = loadProjectConfig();
   const packs = config.extensions?.packs ?? [];
   if (!packs.includes(relRef)) {
@@ -29976,18 +30196,18 @@ function storeRemoveProjectPack(name) {
   const config = loadProjectConfig();
   const packs = config.extensions?.packs ?? [];
   const relRef = `.wai/packs/${name}.yaml`;
-  const match = packs.find((entry) => typeof entry === "string" ? entry === relRef || stem(entry) === name || path47.basename(entry) === name : entry.name === name);
+  const match = packs.find((entry) => typeof entry === "string" ? entry === relRef || stem(entry) === name || path50.basename(entry) === name : entry.name === name);
   if (!match) throw new Error(`Project has no registered pack named "${name}".`);
   config.extensions = { packs: packs.filter((entry) => entry !== match), useGlobalPacks: hostCore.globalPacksEnabled(config) };
   saveProjectConfig(config);
-  const resolved = path47.resolve(root, typeof match === "string" ? match : path47.join(".wai", "packs", match.name));
-  const vendorDir = path47.resolve(root, ".wai", "packs");
-  if (resolved.startsWith(vendorDir + path47.sep)) {
-    fs38.rmSync(resolved, { recursive: true, force: true });
+  const resolved = path50.resolve(root, typeof match === "string" ? match : path50.join(".wai", "packs", match.name));
+  const vendorDir = path50.resolve(root, ".wai", "packs");
+  if (resolved.startsWith(vendorDir + path50.sep)) {
+    fs39.rmSync(resolved, { recursive: true, force: true });
   }
 }
 function readProjectReferences(rootPath) {
-  const projectId = path47.basename(rootPath);
+  const projectId = path50.basename(rootPath);
   const empty = { projectId, packNames: [] };
   try {
     return runWithProjectRoot(rootPath, () => {
@@ -30110,9 +30330,9 @@ function installProjectPackArchive(cfg, credential, project2, archive, name) {
 }
 // src/server/audit.ts
-var fs39 = __toESM(require("fs"));
-var path48 = __toESM(require("path"));
-var crypto9 = __toESM(require("crypto"));
+var fs40 = __toESM(require("fs"));
+var path51 = __toESM(require("path"));
+var crypto10 = __toESM(require("crypto"));
 var LEVEL_ORDER = {
   debug: 0,
   info: 1,
@@ -30134,13 +30354,13 @@ var DEFAULT_AUDIT_POLICY = {
   metadataMode: "redacted"
 };
 function storePath9(dataDir) {
-  return path48.join(dataDir, "audit-events.json");
+  return path51.join(dataDir, "audit-events.json");
 }
 function readEvents(dataDir) {
   const p = storePath9(dataDir);
   let raw;
   try {
-    raw = fs39.readFileSync(p, "utf8");
+    raw = fs40.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read audit store at ${p}: ${e.message}`);
@@ -30155,10 +30375,10 @@ function readEvents(dataDir) {
 }
 function persistEvents(dataDir, events) {
   const p = storePath9(dataDir);
-  fs39.mkdirSync(path48.dirname(p), { recursive: true });
+  fs40.mkdirSync(path51.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs39.writeFileSync(tmp, JSON.stringify(events, null, 2) + "\n");
-  fs39.renameSync(tmp, p);
+  fs40.writeFileSync(tmp, JSON.stringify(events, null, 2) + "\n");
+  fs40.renameSync(tmp, p);
 }
 var SECRET_RE = /Bearer\s+\S/i;
 var LONG_HEX_RE = /[0-9a-fA-F]{32,}/;
@@ -30216,7 +30436,7 @@ var AuditRegistry = class {
     }
     const stamped = {
       ...event,
-      id: event.id && event.id.length > 0 ? event.id : crypto9.randomUUID(),
+      id: event.id && event.id.length > 0 ? event.id : crypto10.randomUUID(),
       timestamp: event.timestamp && event.timestamp.length > 0 ? event.timestamp : (/* @__PURE__ */ new Date()).toISOString(),
       metadata
     };
@@ -30483,10 +30703,10 @@ function unbindRole(cfg, credential, userId, roleId, scopeKind, scopeId) {
 }
 // src/server/identity.ts
-var crypto11 = __toESM(require("crypto"));
+var crypto12 = __toESM(require("crypto"));
 // src/server/idp.ts
-var crypto10 = __toESM(require("crypto"));
+var crypto11 = __toESM(require("crypto"));
 var REQUESTED_SCOPE = "openid email profile";
 var discoveryCache = /* @__PURE__ */ new Map();
 var jwksCache = /* @__PURE__ */ new Map();
@@ -30713,7 +30933,7 @@ function verifyJwtSignature(alg, signingInput, jwk, sigB64url) {
   if (!digest) return false;
   let keyObject;
   try {
-    keyObject = crypto10.createPublicKey({ key: jwk, format: "jwk" });
+    keyObject = crypto11.createPublicKey({ key: jwk, format: "jwk" });
   } catch {
     return false;
   }
@@ -30721,18 +30941,18 @@ function verifyJwtSignature(alg, signingInput, jwk, sigB64url) {
   const sig = Buffer.from(sigB64url, "base64url");
   try {
     if (alg.startsWith("RS")) {
-      return crypto10.verify(digest, data, keyObject, sig);
+      return crypto11.verify(digest, data, keyObject, sig);
     }
     if (alg.startsWith("PS")) {
-      return crypto10.verify(
+      return crypto11.verify(
         digest,
         data,
-        { key: keyObject, padding: crypto10.constants.RSA_PKCS1_PSS_PADDING, saltLength: crypto10.constants.RSA_PSS_SALTLEN_DIGEST },
+        { key: keyObject, padding: crypto11.constants.RSA_PKCS1_PSS_PADDING, saltLength: crypto11.constants.RSA_PSS_SALTLEN_DIGEST },
         sig
       );
     }
     if (alg.startsWith("ES")) {
-      return crypto10.verify(digest, data, { key: keyObject, dsaEncoding: "ieee-p1363" }, sig);
+      return crypto11.verify(digest, data, { key: keyObject, dsaEncoding: "ieee-p1363" }, sig);
     }
   } catch {
     return false;
@@ -30846,8 +31066,8 @@ function assertAllowedRedirectUri(provider, redirectUri) {
 }
 // src/server/policy.ts
-var fs40 = __toESM(require("fs"));
-var path49 = __toESM(require("path"));
+var fs41 = __toESM(require("fs"));
+var path52 = __toESM(require("path"));
 init_fs();
 init_yaml();
 init_loader();
@@ -30866,13 +31086,13 @@ function sendJson(res, status2, body) {
 // src/server/policy.ts
 function packPolicyPath(dataDir) {
-  return path49.join(dataDir, "pack-policy.json");
+  return path52.join(dataDir, "pack-policy.json");
 }
 function getPackPolicyRecord(dataDir) {
   const p = packPolicyPath(dataDir);
   let raw;
   try {
-    raw = fs40.readFileSync(p, "utf8");
+    raw = fs41.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw new Error(`Failed to read pack policy store at ${p}: ${e.message}`);
@@ -30886,14 +31106,14 @@ function getPackPolicyRecord(dataDir) {
 function setPackPolicyRecord(dataDir, policy) {
   const stored = { ...policy, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
   const p = packPolicyPath(dataDir);
-  fs40.mkdirSync(path49.dirname(p), { recursive: true });
+  fs41.mkdirSync(path52.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs40.writeFileSync(tmp, JSON.stringify(stored, null, 2) + "\n");
-  fs40.renameSync(tmp, p);
+  fs41.writeFileSync(tmp, JSON.stringify(stored, null, 2) + "\n");
+  fs41.renameSync(tmp, p);
   return stored;
 }
 function exposurePolicyPath(dataDir) {
-  return path49.join(dataDir, "exposure-policy.json");
+  return path52.join(dataDir, "exposure-policy.json");
 }
 var COMPATIBLE_DEFAULT_EXPOSURE = {
   adminApiMode: "local_only",
@@ -30910,7 +31130,7 @@ function getExposurePolicyRecord(dataDir) {
   const p = exposurePolicyPath(dataDir);
   let raw;
   try {
-    raw = fs40.readFileSync(p, "utf8");
+    raw = fs41.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return null;
     throw new Error(`Failed to read exposure policy store at ${p}: ${e.message}`);
@@ -30923,10 +31143,10 @@ function getExposurePolicyRecord(dataDir) {
 }
 function setExposurePolicyRecord(dataDir, policy) {
   const p = exposurePolicyPath(dataDir);
-  fs40.mkdirSync(path49.dirname(p), { recursive: true });
+  fs41.mkdirSync(path52.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs40.writeFileSync(tmp, JSON.stringify(policy, null, 2) + "\n");
-  fs40.renameSync(tmp, p);
+  fs41.writeFileSync(tmp, JSON.stringify(policy, null, 2) + "\n");
+  fs41.renameSync(tmp, p);
   return policy;
 }
 var PERMISSIVE_DEFAULT_POLICY = {
@@ -30944,7 +31164,7 @@ function effectivePolicy(dataDir) {
   return getPackPolicyRecord(dataDir) ?? PERMISSIVE_DEFAULT_POLICY;
 }
 function identityProvidersPath(dataDir) {
-  return path49.join(dataDir, "identity-providers.json");
+  return path52.join(dataDir, "identity-providers.json");
 }
 function sanitizeIdentityProvider(config) {
   const clean = {
@@ -30968,16 +31188,16 @@ function sanitizeIdentityProvider(config) {
 }
 function writeIdentityProviderRecords(dataDir, records) {
   const p = identityProvidersPath(dataDir);
-  fs40.mkdirSync(path49.dirname(p), { recursive: true });
+  fs41.mkdirSync(path52.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs40.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
-  fs40.renameSync(tmp, p);
+  fs41.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
+  fs41.renameSync(tmp, p);
 }
 function listIdentityProviderRecords(dataDir) {
   const p = identityProvidersPath(dataDir);
   let raw;
   try {
-    raw = fs40.readFileSync(p, "utf8");
+    raw = fs41.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read identity provider store at ${p}: ${e.message}`);
@@ -31604,9 +31824,9 @@ function mintToken(cfg, credential, request) {
   if (owner && owner.status !== "active") {
     throw new ForbiddenError("cannot mint a token for a deactivated user");
   }
-  const token = "wk_" + crypto11.randomBytes(24).toString("hex");
+  const token = "wk_" + crypto12.randomBytes(24).toString("hex");
   const record2 = {
-    id: crypto11.randomBytes(6).toString("hex"),
+    id: crypto12.randomBytes(6).toString("hex"),
     keyHash: hashToken(token),
     projects,
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -31650,10 +31870,10 @@ function mintSelfToken(cfg, credential, projectId, write) {
   if (parsed.mounts.length > 0) {
     assertMintableNarrowingEntry(cfg.dataDir, projectId);
   }
-  const token = "wk_" + crypto11.randomBytes(24).toString("hex");
+  const token = "wk_" + crypto12.randomBytes(24).toString("hex");
   const owner = auditActor(principal);
   const record2 = {
-    id: crypto11.randomBytes(6).toString("hex"),
+    id: crypto12.randomBytes(6).toString("hex"),
     keyHash: hashToken(token),
     projects: [projectId],
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -31768,7 +31988,7 @@ function resolveEnabledProvider(cfg, providerId) {
 }
 async function startSsoLogin(cfg, providerId, redirectUri) {
   const provider = resolveEnabledProvider(cfg, providerId);
-  const nonce = crypto11.randomBytes(16).toString("hex");
+  const nonce = crypto12.randomBytes(16).toString("hex");
   const payload = { providerId, nonce, redirectUri };
   const state = signSsoState(JSON.stringify(payload));
   const endpoints = await resolveEndpoints(provider);
@@ -31819,9 +32039,9 @@ async function completeSsoLogin(cfg, state, code) {
       ...subject.email ? { email: subject.email } : {}
     });
   }
-  const token = "wk_" + crypto11.randomBytes(24).toString("hex");
+  const token = "wk_" + crypto12.randomBytes(24).toString("hex");
   const record2 = {
-    id: crypto11.randomBytes(6).toString("hex"),
+    id: crypto12.randomBytes(6).toString("hex"),
     keyHash: hashToken(token),
     projects: ["*"],
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -31953,17 +32173,17 @@ init_yaml();
 init_loader();
 // src/server/relations.ts
-var fs41 = __toESM(require("fs"));
-var path50 = __toESM(require("path"));
-var crypto12 = __toESM(require("crypto"));
+var fs42 = __toESM(require("fs"));
+var path53 = __toESM(require("path"));
+var crypto13 = __toESM(require("crypto"));
 function storePath10(dataDir) {
-  return path50.join(dataDir, "relations.json");
+  return path53.join(dataDir, "relations.json");
 }
 function readRelations(dataDir) {
   const p = storePath10(dataDir);
   let raw;
   try {
-    raw = fs41.readFileSync(p, "utf8");
+    raw = fs42.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read relation store at ${p}: ${e.message}`);
@@ -31978,10 +32198,10 @@ function readRelations(dataDir) {
 }
 function persistRelations(dataDir, relations) {
   const p = storePath10(dataDir);
-  fs41.mkdirSync(path50.dirname(p), { recursive: true });
+  fs42.mkdirSync(path53.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs41.writeFileSync(tmp, JSON.stringify(relations, null, 2) + "\n");
-  fs41.renameSync(tmp, p);
+  fs42.writeFileSync(tmp, JSON.stringify(relations, null, 2) + "\n");
+  fs42.renameSync(tmp, p);
 }
 var ProjectRelationStore = class {
   constructor(dataDir) {
@@ -32024,7 +32244,7 @@ var ProjectRelationRegistry = class {
     const hasStatus = typeof record2.status === "string" && record2.status.trim().length > 0;
     const stored = {
       ...record2,
-      id: hasId ? record2.id : crypto12.randomUUID(),
+      id: hasId ? record2.id : crypto13.randomUUID(),
       status: hasStatus ? record2.status : "active"
     };
     const relations = this.store.all();
@@ -32091,16 +32311,16 @@ function listProjectRelations(dataDir, sourceProjectId, targetProjectId, status2
 }
 // src/server/surfaces.ts
-var fs42 = __toESM(require("fs"));
-var path51 = __toESM(require("path"));
+var fs43 = __toESM(require("fs"));
+var path54 = __toESM(require("path"));
 function storePath11(dataDir) {
-  return path51.join(dataDir, "public-surfaces.json");
+  return path54.join(dataDir, "public-surfaces.json");
 }
 function readSnapshots(dataDir) {
   const p = storePath11(dataDir);
   let raw;
   try {
-    raw = fs42.readFileSync(p, "utf8");
+    raw = fs43.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read public surface store at ${p}: ${e.message}`);
@@ -32115,10 +32335,10 @@ function readSnapshots(dataDir) {
 }
 function persistSnapshots(dataDir, snapshots) {
   const p = storePath11(dataDir);
-  fs42.mkdirSync(path51.dirname(p), { recursive: true });
+  fs43.mkdirSync(path54.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs42.writeFileSync(tmp, JSON.stringify(snapshots, null, 2) + "\n");
-  fs42.renameSync(tmp, p);
+  fs43.writeFileSync(tmp, JSON.stringify(snapshots, null, 2) + "\n");
+  fs43.renameSync(tmp, p);
 }
 var PublicSurfaceStore = class {
   constructor(dataDir) {
@@ -32261,12 +32481,12 @@ function resolveVisibility(observerProjectId, units, placements) {
   const best = /* @__PURE__ */ new Map();
   for (const placement of placements) {
     if (placement.projectId === observerProjectId) continue;
-    const path64 = chainOf(placement.unitId, unitById);
-    if (!path64.length) continue;
-    const closedOk = path64.every((u) => effectivePosture(u, unitById) !== "closed" || observerInside(u.id) || grantedTo(u));
+    const path67 = chainOf(placement.unitId, unitById);
+    if (!path67.length) continue;
+    const closedOk = path67.every((u) => effectivePosture(u, unitById) !== "closed" || observerInside(u.id) || grantedTo(u));
     if (!closedOk) continue;
-    const crossTenant = !tenantRoots.has(path64[path64.length - 1].id);
-    if (crossTenant && !path64.some(grantedTo)) continue;
+    const crossTenant = !tenantRoots.has(path67[path67.length - 1].id);
+    if (crossTenant && !path67.some(grantedTo)) continue;
     if (crossTenant && directUnits.length === 0) continue;
     const distance = crossTenant ? "partner" : sameBranch(placement.unitId) ? "department" : "instance";
     const existing = best.get(placement.projectId);
@@ -32912,8 +33132,8 @@ function handleLandscapeRequest(cfg, credential, req, res, body, url) {
 }
 // src/server/migration.ts
-var fs43 = __toESM(require("fs"));
-var path52 = __toESM(require("path"));
+var fs44 = __toESM(require("fs"));
+var path55 = __toESM(require("path"));
 var LEGACY_CAPABILITY_MAP = {
   "mcp:read": "project:read",
   "operations:read": "project:read",
@@ -32945,16 +33165,16 @@ function scopeOf(grant) {
 }
 function readRaw(file) {
   try {
-    return JSON.parse(fs43.readFileSync(file, "utf8"));
+    return JSON.parse(fs44.readFileSync(file, "utf8"));
   } catch {
     return null;
   }
 }
 function writeRaw(file, value) {
-  fs43.mkdirSync(path52.dirname(file), { recursive: true });
+  fs44.mkdirSync(path55.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
-  fs43.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n");
-  fs43.renameSync(tmp, file);
+  fs44.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n");
+  fs44.renameSync(tmp, file);
 }
 function slugify(name) {
   return name.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "") || "unit";
@@ -32988,13 +33208,13 @@ function migratePermissionModel(dataDir, apply) {
     findings.push({ area, detail });
   };
   const grid = readRaw(
-    path52.join(dataDir, "permissions.json")
+    path55.join(dataDir, "permissions.json")
   ) ?? [];
   if (!getInstanceIdentity(dataDir)) {
     found("instance", "instance identity is not seeded \u2014 the built-in admin/dev subjects have no persisted UUIDs");
     if (apply) ensureInstanceIdentity(dataDir);
   }
-  const orgPath = path52.join(dataDir, "organization.json");
+  const orgPath = path55.join(dataDir, "organization.json");
   const org = readRaw(orgPath);
   if (org?.units?.length) {
     const units = org.units;
@@ -33048,7 +33268,7 @@ function migratePermissionModel(dataDir, apply) {
       found("units", `${remap.length} unit id(s) would be remapped across placements, exposeTo, assignments, and users`);
     }
   }
-  const usersPath = path52.join(dataDir, "users.json");
+  const usersPath = path55.join(dataDir, "users.json");
   const users = readRaw(usersPath);
   if (users) {
     let changed = false;
@@ -33075,7 +33295,7 @@ function migratePermissionModel(dataDir, apply) {
     }
     if (apply && changed) writeRaw(usersPath, users);
   }
-  const keysPath = path52.join(dataDir, "auth", "credentials.json");
+  const keysPath = path55.join(dataDir, "auth", "credentials.json");
   const keys = readRaw(keysPath);
   if (keys) {
     let changed = false;
@@ -33125,7 +33345,7 @@ function migratePermissionModel(dataDir, apply) {
     }
     if (apply && changed) writeRaw(keysPath, keys);
   }
-  const sessionsPath = path52.join(dataDir, "web-sessions.json");
+  const sessionsPath = path55.join(dataDir, "web-sessions.json");
   const sessions = readRaw(sessionsPath);
   if (sessions) {
     let changed = false;
@@ -33204,25 +33424,25 @@ function migratePermissionModel(dataDir, apply) {
 // src/server/http.ts
 var http2 = __toESM(require("http"));
-var fs51 = __toESM(require("fs"));
-var path60 = __toESM(require("path"));
+var fs52 = __toESM(require("fs"));
+var path63 = __toESM(require("path"));
 // src/server/request.ts
 var import_streamableHttp = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
 init_fs();
 // src/server/approvals.ts
-var fs44 = __toESM(require("fs"));
-var path53 = __toESM(require("path"));
-var crypto13 = __toESM(require("crypto"));
+var fs45 = __toESM(require("fs"));
+var path56 = __toESM(require("path"));
+var crypto14 = __toESM(require("crypto"));
 function storePath12(dataDir) {
-  return path53.join(dataDir, "approvals.json");
+  return path56.join(dataDir, "approvals.json");
 }
 function readRequests(dataDir) {
   const p = storePath12(dataDir);
   let raw;
   try {
-    raw = fs44.readFileSync(p, "utf8");
+    raw = fs45.readFileSync(p, "utf8");
   } catch (e) {
     if (e.code === "ENOENT") return [];
     throw new Error(`Failed to read approval store at ${p}: ${e.message}`);
@@ -33237,10 +33457,10 @@ function readRequests(dataDir) {
 }
 function persistRequests(dataDir, requests) {
   const p = storePath12(dataDir);
-  fs44.mkdirSync(path53.dirname(p), { recursive: true });
+  fs45.mkdirSync(path56.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
-  fs44.writeFileSync(tmp, JSON.stringify(requests, null, 2) + "\n");
-  fs44.renameSync(tmp, p);
+  fs45.writeFileSync(tmp, JSON.stringify(requests, null, 2) + "\n");
+  fs45.renameSync(tmp, p);
 }
 var SECRET_RE2 = /Bearer\s+\S/i;
 var LONG_HEX_RE2 = /[0-9a-fA-F]{32,}/;
@@ -33288,7 +33508,7 @@ var ApprovalRegistry = class {
     }
     const stored = {
       ...request,
-      id: crypto13.randomUUID(),
+      id: crypto14.randomUUID(),
       createdAt: (/* @__PURE__ */ new Date()).toISOString(),
       status: "pending"
     };
@@ -33597,23 +33817,6 @@ function lockProject2(cfg, credential, projectId, subproject) {
     }
   });
 }
-function promoteProject2(cfg, credential, projectId, subproject) {
-  return lifecycleAction(cfg, credential, projectId, {
-    action: "project:promote",
-    verb: "Promote",
-    noun: "promotion",
-    subproject,
-    execute: () => {
-      const promo = executeApprovedPromote(cfg, projectId, subproject);
-      return {
-        status: "completed",
-        action: "project:promote",
-        summary: `Promotion of project "${projectId}"${subprojectSuffix(subproject)}: ${promo.status} \u2014 ${promo.message}`,
-        promote: promo
-      };
-    }
-  });
-}
 function subprojectSuffix(subproject) {
   return subproject ? ` subproject "${subproject}"` : "";
 }
@@ -33737,11 +33940,6 @@ function executeApproved(cfg, req) {
       const lock = executeApprovedLock(cfg, req.projectId ?? "", scope);
       return `Locked project "${req.projectId}"${subprojectSuffix(scope)} (status: ${lock.status}).`;
     }
-    case "project:promote": {
-      const scope = readSubprojectScope(req);
-      const promo = executeApprovedPromote(cfg, req.projectId ?? "", scope);
-      return `Promotion of project "${req.projectId}"${subprojectSuffix(scope)}: ${promo.status} \u2014 ${promo.message}`;
-    }
     default:
       throw new Error(`Unsupported approval kind "${req.kind}".`);
   }
@@ -33783,7 +33981,7 @@ async function awaitApproval(cfg, credential, requestId, timeoutSeconds) {
   let current2 = req;
   while (current2.status === "pending" && Date.now() < deadline) {
     const remaining = deadline - Date.now();
-    await new Promise((resolve26) => setTimeout(resolve26, Math.min(AWAIT_POLL_INTERVAL_MS, remaining)));
+    await new Promise((resolve27) => setTimeout(resolve27, Math.min(AWAIT_POLL_INTERVAL_MS, remaining)));
     expirePendingApprovals(cfg.dataDir, (/* @__PURE__ */ new Date()).toISOString());
     current2 = getApprovalRequestById(cfg.dataDir, requestId) ?? current2;
   }
@@ -34051,12 +34249,12 @@ function handleOperationsRequest(cfg, credential, req, res, url) {
 }
 // src/server/gitbacking.ts
-var fs45 = __toESM(require("fs"));
-var path54 = __toESM(require("path"));
-var crypto14 = __toESM(require("crypto"));
+var fs46 = __toESM(require("fs"));
+var path57 = __toESM(require("path"));
+var crypto15 = __toESM(require("crypto"));
 var import_child_process4 = require("child_process");
 function storePath13(dataDir) {
-  return path54.join(dataDir, "git-backing.json");
+  return path57.join(dataDir, "git-backing.json");
 }
 var GitBackingStore = class {
   constructor(dataDir) {
@@ -34068,7 +34266,7 @@ var GitBackingStore = class {
     const p = storePath13(this.dataDir);
     let raw;
     try {
-      raw = fs45.readFileSync(p, "utf8");
+      raw = fs46.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return [];
       throw new Error(`Cannot read git-backing store at ${p}: ${err.message}`);
@@ -34087,10 +34285,10 @@ var GitBackingStore = class {
   /** Swap the persisted collection wholesale via write-temp-then-rename. */
   replaceAll(bindings) {
     const p = storePath13(this.dataDir);
-    fs45.mkdirSync(path54.dirname(p), { recursive: true });
+    fs46.mkdirSync(path57.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
-    fs45.writeFileSync(tmp, JSON.stringify(bindings, null, 2) + "\n");
-    fs45.renameSync(tmp, p);
+    fs46.writeFileSync(tmp, JSON.stringify(bindings, null, 2) + "\n");
+    fs46.renameSync(tmp, p);
   }
 };
 var GitBackingRegistry = class {
@@ -34109,7 +34307,7 @@ var GitBackingRegistry = class {
     const bindings = this.store.load();
     const stored = {
       ...binding,
-      id: binding.id || crypto14.randomUUID(),
+      id: binding.id || crypto15.randomUUID(),
       createdAt: binding.createdAt || (/* @__PURE__ */ new Date()).toISOString()
     };
     const sameScope = (b) => b.scopeKind === stored.scopeKind && (b.scopeId ?? "") === (stored.scopeId ?? "");
@@ -34195,8 +34393,8 @@ function checkoutBranch(workdir, branch) {
   }
 }
 function cloneOrOpen(remote, branch, workdir, credentialRef) {
-  if (!fs45.existsSync(path54.join(workdir, ".git"))) {
-    fs45.mkdirSync(workdir, { recursive: true });
+  if (!fs46.existsSync(path57.join(workdir, ".git"))) {
+    fs46.mkdirSync(workdir, { recursive: true });
     git2(["clone", authRemote2(remote, credentialRef), "."], workdir);
     git2(["config", "user.name", process.env["WAIRON_GIT_NAME"] || "wairon-bot"], workdir);
     git2(["config", "user.email", process.env["WAIRON_GIT_EMAIL"] || "wairon-bot@localhost"], workdir);
@@ -34208,11 +34406,11 @@ function cloneOrOpen(remote, branch, workdir, credentialRef) {
   return workdir;
 }
 function mirrorTree(sourceDir, targetDir) {
-  fs45.rmSync(targetDir, { recursive: true, force: true });
-  const stat = fs45.statSync(sourceDir, { throwIfNoEntry: false });
+  fs46.rmSync(targetDir, { recursive: true, force: true });
+  const stat = fs46.statSync(sourceDir, { throwIfNoEntry: false });
   if (!stat) return;
-  fs45.mkdirSync(path54.dirname(targetDir), { recursive: true });
-  fs45.cpSync(sourceDir, targetDir, { recursive: true });
+  fs46.mkdirSync(path57.dirname(targetDir), { recursive: true });
+  fs46.cpSync(sourceDir, targetDir, { recursive: true });
 }
 function commitAndPush(workdir, message) {
   git2(["add", "-A"], workdir);
@@ -34334,7 +34532,7 @@ function unbindScope(cfg, credential, bindingId) {
   tryAppendAudit7(cfg, buildAuditEvent6(principal, "git.backing.unbind", "security", bindingId));
 }
 function runMirrorSync(cfg, binding) {
-  const workdir = path54.join(cfg.dataDir, "git-backing", binding.id);
+  const workdir = path57.join(cfg.dataDir, "git-backing", binding.id);
   cloneOrOpen(binding.remote, binding.branch, workdir, binding.credentialRef);
   if (binding.scopeKind === "unit") {
     const units = listOrganizationUnits(cfg.dataDir);
@@ -34342,23 +34540,23 @@ function runMirrorSync(cfg, binding) {
     const placedIds = new Set(
       listProjectPlacements(cfg.dataDir).filter((p) => subtree.has(p.unitId)).map((p) => p.projectId)
     );
-    const projectsDir = path54.join(workdir, "projects");
-    fs45.rmSync(projectsDir, { recursive: true, force: true });
+    const projectsDir = path57.join(workdir, "projects");
+    fs46.rmSync(projectsDir, { recursive: true, force: true });
     for (const rec of listProjectRecords(cfg.dataDir)) {
       if (!placedIds.has(rec.id)) continue;
-      mirrorTree(path54.join(rec.rootPath, ".wai"), path54.join(projectsDir, rec.id, ".wai"));
+      mirrorTree(path57.join(rec.rootPath, ".wai"), path57.join(projectsDir, rec.id, ".wai"));
     }
   } else {
-    const instanceDir = path54.join(workdir, "instance");
-    fs45.rmSync(instanceDir, { recursive: true, force: true });
+    const instanceDir = path57.join(workdir, "instance");
+    fs46.rmSync(instanceDir, { recursive: true, force: true });
     const files = binding.includeCredentials ? INSTANCE_STRUCTURE_FILES : INSTANCE_STRUCTURE_FILES.filter((rel2) => rel2 !== "auth/credentials.json");
     for (const rel2 of files) {
-      mirrorTree(path54.join(cfg.dataDir, rel2), path54.join(instanceDir, rel2));
+      mirrorTree(path57.join(cfg.dataDir, rel2), path57.join(instanceDir, rel2));
     }
-    const projectsDir = path54.join(workdir, "projects");
-    fs45.rmSync(projectsDir, { recursive: true, force: true });
+    const projectsDir = path57.join(workdir, "projects");
+    fs46.rmSync(projectsDir, { recursive: true, force: true });
     for (const rec of listProjectRecords(cfg.dataDir)) {
-      mirrorTree(path54.join(rec.rootPath, ".wai"), path54.join(projectsDir, rec.id, ".wai"));
+      mirrorTree(path57.join(rec.rootPath, ".wai"), path57.join(projectsDir, rec.id, ".wai"));
     }
   }
   const published = commitAndPush(
@@ -34504,7 +34702,7 @@ function setExposurePolicy2(cfg, credential, exposure) {
 // src/server/websocket.ts
 var import_events = require("events");
-var crypto15 = __toESM(require("crypto"));
+var crypto16 = __toESM(require("crypto"));
 var WS_GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
 var MAX_PAYLOAD = 1 << 20;
 var OP_CONTINUATION = 0;
@@ -34518,7 +34716,7 @@ function isWebSocketUpgrade(req) {
 function acceptWebSocket(req, socket) {
   const key = req.headers["sec-websocket-key"];
   if (!isWebSocketUpgrade(req) || typeof key !== "string") return null;
-  const accept = crypto15.createHash("sha1").update(key + WS_GUID).digest("base64");
+  const accept = crypto16.createHash("sha1").update(key + WS_GUID).digest("base64");
   socket.write(
     `HTTP/1.1 101 Switching Protocols\r
 Upgrade: websocket\r
@@ -34668,9 +34866,9 @@ function encodeFrame(opcode, payload) {
 }
 // src/server/web.ts
-var crypto20 = __toESM(require("crypto"));
-var fs50 = __toESM(require("fs"));
-var path59 = __toESM(require("path"));
+var crypto21 = __toESM(require("crypto"));
+var fs51 = __toESM(require("fs"));
+var path62 = __toESM(require("path"));
 // src/server/webadmin.ts
 function listUsers3(cfg, sessionId, project2) {
@@ -34912,26 +35110,23 @@ function createProject2(cfg, sessionId, id, unitId, profileSelection) {
 function lockProject3(cfg, sessionId, projectId) {
   return lockProject(cfg, sessionId, projectId);
 }
-function promoteProject3(cfg, sessionId, projectId) {
-  return promoteProject(cfg, sessionId, projectId);
-}
 function destroyProject2(cfg, sessionId, id) {
   destroyProject(cfg, sessionId, id);
 }
 // src/server/shareadmin.ts
-var crypto19 = __toESM(require("crypto"));
+var crypto20 = __toESM(require("crypto"));
 // src/server/sharesnapshots.ts
-var fs46 = __toESM(require("fs"));
-var path55 = __toESM(require("path"));
-var crypto16 = __toESM(require("crypto"));
+var fs47 = __toESM(require("fs"));
+var path58 = __toESM(require("path"));
+var crypto17 = __toESM(require("crypto"));
 init_fs();
 function snapshotDir(dataDir) {
-  return path55.join(dataDir, "share-snapshots");
+  return path58.join(dataDir, "share-snapshots");
 }
 function snapshotPath(dataDir, id) {
-  return path55.join(snapshotDir(dataDir), `${id}.json`);
+  return path58.join(snapshotDir(dataDir), `${id}.json`);
 }
 var ShareSnapshotStore = class {
   constructor(dataDir) {
@@ -34939,17 +35134,17 @@ var ShareSnapshotStore = class {
   }
   write(snapshot) {
     const p = snapshotPath(this.dataDir, snapshot.id);
-    if (fs46.existsSync(p)) return;
-    fs46.mkdirSync(path55.dirname(p), { recursive: true });
+    if (fs47.existsSync(p)) return;
+    fs47.mkdirSync(path58.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
-    fs46.writeFileSync(tmp, JSON.stringify(snapshot, null, 2) + "\n");
-    fs46.renameSync(tmp, p);
+    fs47.writeFileSync(tmp, JSON.stringify(snapshot, null, 2) + "\n");
+    fs47.renameSync(tmp, p);
   }
   read(snapshotId) {
     const p = snapshotPath(this.dataDir, snapshotId);
     let raw;
     try {
-      raw = fs46.readFileSync(p, "utf8");
+      raw = fs47.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return null;
       throw new Error(`Cannot read share snapshot at ${p}: ${err.message}`);
@@ -34968,7 +35163,7 @@ var ShareSnapshotRegistry = class {
   put(snapshot) {
     const stored = {
       ...snapshot,
-      id: snapshot.id || crypto16.randomUUID(),
+      id: snapshot.id || crypto17.randomUUID(),
       capturedAt: snapshot.capturedAt || (/* @__PURE__ */ new Date()).toISOString()
     };
     this.store.write(stored);
@@ -35041,11 +35236,11 @@ function captureSnapshot(dataDir, principal, projectId, view, artifacts) {
 }
 // src/server/sharelinks.ts
-var fs47 = __toESM(require("fs"));
-var path56 = __toESM(require("path"));
-var crypto17 = __toESM(require("crypto"));
+var fs48 = __toESM(require("fs"));
+var path59 = __toESM(require("path"));
+var crypto18 = __toESM(require("crypto"));
 function storePath14(dataDir) {
-  return path56.join(dataDir, "share-links.json");
+  return path59.join(dataDir, "share-links.json");
 }
 var ShareLinkStore = class {
   constructor(dataDir) {
@@ -35055,7 +35250,7 @@ var ShareLinkStore = class {
     const p = storePath14(this.dataDir);
     let raw;
     try {
-      raw = fs47.readFileSync(p, "utf8");
+      raw = fs48.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return [];
       throw new Error(`Cannot read share-link store at ${p}: ${err.message}`);
@@ -35073,10 +35268,10 @@ var ShareLinkStore = class {
   }
   replaceAll(links) {
     const p = storePath14(this.dataDir);
-    fs47.mkdirSync(path56.dirname(p), { recursive: true });
+    fs48.mkdirSync(path59.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
-    fs47.writeFileSync(tmp, JSON.stringify(links, null, 2) + "\n");
-    fs47.renameSync(tmp, p);
+    fs48.writeFileSync(tmp, JSON.stringify(links, null, 2) + "\n");
+    fs48.renameSync(tmp, p);
   }
 };
 var ShareLinkRegistry = class {
@@ -35087,7 +35282,7 @@ var ShareLinkRegistry = class {
     const links = this.store.load();
     const stored = {
       ...link,
-      id: link.id || crypto17.randomUUID(),
+      id: link.id || crypto18.randomUUID(),
       createdAt: link.createdAt || (/* @__PURE__ */ new Date()).toISOString()
     };
     this.store.replaceAll([...links, stored]);
@@ -35144,11 +35339,11 @@ function listProjectLinks(dataDir, projectId) {
 }
 // src/server/shareaccesslog.ts
-var fs48 = __toESM(require("fs"));
-var path57 = __toESM(require("path"));
-var crypto18 = __toESM(require("crypto"));
+var fs49 = __toESM(require("fs"));
+var path60 = __toESM(require("path"));
+var crypto19 = __toESM(require("crypto"));
 function storePath15(dataDir) {
-  return path57.join(dataDir, "share-access.json");
+  return path60.join(dataDir, "share-access.json");
 }
 var ShareAccessStore = class {
   constructor(dataDir) {
@@ -35158,7 +35353,7 @@ var ShareAccessStore = class {
     const p = storePath15(this.dataDir);
     let raw;
     try {
-      raw = fs48.readFileSync(p, "utf8");
+      raw = fs49.readFileSync(p, "utf8");
     } catch (err) {
       if (err.code === "ENOENT") return [];
       throw new Error(`Cannot read share-access store at ${p}: ${err.message}`);
@@ -35176,11 +35371,11 @@ var ShareAccessStore = class {
   }
   append(entry) {
     const p = storePath15(this.dataDir);
-    fs48.mkdirSync(path57.dirname(p), { recursive: true });
+    fs49.mkdirSync(path60.dirname(p), { recursive: true });
     const next = [...this.load(), entry];
     const tmp = `${p}.tmp`;
-    fs48.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n");
-    fs48.renameSync(tmp, p);
+    fs49.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n");
+    fs49.renameSync(tmp, p);
   }
 };
 var ShareAccessRegistry = class {
@@ -35190,7 +35385,7 @@ var ShareAccessRegistry = class {
   append(entry) {
     const stored = {
       ...entry,
-      id: entry.id || crypto18.randomUUID(),
+      id: entry.id || crypto19.randomUUID(),
       at: entry.at || (/* @__PURE__ */ new Date()).toISOString()
     };
     this.store.append(stored);
@@ -35254,7 +35449,7 @@ function createShareLink(cfg, sessionId, input) {
   const wantsOpenapi = !!input.allowDownloadOpenapi || (input.artifacts ?? []).includes("openapi");
   const artifacts = artifactsFor({ allowDownloadOpenapi: !!input.allowDownloadOpenapi }, wantsOpenapi);
   const snapshot = putSnapshot(cfg.dataDir, captureSnapshot(cfg.dataDir, principal, input.projectId, input.view, artifacts));
-  const token = crypto19.randomBytes(32).toString("base64url");
+  const token = crypto20.randomBytes(32).toString("base64url");
   const link = createLink(cfg.dataDir, {
     id: "",
     tokenHash: hashToken(token),
@@ -35331,16 +35526,16 @@ function getShareAccessLog(cfg, sessionId, linkId, limit) {
 init_fs();
 // src/server/swagger.ts
-var fs49 = __toESM(require("fs"));
-var path58 = __toESM(require("path"));
+var fs50 = __toESM(require("fs"));
+var path61 = __toESM(require("path"));
 var cache;
 function loadAssets() {
   if (cache !== void 0) return cache;
   try {
-    const dir = path58.dirname(require.resolve("swagger-ui-dist/package.json"));
+    const dir = path61.dirname(require.resolve("swagger-ui-dist/package.json"));
     cache = {
-      css: fs49.readFileSync(path58.join(dir, "swagger-ui.css"), "utf8"),
-      js: fs49.readFileSync(path58.join(dir, "swagger-ui-bundle.js"), "utf8")
+      css: fs50.readFileSync(path61.join(dir, "swagger-ui.css"), "utf8"),
+      js: fs50.readFileSync(path61.join(dir, "swagger-ui-bundle.js"), "utf8")
     };
   } catch {
     cache = null;
@@ -35380,7 +35575,7 @@ function getLoginOptions(cfg) {
 async function startSignIn(cfg, providerId, redirectUri) {
   const provider = resolveEnabledProvider(cfg, providerId);
   assertAllowedRedirectUri(provider, redirectUri);
-  const nonce = crypto20.randomBytes(16).toString("hex");
+  const nonce = crypto21.randomBytes(16).toString("hex");
   const payload = { providerId, nonce, redirectUri };
   const state = signSsoState(JSON.stringify(payload));
   const endpoints = await resolveEndpoints(provider);
@@ -35732,20 +35927,20 @@ function clearNonceCookie(secure) {
 }
 function nonceMatches(a, b) {
   if (!a || !b || a.length !== b.length) return false;
-  return crypto20.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+  return crypto21.timingSafeEqual(Buffer.from(a), Buffer.from(b));
 }
 function loadReactBundle() {
   const candidates = [
-    path59.resolve(__dirname, "webapp.html"),
+    path62.resolve(__dirname, "webapp.html"),
     // dist/index.js -> dist/webapp.html
-    path59.resolve(__dirname, "..", "webapp.html"),
+    path62.resolve(__dirname, "..", "webapp.html"),
     // dist/cli/index.js -> dist/webapp.html
-    path59.resolve(__dirname, "..", "..", "web", "dist", "index.html")
+    path62.resolve(__dirname, "..", "..", "web", "dist", "index.html")
     // tsx dev: src/server -> web/dist
   ];
   for (const candidate of candidates) {
     try {
-      if (fs50.existsSync(candidate)) return fs50.readFileSync(candidate, "utf8");
+      if (fs51.existsSync(candidate)) return fs51.readFileSync(candidate, "utf8");
     } catch {
     }
   }
@@ -37432,9 +37627,6 @@ details.adv summary { cursor:pointer; color:var(--dim); font-size:12px; margin-b
       Array.prototype.forEach.call(host.querySelectorAll('[data-lock]'), function (b) {
         b.addEventListener('click', function () { projectAction('/web/projects/lock', { projectId: b.getAttribute('data-lock') }, b, 'Locking\u2026', 'Lock'); });
       });
-      Array.prototype.forEach.call(host.querySelectorAll('[data-promote]'), function (b) {
-        b.addEventListener('click', function () { projectAction('/web/projects/promote', { projectId: b.getAttribute('data-promote') }, b, 'Promoting\u2026', 'Promote'); });
-      });
       Array.prototype.forEach.call(host.querySelectorAll('[data-destroy]'), function (b) {
         b.addEventListener('click', function () {
           if (!confirm('Destroy project "' + b.getAttribute('data-destroy') + '"? This removes its entire spec tree.')) return;
@@ -37738,9 +37930,6 @@ function projectCreate(cfg, sessionId, body, res) {
 function projectLock(cfg, sessionId, body, res) {
   sendJson(res, 200, lockProject3(cfg, sessionId, String(body?.projectId ?? "")));
 }
-function projectPromote(cfg, sessionId, body, res) {
-  sendJson(res, 200, promoteProject3(cfg, sessionId, String(body?.projectId ?? "")));
-}
 function projectDestroy(cfg, sessionId, body, res) {
   destroyProject2(cfg, sessionId, String(body?.id ?? ""));
   sendJson(res, 200, { ok: true });
@@ -38020,9 +38209,6 @@ async function handleWebRequest(cfg, req, res, body, url, ctx) {
       if (req.method === "POST" && parts.length === 3 && parts[2] === "lock") {
         return projectLock(cfg, sessionId, body, res);
       }
-      if (req.method === "POST" && parts.length === 3 && parts[2] === "promote") {
-        return projectPromote(cfg, sessionId, body, res);
-      }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "destroy") {
         return projectDestroy(cfg, sessionId, body, res);
       }
@@ -38277,8 +38463,8 @@ var RealtimeHub = class {
    *  complete the handshake, and register the connection. A bad path or session
    *  destroys the socket. */
   handleUpgrade(cfg, req, socket) {
-    const path64 = (req.url ?? "/").split("?")[0];
-    if (path64 !== REALTIME_PATH || !isWebSocketUpgrade(req)) {
+    const path67 = (req.url ?? "/").split("?")[0];
+    if (path67 !== REALTIME_PATH || !isWebSocketUpgrade(req)) {
       socket.destroy();
       return;
     }
@@ -38455,7 +38641,6 @@ function auditToolCall(dataDir, principal, projectId, body, outcome, subproject)
 var PROJECT_LIFECYCLE_TOOLS = /* @__PURE__ */ new Set([
   "sdd_host_initialize_project",
   "sdd_host_lock_project",
-  "sdd_host_promote_project",
   "sdd_host_get_approval_status",
   "sdd_host_await_approval"
 ]);
@@ -38513,7 +38698,6 @@ function requiredDataPlaneCapability(toolName) {
 var MUTATING_HOST_TOOLS = /* @__PURE__ */ new Set([
   "sdd_host_initialize_project",
   "sdd_host_lock_project",
-  "sdd_host_promote_project",
   "sdd_host_await_approval",
   // a decided approval may have executed the action
   "sdd_host_policy_reconcile"
@@ -38583,9 +38767,6 @@ async function dispatchProjectLifecycleTool(cfg, credential, projectId, body, su
       case "sdd_host_lock_project":
         value = lockProject2(cfg, credential, projectId, subproject);
         break;
-      case "sdd_host_promote_project":
-        value = promoteProject2(cfg, credential, projectId, subproject);
-        break;
       case "sdd_host_await_approval":
         value = await awaitApproval(
           cfg,
@@ -39051,7 +39232,6 @@ var WEB_MUTATION_PATHS = /* @__PURE__ */ new Set([
   "/web/tokens/revoke",
   "/web/projects",
   "/web/projects/lock",
-  "/web/projects/promote",
   "/web/projects/destroy"
 ]);
 function routeData(cfg, req, res) {
@@ -39063,7 +39243,7 @@ function routeData(cfg, req, res) {
   if (req.method === "GET" && url.pathname === "/readyz") {
     let ready = false;
     try {
-      fs51.accessSync(cfg.dataDir, fs51.constants.W_OK);
+      fs52.accessSync(cfg.dataDir, fs52.constants.W_OK);
       ready = true;
     } catch {
     }
@@ -39163,7 +39343,7 @@ function routeData(cfg, req, res) {
 }
 function readExposurePolicyFile(dataDir) {
   try {
-    const raw = fs51.readFileSync(path60.join(dataDir, "exposure-policy.json"), "utf8");
+    const raw = fs52.readFileSync(path63.join(dataDir, "exposure-policy.json"), "utf8");
     const parsed = JSON.parse(raw);
     return parsed && typeof parsed === "object" ? parsed : void 0;
   } catch {
@@ -39212,7 +39392,6 @@ async function routeAdmin(cfg, req, res) {
         return sendJson(res, 200, { ok: true });
       }
       if (req.method === "POST" && parts.length === 4 && parts[3] === "lock") return sendJson(res, 200, lockProject(cfg, cred, parts[2]));
-      if (req.method === "POST" && parts.length === 4 && parts[3] === "promote") return sendJson(res, 200, promoteProject(cfg, cred, parts[2]));
       if (req.method === "POST" && parts.length === 4 && parts[3] === "git") return sendJson(res, 201, enableGit(cfg, cred, parts[2], body.remote, body.branch ?? "main", body.pat));
       if (req.method === "DELETE" && parts.length === 4 && parts[3] === "git") {
         disableGit(cfg, cred, parts[2]);
@@ -39867,9 +40046,9 @@ function seedDemoTree() {
 // src/commands/host.ts
 function resolveHostConfig(options) {
-  const dataDir = options.dataDir || process.env["WAIRON_DATA_DIR"] || path61.join(os11.homedir(), ".wairon", "data");
+  const dataDir = options.dataDir || process.env["WAIRON_DATA_DIR"] || path64.join(os12.homedir(), ".wairon", "data");
   if (!process.env["WAIRON_PACKS_DIR"]) {
-    process.env["WAIRON_PACKS_DIR"] = path61.join(dataDir, "packs");
+    process.env["WAIRON_PACKS_DIR"] = path64.join(dataDir, "packs");
   }
   const cfg = {
     host: options.host || "0.0.0.0",
@@ -39970,11 +40149,11 @@ async function runServe(options = {}) {
   logger.info(`  data dir:    ${import_chalk17.default.gray(cfg.dataDir)}`);
   logger.blank();
   logger.info("Press Ctrl+C to stop.");
-  await new Promise((resolve26) => {
+  await new Promise((resolve27) => {
     const shutdown = () => {
       logger.info("Shutting down\u2026");
       handle.close();
-      resolve26();
+      resolve27();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -39994,14 +40173,14 @@ function openBrowser(url) {
 }
 async function runDev(options = {}) {
   const cwd = process.cwd();
-  if (!fs52.existsSync(path61.join(cwd, ".wai"))) {
+  if (!fs53.existsSync(path64.join(cwd, ".wai"))) {
     throw new WaironError(
       "No .wai/ found in the current directory. Run `wairon dev` from a wairon project root (or run `wairon init` first)."
     );
   }
-  const hash = crypto21.createHash("sha256").update(cwd).digest("hex").slice(0, 16);
-  const dataDir = path61.join(os11.tmpdir(), "wairon-dev", hash);
-  fs52.mkdirSync(dataDir, { recursive: true });
+  const hash = crypto22.createHash("sha256").update(cwd).digest("hex").slice(0, 16);
+  const dataDir = path64.join(os12.tmpdir(), "wairon-dev", hash);
+  fs53.mkdirSync(dataDir, { recursive: true });
   registerLocalDevProject(dataDir, "local", cwd);
   const port = options.port ? Number(options.port) : 8080;
   const exposurePolicy = {
@@ -40039,11 +40218,11 @@ async function runDev(options = {}) {
   logger.blank();
   logger.info("An agent edits specs; refresh the page to see the live graph. Press Ctrl+C to stop.");
   if (options.open) openBrowser(url);
-  await new Promise((resolve26) => {
+  await new Promise((resolve27) => {
     const shutdown = () => {
       logger.info("Shutting down\u2026");
       handle.close();
-      resolve26();
+      resolve27();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -40313,18 +40492,6 @@ async function runHostLock(options = {}) {
     throw mapAdminError(e);
   }
 }
-async function runHostPromote(options = {}) {
-  const cfg = resolveHostConfig(options);
-  if (!options.project) throw new WaironError("`--project <id>` is required for `host promote`.");
-  try {
-    const result = promoteProject(cfg, masterCredential(), options.project);
-    const mark = result.status === "ready" ? import_chalk17.default.green("\u2713") : import_chalk17.default.yellow("\u2717");
-    logger.info(`${mark} ${result.message}`);
-    if (result.status !== "ready") process.exitCode = 1;
-  } catch (e) {
-    throw mapAdminError(e);
-  }
-}
 async function runHostProducer(action, options = {}) {
   const cfg = resolveHostConfig(options);
   const cred = masterCredential();
@@ -40409,8 +40576,8 @@ async function runHostPacks(action, options = {}) {
       }
       case "install": {
         if (!options.file) throw new WaironError("`--file <path>` (a declarative pack YAML) is required for install.");
-        const name = options.name ?? path61.basename(options.file).replace(/\.(ya?ml)$/i, "");
-        const content = fs52.readFileSync(path61.resolve(options.file), "utf8");
+        const name = options.name ?? path64.basename(options.file).replace(/\.(ya?ml)$/i, "");
+        const content = fs53.readFileSync(path64.resolve(options.file), "utf8");
         const desc = project2 ? installProjectPack(cfg, cred, project2, name, content) : installGlobalPack(cfg, cred, name, content);
         logger.success(`Installed ${scope} pack "${desc.name}" (${desc.profiles} profile(s), ${desc.languages} language(s)).`);
         if (project2) logger.info("Committed with the project \u2014 every clone and CI will enforce it.");
@@ -40636,7 +40803,7 @@ async function runSurface(action, options = {}) {
 }
 // src/commands/subsystem.ts
-var path62 = __toESM(require("path"));
+var path65 = __toESM(require("path"));
 init_logger();
 init_errors();
 init_fs();
@@ -40676,9 +40843,9 @@ async function runSubsystemAdd(id, options = {}) {
     updatedAt: now
   };
   createChainedSubsystem(subsystem, displayName);
-  const childDir = path62.resolve(getProjectRoot(), options.projectPath);
+  const childDir = path65.resolve(getProjectRoot(), options.projectPath);
   logger.success(`Added external subsystem "${id}" \u2192 ${options.projectPath}`);
-  logger.info(`Scaffolded child project at ${path62.relative(process.cwd(), childDir) || "."}`);
+  logger.info(`Scaffolded child project at ${path65.relative(process.cwd(), childDir) || "."}`);
   logger.info(`Design its spec tree from this parent using namespaced ids (e.g. ${id}::<component>).`);
 }
 async function runSubsystemMove(id, options = {}) {
@@ -40701,9 +40868,9 @@ async function runSubsystemExternalize(id, options = {}) {
     throw new WaironError("--project-path (the subproject destination) is required.");
   }
   externalizeSubsystem(id, options.projectPath);
-  const childDir = path62.resolve(getProjectRoot(), options.projectPath);
+  const childDir = path65.resolve(getProjectRoot(), options.projectPath);
   logger.success(`Externalized subsystem "${id}" \u2192 ${options.projectPath}`);
-  logger.info(`Moved its specs into ${path62.relative(process.cwd(), childDir) || "."} (now a standalone subproject).`);
+  logger.info(`Moved its specs into ${path65.relative(process.cwd(), childDir) || "."} (now a standalone subproject).`);
   logger.info("Move the source code there yourself, then run `wairon validate` to confirm the tree.");
 }
 async function runSubsystemInternalize(id) {
@@ -40947,7 +41114,7 @@ async function runAgent(action, id) {
     }
     case "customize": {
       const brief = composeAgentBrief3(id);
-      const guidancePath = path63.join(AI_PATHS.root(), "agents", `${id}.md`);
+      const guidancePath = path66.join(AI_PATHS.root(), "agents", `${id}.md`);
       const relPath = `.wai/agents/${id}.md`;
       if (pathExists(guidancePath)) {
         throw new GuidanceFileExistsError(relPath);
@@ -41050,9 +41217,6 @@ hostCmd.command("key <action>").description("mint | list | revoke an API key").o
 hostCmd.command("lock").description("validate-as-complete and write the state-scoped lock record for a hosted project").requiredOption("--project <id>", "project id").option("--data-dir <path>", "data root").action(async (opts) => {
   await runHostLock({ project: opts.project, dataDir: opts.dataDir });
 });
-hostCmd.command("promote").description("promote a locked project after re-checking its StateId (never merges to production)").requiredOption("--project <id>", "project id").option("--data-dir <path>", "data root").action(async (opts) => {
-  await runHostPromote({ project: opts.project, dataDir: opts.dataDir });
-});
 hostCmd.command("git <action>").description("enable | disable | sync | commit | status | sync-config \u2014 bind a project to its REAL repo (wairon commits ONLY .wai/)").option("--project <id>", "project id").option("--remote <url>", "git remote URL (for enable)").option("--branch <name>", "default branch PRs target (for enable)", "main").option("--subsystem <id>", "narrow a commit to .wai/specs/<subsystem>/ (staging convenience \u2014 history stays per-repo)").option("-m, --message <message>", "commit message (for commit)").option("--interval <minutes>", "periodic-sync interval in minutes (for sync-config; omit to disable)").option("--no-skip-if-clean", "commit on every periodic tick even when the scoped path is clean (for sync-config)").option("--data-dir <path>", "data root").action(async (action, opts) => {
   await runHostGit(action, {
     project: opts.project,