@wairon/cli 5.1.1-dev.70 → 5.1.1-dev.72

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.70";
+    WAIRON_VERSION = "5.1.1-dev.72";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     SUPPORTED_ALIASES = ["wai"];
     SCAN_EXCLUDE_DIRS = /* @__PURE__ */ new Set([
@@ -1860,7 +1860,13 @@ var init_specs = __esm({
       /** The L2 component that realizes this public interface (the subsystem's published surface). */
       component: SpecIdSchema.optional(),
       /** Optional L3 interface on that component backing this entry. */
-      interface: SpecIdSchema.optional()
+      interface: SpecIdSchema.optional(),
+      /**
+       * The subsystems this surface is published to. Absent, anyone may depend on
+       * it; present, only these subsystems may — when every entry publishing the
+       * component names consumers, the union of those lists is the whole set.
+       */
+      consumers: import_zod8.z.array(SpecIdSchema).optional()
     });
     TrustedLinkSchema = import_zod8.z.object({
       /** The peer subsystem id this link sanctions tight coupling with. */
@@ -9477,6 +9483,39 @@ var init_public_surface_binding = __esm({
   }
 });
 
+// src/core/rules/integrity/public-surface-consumers.ts
+var publicSurfaceConsumersRule;
+var init_public_surface_consumers = __esm({
+  "src/core/rules/integrity/public-surface-consumers.ts"() {
+    "use strict";
+    init_models();
+    publicSurfaceConsumersRule = {
+      name: "public-surface-consumers",
+      description: "Every subsystem a published surface names as its consumer must exist in the tree. A consumers list restricts who may depend on the surface, so an id that names nothing locks the surface against a caller nobody can be \u2014 and a typo there silently locks out the caller that was meant, which the boundary rule would then report against the wrong party.",
+      codes: [
+        { code: "PUBLIC_INTERFACE_UNKNOWN_CONSUMER", defaultSeverity: "error", summary: "A published surface names as its consumer a subsystem the tree does not have" }
+      ],
+      check(ctx) {
+        const known = new Set(ctx.subsystems.map((s) => s.id));
+        for (const sub of ctx.subsystems) {
+          for (const pi of sub.publicInterfaces) {
+            for (const consumer of pi.consumers ?? []) {
+              if (known.has(consumer)) continue;
+              ctx.addIssue(
+                "error",
+                "PUBLIC_INTERFACE_UNKNOWN_CONSUMER",
+                `Subsystem "${sub.id}" publishes "${pi.component ?? `${pi.type} ${pi.details}`}" to consumer "${consumer}", which names no subsystem of this tree. Name an existing subsystem, or drop the id \u2014 a consumers list admits only the subsystems it names.`,
+                sub.id,
+                isDraftSubsystem(sub)
+              );
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
 // src/core/rules/integrity/public-surface-declared-type.ts
 var pubTypeMatches, EVENT_VOCAB, expectedFor, publicSurfaceDeclaredTypeRule;
 var init_public_surface_declared_type = __esm({
@@ -11009,6 +11048,11 @@ var init_auth_source_wiring = __esm({
 });
 
 // src/core/rules/doctrine/subsystem-boundary-dependencies.ts
+function restrictedConsumers(ctx, subsystemId, componentId) {
+  const entries = (ctx.subsystems.find((s) => s.id === subsystemId)?.publicInterfaces ?? []).filter((pi) => pi.component === componentId);
+  if (entries.length === 0 || entries.some((pi) => pi.consumers === void 0)) return null;
+  return [...new Set(entries.flatMap((pi) => pi.consumers ?? []))];
+}
 var subsystemBoundaryDepsRule;
 var init_subsystem_boundary_dependencies = __esm({
   "src/core/rules/doctrine/subsystem-boundary-dependencies.ts"() {
@@ -11016,14 +11060,15 @@ var init_subsystem_boundary_dependencies = __esm({
     init_models();
     subsystemBoundaryDepsRule = {
       name: "subsystem-boundary-dependencies",
-      description: "Judges every dependsOn edge that leaves its own subsystem, and every one that resolves nowhere. Across subsystems the shape is client Adapter \u2192 published remote Portal, OR a direct in-process edge licensed by a trustedLink declared on the SOURCE subsystem (the published-Portal target requirement applies either way). A reference that names nothing in this tree is resolved against the stored surface snapshots: a hit is a DECLARED remote portal and the same Adapter requirement applies to it, snapshots of several providers that disagree make the reference ambiguous, and a reference authored to leave this root that no snapshot covers warns instead of erroring. Boundary rules are never relaxed by a pack profile.",
+      description: "Judges every dependsOn edge that leaves its own subsystem, and every one that resolves nowhere. Across subsystems the shape is client Adapter \u2192 published remote Portal, OR a direct in-process edge licensed by a trustedLink declared on the SOURCE subsystem (the published-Portal target requirement applies either way). A published surface may also name the subsystems it serves (a publicInterfaces entry's consumers): a component every one of whose entries names consumers may be depended on only from those subsystems, which is how a provider keeps a surface \u2014 the raw spec writes \u2014 away from a door that must not reach it. A reference that names nothing in this tree is resolved against the stored surface snapshots: a hit is a DECLARED remote portal and the same Adapter requirement applies to it, snapshots of several providers that disagree make the reference ambiguous, and a reference authored to leave this root that no snapshot covers warns instead of erroring. Boundary rules are never relaxed by a pack profile.",
       codes: [
         { code: "INVALID_DEPENDENCY_REFERENCE", defaultSeverity: "error", summary: "dependsOn names a non-existent component" },
         { code: "CROSS_TREE_REF_UNRESOLVED", defaultSeverity: "warning", summary: "Cross-tree dependsOn (super::/:: form) with no surface snapshot covering it" },
         { code: "SURFACE_REF_AMBIGUOUS", defaultSeverity: "error", summary: "Cross-tree dependsOn matched by surface snapshots of several providers with different contracts" },
         { code: "CROSS_SUBSYSTEM_NON_ADAPTER", defaultSeverity: "error", summary: "Non-Adapter component crossing a subsystem boundary" },
         { code: "CROSS_SUBSYSTEM_PRIVATE_ACCESS", defaultSeverity: "error", summary: "Cross-subsystem dependency on an unpublished component" },
-        { code: "CROSS_SUBSYSTEM_TARGET_NON_PORTAL", defaultSeverity: "error", summary: "Cross-subsystem hop entering through a non-Portal" }
+        { code: "CROSS_SUBSYSTEM_TARGET_NON_PORTAL", defaultSeverity: "error", summary: "Cross-subsystem hop entering through a non-Portal" },
+        { code: "CROSS_SUBSYSTEM_UNLISTED_CONSUMER", defaultSeverity: "error", summary: "Cross-subsystem dependency on a surface published only to other subsystems" }
       ],
       check(ctx) {
         for (const edge of ctx.dependencyEdges().all) {
@@ -11106,6 +11151,16 @@ var init_subsystem_boundary_dependencies = __esm({
               edge.draftContext
             );
           }
+          const publishedTo = restrictedConsumers(ctx, depComp.subsystem, depComp.id);
+          if (publishedTo && !publishedTo.includes(comp.subsystem)) {
+            ctx.addIssue(
+              "error",
+              "CROSS_SUBSYSTEM_UNLISTED_CONSUMER",
+              `Boundary violation: "${comp.id}" (subsystem "${comp.subsystem}") depends on "${depComp.id}", which subsystem "${depComp.subsystem}" publishes only to ${publishedTo.map((s) => `"${s}"`).join(", ")}. Depend on a surface published to "${comp.subsystem}" instead, or \u2014 when "${comp.subsystem}" really is a caller the provider meant to serve \u2014 add it to the entry's consumers.`,
+              comp.id,
+              edge.draftContext
+            );
+          }
         }
       }
     };
@@ -15983,6 +16038,7 @@ var init_repository = __esm({
     init_field_type_references();
     init_signature_type_references();
     init_public_surface_binding();
+    init_public_surface_consumers();
     init_public_surface_declared_type();
     init_public_surface_bound_contract();
     init_lint_allows();
@@ -16161,10 +16217,11 @@ var init_repository = __esm({
       assertionForbiddenEdgesRule,
       assertionRequiredFieldsRule,
       assertionEndpointShapesRule,
-      // The published surface in three questions: what backs the entry, whether
-      // that component's stereotype can realize the type it declares, and whether
-      // the contract it binds is that component's own.
+      // The published surface in four questions: what backs the entry, who it is
+      // published to, whether that component's stereotype can realize the type it
+      // declares, and whether the contract it binds is that component's own.
       publicSurfaceBindingRule,
+      publicSurfaceConsumersRule,
       publicSurfaceDeclaredTypeRule,
       publicSurfaceBoundContractRule,
       cyclesRule,
@@ -19633,6 +19690,7 @@ __export(specs_exports, {
   deleteGroupSpec: () => deleteGroupSpec,
   deleteImplementationSpec: () => deleteImplementationSpec,
   deleteInterfaceSpec: () => deleteInterfaceSpec,
+  deleteSpec: () => deleteSpec,
   deleteSubsystemSpec: () => deleteSubsystemSpec,
   deleteTypeSpec: () => deleteTypeSpec,
   deregisterPackRef: () => deregisterPackRef,
@@ -19659,6 +19717,7 @@ __export(specs_exports, {
   loadImplementationSpecs: () => loadImplementationSpecs,
   loadInterfaceSpec: () => loadInterfaceSpec,
   loadInterfaceSpecs: () => loadInterfaceSpecs,
+  loadSpec: () => loadSpec,
   loadSubsystemSpec: () => loadSubsystemSpec,
   loadSubsystemSpecs: () => loadSubsystemSpecs,
   loadSystemSpec: () => loadSystemSpec,
@@ -19680,6 +19739,7 @@ __export(specs_exports, {
   saveGroupSpec: () => saveGroupSpec,
   saveImplementationSpec: () => saveImplementationSpec,
   saveInterfaceSpec: () => saveInterfaceSpec,
+  saveSpec: () => saveSpec,
   saveSubsystemSpec: () => saveSubsystemSpec,
   saveSystemSpec: () => saveSystemSpec,
   saveTypeSpec: () => saveTypeSpec,
@@ -19946,7 +20006,10 @@ function stripNamespaceFromSubsystem(spec, prefix) {
     publicInterfaces: spec.publicInterfaces.map((pi) => ({
       ...pi,
       component: pi.component ? relMember(pi.component) : void 0,
-      interface: pi.interface ? relMember(pi.interface) : void 0
+      interface: pi.interface ? relMember(pi.interface) : void 0,
+      // consumers name SUBSYSTEMS — peers of this one, so they are relative to
+      // the namespace the subsystem itself is declared in, never its members'.
+      ...pi.consumers ? { consumers: pi.consumers.map((c) => c.includes("::") ? relativizeId(c, prefix) : c) } : {}
     })),
     lifecycle: spec.lifecycle?.map((le) => ({
       ...le,
@@ -20169,6 +20232,8 @@ function identityKeyOf(field, item) {
   const o = item;
   const str = (v) => typeof v === "string" && v.length > 0 ? v : null;
   switch (field) {
+    case "publicInterfaces":
+      return publicInterfaceKey(o);
     case "dispatch":
       return str(o.capability);
     // A listener mounts each portal once, so the portal IS the mount's identity.
@@ -20214,6 +20279,13 @@ function identityKeyOf(field, item) {
       return str(o.name) ?? str(o.id);
   }
 }
+function publicInterfaceKey(o) {
+  const str = (v) => typeof v === "string" && v.length > 0 ? v : null;
+  const component = str(o.component);
+  if (component) return str(o.interface) ? `${component}.${String(o.interface)}` : component;
+  if (typeof o.type === "string" && typeof o.details === "string") return `${o.type} ${o.details}`;
+  return null;
+}
 function reportIdentityOf(field, item) {
   if (item !== null && typeof item === "object") {
     const step = item.stepNumber;
@@ -20265,6 +20337,9 @@ function identityFieldsOf(field) {
   switch (field) {
     case "dispatch":
       return ["capability"];
+    // Bound: component + interface; not yet bound: type + details.
+    case "publicInterfaces":
+      return ["component", "interface", "type", "details"];
     case "lifecycle":
       return ["phase", "component", "method"];
     case "emits":
@@ -20677,6 +20752,18 @@ function restoreSpecFiles(snapshot) {
 function findLegacySpecFiles() {
   return current().findLegacySpecFiles();
 }
+function loadSpec(kind, id) {
+  const workspace = current();
+  return workspace.load(kind, id);
+}
+function saveSpec(kind, spec) {
+  const workspace = current();
+  return workspace.save(kind, spec);
+}
+function deleteSpec(kind, id) {
+  const workspace = current();
+  return workspace.delete(kind, id);
+}
 function updateSpec(kind, id, delta, hooks, dryRun) {
   return current().updateSpec(kind, id, delta, hooks, dryRun);
 }
@@ -20870,7 +20957,10 @@ var init_specs2 = __esm({
             publicInterfaces: sub.publicInterfaces.map((p) => ({
               ...p,
               component: p.component ? qualifyId(p.component, componentPrefix, this.rootSubsystems) : void 0,
-              interface: p.interface ? qualifyId(p.interface, componentPrefix, this.rootSubsystems) : void 0
+              interface: p.interface ? qualifyId(p.interface, componentPrefix, this.rootSubsystems) : void 0,
+              // Each consumer is a subsystem reference: qualified into the namespace
+              // this subsystem is declared in, like a component's `subsystem` field.
+              ...p.consumers ? { consumers: p.consumers.map((c) => qualifySubsystemRef(c, namespacePrefix, this.rootSubsystems)) } : {}
             })),
             lifecycle: sub.lifecycle?.map((le) => ({
               ...le,
@@ -21770,6 +21860,76 @@ var init_specs2 = __esm({
         return true;
       }
       // -------------------------------------------------------------------------
+      // Kind-generic access (spec_index.load, spec_registry.save / delete)
+      //
+      // The one place a kind held as DATA becomes the typed loader, writer or
+      // delete of that kind. Every caller that holds the kind as a value — the
+      // gated whole-spec write, a delete by kind, the delta update, the method
+      // move — used to repeat this switch, and each copy could drift from the
+      // others (one of them forgot that a type's writer takes no status).
+      // -------------------------------------------------------------------------
+      /** One stored spec of the named kind, or null. The L0 is a singleton: its id is informational. */
+      load(kind, id) {
+        switch (kind) {
+          case "system":
+            return this.loadSystemSpec();
+          case "subsystem":
+            return this.loadSubsystemSpec(id);
+          case "component":
+            return this.loadComponentSpec(id);
+          case "interface":
+            return this.loadInterfaceSpec(id);
+          case "implementation":
+            return this.loadImplementationSpec(id);
+          case "type":
+            return this.loadTypeSpec(id);
+        }
+      }
+      /**
+       * Persist one spec through the typed writer of its kind, answering with that
+       * writer's placement notices (none for the L0 and a subsystem). A draft or
+       * status-less save keeps the stored status, exactly as the typed writers do.
+       */
+      save(kind, spec) {
+        return this.saveOfKind(kind, spec);
+      }
+      /** The typed writer of a kind, with the caller's save options — the delta update and the move state a demotion. */
+      saveOfKind(kind, spec, opts) {
+        switch (kind) {
+          case "system":
+            this.saveSystemSpec(spec);
+            return [];
+          case "subsystem":
+            this.saveSubsystemSpec(spec, opts);
+            return [];
+          case "component":
+            return this.saveComponentSpec(spec, opts);
+          case "interface":
+            return this.saveInterfaceSpec(spec, opts);
+          case "implementation":
+            return this.saveImplementationSpec(spec, opts);
+          case "type":
+            return this.saveTypeSpec(spec, opts);
+        }
+      }
+      /** Delete one spec document of the named kind; false when none was stored. The L0 cannot be deleted. */
+      delete(kind, id) {
+        switch (kind) {
+          case "system":
+            throw new Error("The L0 system spec cannot be deleted: it is the root every other spec hangs from.");
+          case "subsystem":
+            return this.deleteSubsystemSpec(id);
+          case "component":
+            return this.deleteComponentSpec(id);
+          case "interface":
+            return this.deleteInterfaceSpec(id);
+          case "implementation":
+            return this.deleteImplementationSpec(id);
+          case "type":
+            return this.deleteTypeSpec(id);
+        }
+      }
+      // -------------------------------------------------------------------------
       // Spec status promotion (draft/design → complete)
       // -------------------------------------------------------------------------
       /** Every spec whose status is not yet 'complete', with its current status captured. */
@@ -21990,23 +22150,7 @@ var init_specs2 = __esm({
        */
       updateSpec(kind, id, delta, hooks, dryRun = false) {
         const notices = [];
-        const result = (() => {
-          switch (kind) {
-            case "system":
-              return this.loadSystemSpec();
-            // singleton — id is informational
-            case "subsystem":
-              return this.loadSubsystemSpec(id);
-            case "component":
-              return this.loadComponentSpec(id);
-            case "interface":
-              return this.loadInterfaceSpec(id);
-            case "implementation":
-              return this.loadImplementationSpec(id);
-            case "type":
-              return this.loadTypeSpec(id);
-          }
-        })();
+        const result = this.load(kind, id);
         if (!result) {
           throw new Error(`Spec of kind "${kind}" with ID "${id}" does not exist. Define it first.`);
         }
@@ -22338,9 +22482,10 @@ var init_specs2 = __esm({
         const mergePublicInterfaces = (existing, delta2) => {
           const merged = [...existing];
           for (const deltaItem of delta2) {
-            const piKey = (i) => `${i?.component}.${i?.interface}`;
+            const piKey = (i) => String(identityKeyOf("publicInterfaces", i));
             assertDeltaMarkers(deltaItem, `publicInterface "${piKey(deltaItem)}"`);
-            const idx = merged.findIndex((item) => item.component === deltaItem.component && item.interface === deltaItem.interface);
+            const key = identityKeyOf("publicInterfaces", deltaItem);
+            const idx = key === null ? -1 : merged.findIndex((item) => identityKeyOf("publicInterfaces", item) === key);
             if (idx !== -1) {
               if (deltaItem.remove === true || deltaItem.action === "delete") {
                 merged.splice(idx, 1);
@@ -22429,7 +22574,8 @@ var init_specs2 = __esm({
                 out.publicInterfaces = out.publicInterfaces.map((pi) => ({
                   ...pi,
                   ...typeof pi?.component === "string" ? { component: qm(pi.component) } : {},
-                  ...typeof pi?.interface === "string" ? { interface: qm(pi.interface) } : {}
+                  ...typeof pi?.interface === "string" ? { interface: qm(pi.interface) } : {},
+                  ...Array.isArray(pi?.consumers) ? { consumers: pi.consumers.map((c) => typeof c === "string" ? qualifySubsystemRef(c, prefix, this.rootSubsystems) : c) } : {}
                 }));
               }
               if (Array.isArray(out.lifecycle)) {
@@ -22483,14 +22629,14 @@ var init_specs2 = __esm({
 - ${labelErrors.join("\n- ")}`);
           }
         }
-        const canonical = (spec) => {
+        const canonical2 = (spec) => {
           const parsed = deltaSchema.safeParse(spec);
           const value = { ...parsed.success ? parsed.data : spec };
           delete value.updatedAt;
           return value;
         };
-        const canonicalStored = canonical(storedBefore);
-        const canonicalMerged = canonical(mergedResult);
+        const canonicalStored = canonical2(storedBefore);
+        const canonicalMerged = canonical2(mergedResult);
         const changes = specChanges(canonicalStored, canonicalMerged);
         const ineffective = ineffectiveDeltaPaths(
           { ...qualifiedDelta, ...unsetFields.length ? { unset: unsetFields } : {} },
@@ -22529,26 +22675,7 @@ var init_specs2 = __esm({
         const opts = {
           allowStatusDemotion: Object.prototype.hasOwnProperty.call(delta, "status")
         };
-        switch (kind) {
-          case "system":
-            this.saveSystemSpec(mergedResult);
-            break;
-          case "subsystem":
-            this.saveSubsystemSpec(mergedResult, opts);
-            break;
-          case "component":
-            notices.push(...this.saveComponentSpec(mergedResult, opts));
-            break;
-          case "interface":
-            notices.push(...this.saveInterfaceSpec(mergedResult, opts));
-            break;
-          case "implementation":
-            notices.push(...this.saveImplementationSpec(mergedResult, opts));
-            break;
-          case "type":
-            notices.push(...this.saveTypeSpec(mergedResult));
-            break;
-        }
+        notices.push(...this.saveOfKind(kind, mergedResult, opts));
         return {
           kind,
           id,
@@ -22909,23 +23036,7 @@ var init_specs2 = __esm({
       }
       /** Persist one moved spec through the store's own writer, and answer with its placement notices. */
       saveMovedSpec(kind, spec) {
-        const opts = { allowStatusDemotion: true };
-        switch (kind) {
-          case "system":
-            this.saveSystemSpec(spec);
-            return [];
-          case "subsystem":
-            this.saveSubsystemSpec(spec, opts);
-            return [];
-          case "component":
-            return this.saveComponentSpec(spec, opts);
-          case "interface":
-            return this.saveInterfaceSpec(spec, opts);
-          case "implementation":
-            return this.saveImplementationSpec(spec, opts);
-          case "type":
-            return this.saveTypeSpec(spec);
-        }
+        return this.saveOfKind(kind, spec, { allowStatusDemotion: true });
       }
     };
     DEFAULT_DEPENDENCY_LIMIT = 8;
@@ -29082,6 +29193,361 @@ var init_core = __esm({
   }
 });
 
+// src/core/authoring.ts
+function candidateOptions() {
+  try {
+    const config = loadProjectConfig();
+    return config ? { rules: config.rules, projectType: config.projectType } : {};
+  } catch {
+    return {};
+  }
+}
+function noticesFrom(verdict) {
+  return verdict.warnings.map((w) => `${w.code}: ${w.message}`);
+}
+function componentCandidateGate(options = candidateOptions()) {
+  return {
+    gate: (kind, merged) => {
+      if (kind !== "component") return;
+      const verdict = validateComponentCandidate(merged, options);
+      if (verdict.errors.length) throw new Error(formatCandidateRefusal(verdict));
+      return noticesFrom(verdict);
+    }
+  };
+}
+function restatementParent(restatement) {
+  const spec = restatement.spec;
+  switch (restatement.kind) {
+    case "subsystem":
+      return { kind: "system", id: "system" };
+    case "component":
+      return { kind: "subsystem", id: spec.subsystem };
+    case "interface":
+      return { kind: "component", id: spec.component };
+    case "implementation":
+      return { kind: "interface", id: spec.contract };
+    default:
+      return null;
+  }
+}
+function applyRestatement(restatement, existing, parent) {
+  const replacedExisting = existing !== null;
+  const parentRef = restatementParent(restatement);
+  if (parentRef && !parent) return refused(restatement, replacedExisting, MISSING_PARENT[restatement.kind](parentRef.id));
+  const status2 = statusForCreate(restatement, existing);
+  if ("refusal" in status2) return refused(restatement, replacedExisting, status2.refusal);
+  const candidate = JSON.parse(JSON.stringify(restatement.spec));
+  if (restatement.kind === "subsystem") candidate.parentSystem = parent.name;
+  const carried = carryInto(restatement, existing, candidate);
+  const cleared = clearedByOmission(existing, candidate, restatement.fields);
+  stampLifecycle(candidate, existing, status2.status);
+  const labelErrors = resolveLabelsOf(restatement.kind, candidate);
+  if (labelErrors.length) {
+    return refused(restatement, replacedExisting, `Unresolved narrative label references \u2014 nothing was saved:
+- ${labelErrors.join("\n- ")}`);
+  }
+  const parsed = parseCandidate(restatement.kind, candidate);
+  if ("refusal" in parsed) return refused(restatement, replacedExisting, parsed.refusal);
+  return {
+    spec: parsed.spec,
+    ...status2.status ? { status: status2.status } : {},
+    replacedExisting,
+    notices: existing ? rewriteNotices(restatement.kind, existing, candidate, carried, cleared) : [],
+    changedMethods: changedMethodsOf(restatement.kind, existing, candidate)
+  };
+}
+function parseCandidate(kind, candidate) {
+  const masked = /* @__PURE__ */ new Map();
+  const mask = (value) => {
+    if (typeof value === "string") {
+      if (!value.includes("::")) return value;
+      const token = `nsref_${masked.size}_masked`;
+      masked.set(token, value);
+      return token;
+    }
+    if (Array.isArray(value)) return value.map(mask);
+    if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, mask(v)]));
+    return value;
+  };
+  const restore = (value) => {
+    if (typeof value === "string") return masked.get(value) ?? value;
+    if (Array.isArray(value)) return value.map(restore);
+    if (value && typeof value === "object") return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, restore(v)]));
+    return value;
+  };
+  const result = SPEC_SCHEMA[kind].safeParse(mask(candidate));
+  if (result.success) return { spec: restore(result.data) };
+  const id = kind === "system" ? "system" : String(candidate.id);
+  const issues = result.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
+  return {
+    refusal: `Refusing to write ${kind} "${id}": the spec it would become does not parse \u2014 ${issues}. Nothing was written. State the missing or malformed field and call again.`
+  };
+}
+function refused(restatement, replacedExisting, refusal2) {
+  return { spec: restatement.spec, refusal: refusal2, replacedExisting, notices: [], changedMethods: [] };
+}
+function statusForCreate(restatement, existing) {
+  if (!STATUSED_KINDS.has(restatement.kind)) return {};
+  const stated = restatement.status;
+  const stored = existing?.status;
+  const held = stored !== void 0 && STATUS_ORDER.includes(stored) ? stored : void 0;
+  if (stated === void 0) return { status: held ?? "draft" };
+  if (held === void 0 || STATUS_ORDER.indexOf(stated) >= STATUS_ORDER.indexOf(held)) return { status: stated };
+  const label = `${restatement.kind} "${restatement.spec.id}"`;
+  return {
+    refusal: `Refusing to re-author ${label} at status "${stated}": it is stored at "${held}", and a create tool never lowers a spec's status \u2014 a restatement that reopened a frozen spec would undo a lock without saying so. Nothing was written. To reopen it deliberately, use sdd_update_spec with {"status": "${stated}"}; to keep the level it has, leave status out.`
+  };
+}
+function carryInto(restatement, existing, candidate) {
+  if (!existing) return [];
+  const carried = ["createdAt"];
+  if (restatement.memberFields && Array.isArray(candidate.methods)) {
+    const stored = existing.methods ?? [];
+    for (const method2 of candidate.methods) {
+      const prev = stored.find((p) => p.name === method2.name);
+      for (const field of carryUnexpressed(prev, method2, restatement.memberFields)) carried.push(`${field} (${String(method2.name)})`);
+    }
+  }
+  carried.push(...carryUnexpressed(existing, candidate, [...restatement.fields, "createdAt"]));
+  return carried;
+}
+function carryUnexpressed(existing, next, expressed) {
+  if (!existing) return [];
+  const carried = [];
+  for (const [field, value] of Object.entries(existing)) {
+    if (value === void 0) continue;
+    if (STORE_MANAGED_FIELDS.has(field)) continue;
+    if (expressed.includes(field) && !ALWAYS_CARRIED_FIELDS.has(field)) continue;
+    if (next[field] !== void 0) continue;
+    next[field] = value;
+    carried.push(field);
+  }
+  return carried;
+}
+function isEmptyValue(value) {
+  if (value === void 0 || value === null) return true;
+  if (Array.isArray(value)) return value.length === 0;
+  if (typeof value === "string") return value.trim() === "";
+  if (typeof value === "object") return Object.keys(value).length === 0;
+  return false;
+}
+function clearedByOmission(existing, next, expressed) {
+  if (!existing) return [];
+  const stored = existing;
+  const cleared = [];
+  for (const field of expressed) {
+    const before = stored[field];
+    if (STORE_MANAGED_FIELDS.has(field) || ALWAYS_CARRIED_FIELDS.has(field)) continue;
+    if (isEmptyValue(before) || !isEmptyValue(next[field])) continue;
+    cleared.push(Array.isArray(before) ? `${field} (had ${before.length})` : field);
+  }
+  return cleared;
+}
+function stampLifecycle(candidate, existing, status2) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  candidate.createdAt = existing?.createdAt ?? now;
+  candidate.updatedAt = now;
+  if (status2) candidate.status = status2;
+  else delete candidate.status;
+}
+function resolveLabelsOf(kind, candidate) {
+  if (kind !== "implementation") return [];
+  const methods = candidate.methods ?? [];
+  return methods.flatMap((m) => resolveNarrativeLabels(m.name, m.narrative ?? []));
+}
+function removedByName(before, after) {
+  if (!before?.length) return [];
+  const kept = new Set((after ?? []).map((m) => m.name));
+  return before.map((m) => m.name).filter((n) => !kept.has(n));
+}
+function rewriteNotices(kind, existing, candidate, carried, cleared) {
+  const named = kind === "system" ? existing.name : String(candidate.id);
+  const notices = [`${REWRITE_LABEL[kind]} "${named}" already existed \u2014 re-authored in place; this input REPLACES what it expresses.`];
+  if (carried.length) notices.push(`Carried forward (not expressible through this tool): ${carried.join(", ")}.`);
+  const removal = removalNotice(kind, existing, candidate);
+  if (removal) notices.push(removal);
+  if (cleared.length) {
+    notices.push(
+      `CLEARED by omission: ${cleared.join(", ")} \u2014 the argument was not repeated, so the previous value is gone. Use sdd_update_spec if you meant to leave it untouched.`
+    );
+  }
+  return notices;
+}
+function removalNotice(kind, existing, candidate) {
+  const before = existing;
+  let removed = [];
+  let noun = "method";
+  let suffix = "";
+  if (kind === "interface" || kind === "implementation") {
+    removed = removedByName(before.methods, candidate.methods);
+    suffix = kind === "interface" ? " (endpoint bindings included)" : " (L5 narratives included)";
+  } else if (kind === "type") {
+    removed = [
+      ...removedByName(before.fields, candidate.fields).map((n) => `field ${n}`),
+      ...removedByName(before.methods, candidate.methods).map((n) => `method ${n}`)
+    ];
+    noun = "member";
+  }
+  if (!removed.length) return void 0;
+  return `REMOVED by this restatement: ${removed.length === 1 ? noun : `${noun}s`} ${removed.map((n) => `"${n}"`).join(", ")}${suffix} \u2014 absent from the input, so no longer in the spec. Restate them to keep them, or use sdd_update_spec to edit one member at a time.`;
+}
+function changedMethodsOf(kind, existing, candidate) {
+  if (!existing || !(kind in METHOD_SCHEMA)) return [];
+  const schema = METHOD_SCHEMA[kind];
+  const stored = existing.methods ?? [];
+  const next = candidate.methods ?? [];
+  return stored.filter((method2) => {
+    const restated = next.find((m) => m.name === method2.name);
+    if (!restated) return true;
+    const parsed = schema.safeParse(restated);
+    return !parsed.success || canonical(parsed.data) !== canonical(method2);
+  }).map((method2) => method2.name);
+}
+function canonical(value) {
+  return JSON.stringify(value, (_key, v) => v && typeof v === "object" && !Array.isArray(v) ? Object.fromEntries(Object.entries(v).filter(([, x]) => x !== void 0).sort(([a], [b]) => a.localeCompare(b))) : v);
+}
+function writeSpec(restatement) {
+  const bound2 = candidateOptions();
+  const parentRef = restatementParent(restatement);
+  const parent = parentRef ? loadSpec(parentRef.kind, parentRef.id) : null;
+  const id = restatement.kind === "system" ? "system" : restatement.spec.id;
+  const existing = loadSpec(restatement.kind, id);
+  const application = applyRestatement(restatement, existing, parent);
+  if (application.refusal !== void 0) throw new Error(application.refusal);
+  const gateNotices = restatement.kind === "component" ? judgeComponent(application.spec, bound2) : [];
+  const persisted = persistCandidate(restatement.kind, application.spec);
+  const testsToRevisit = testsInvalidatedBy(application.changedMethods, [existing, application.spec], bound2);
+  return {
+    kind: restatement.kind,
+    id,
+    name: application.spec.name,
+    replacedExisting: application.replacedExisting,
+    ...application.status ? { status: application.status } : {},
+    notices: [...gateNotices, ...persisted.notices, ...application.notices],
+    ...persisted.scaffoldedProjectPath ? { scaffoldedProjectPath: persisted.scaffoldedProjectPath } : {},
+    testsToRevisit
+  };
+}
+function judgeComponent(candidate, options) {
+  const verdict = validateComponentCandidate(candidate, options);
+  if (verdict.errors.length) throw new Error(formatCandidateRefusal(verdict));
+  return noticesFrom(verdict);
+}
+function persistCandidate(kind, spec) {
+  const projectPath = kind === "subsystem" ? spec.projectPath : void 0;
+  if (projectPath && projectPath.trim() !== "") {
+    createChainedSubsystem(spec, spec.name);
+    return { notices: [], scaffoldedProjectPath: projectPath };
+  }
+  return { notices: saveSpec(kind, spec) };
+}
+function testsInvalidatedBy(methods, specs, options) {
+  const testRoots = options.rules?.conformance?.testRoots ?? [];
+  if (methods.length === 0 || testRoots.length === 0) return [];
+  const symbolOf = (name) => specs.map((s) => (s?.methods ?? []).find((m) => m.name === name)?.symbol).find((symbol) => symbol !== void 0);
+  return findTestsReferencing2(methods.map((name) => ({ name, symbol: symbolOf(name) })), getProjectRoot(), testRoots);
+}
+function deleteSpec2(kind, id) {
+  const bound2 = candidateOptions();
+  const stored = loadSpec(kind, id);
+  const deleted = deleteSpec(kind, id);
+  const methods = deleted ? (stored?.methods ?? []).map((m) => m.name) : [];
+  const testsToRevisit = testsInvalidatedBy(methods, [stored], bound2);
+  return { kind, id, deleted, testsToRevisit };
+}
+function updateSpecGated(kind, id, delta, dryRun) {
+  const bound2 = candidateOptions();
+  const gate = componentCandidateGate(bound2);
+  const report2 = updateSpec(kind, id, delta, gate, dryRun);
+  const testRoots = bound2.rules?.conformance?.testRoots ?? [];
+  const changed = changedMethods(report2, delta);
+  if (changed.length > 0 && testRoots.length > 0) {
+    report2.testsToRevisit = findTestsReferencing2(changed, getProjectRoot(), testRoots);
+  }
+  return report2;
+}
+function changedMethods(report2, delta) {
+  const named = /* @__PURE__ */ new Set();
+  for (const change of report2.changes) {
+    const [field, name] = change.path.split(".");
+    if (field === "methods" && name) named.add(name);
+  }
+  const written = Array.isArray(delta?.methods) ? delta.methods : [];
+  return [...named].map((name) => ({
+    name,
+    symbol: written.find((m) => m?.name === name)?.symbol
+  }));
+}
+function methodMoveGate(source) {
+  const bound2 = candidateOptions();
+  return {
+    gate: (kind, merged) => {
+      if (kind !== "component") return;
+      const { codes, verdict, ceiling } = judgeMoveHome(merged, source, bound2);
+      if (codes.length === 0) return noticesFrom(verdict);
+      throw new Error(
+        `${codes.join(", ")} refuses "${merged.id}" as the home for these methods. ` + (verdict.errors.length ? formatCandidateRefusal(verdict) : `It would reach ${merged.dependsOn?.length ?? 0} dependencies against a ceiling of ${ceiling}.`)
+      );
+    },
+    assess: (kind, merged) => kind === "component" ? judgeMoveHome(merged, source, bound2).codes : []
+  };
+}
+function judgeMoveHome(component, source, options) {
+  const ceiling = options.rules?.complexity?.maxComponentDependencies;
+  const verdict = validateComponentCandidate(component, options);
+  const codes = verdict.errors.map((e) => e.code);
+  if (component.id !== source && ceiling !== void 0 && (component.dependsOn?.length ?? 0) > ceiling) {
+    codes.push("EXCESSIVE_DEPENDENCIES");
+  }
+  return { codes: [...new Set(codes)], verdict, ceiling };
+}
+function moveMethods2(from, to, methods, dryRun) {
+  return moveMethods(from, to, methods, methodMoveGate(from), dryRun);
+}
+var STORE_MANAGED_FIELDS, ALWAYS_CARRIED_FIELDS, STATUS_ORDER, STATUSED_KINDS, MISSING_PARENT, REWRITE_LABEL, SPEC_SCHEMA, METHOD_SCHEMA;
+var init_authoring = __esm({
+  "src/core/authoring.ts"() {
+    "use strict";
+    init_specs();
+    init_core();
+    init_validation();
+    init_candidate();
+    init_narrative_labels();
+    init_fs();
+    STORE_MANAGED_FIELDS = /* @__PURE__ */ new Set(["status", "updatedAt"]);
+    ALWAYS_CARRIED_FIELDS = /* @__PURE__ */ new Set(["ext"]);
+    STATUS_ORDER = ["draft", "design", "complete"];
+    STATUSED_KINDS = /* @__PURE__ */ new Set(["subsystem", "component", "interface", "implementation"]);
+    MISSING_PARENT = {
+      subsystem: () => "System spec must be initialized (sdd_initialize_system) first.",
+      component: (id) => `Parent subsystem "${id}" does not exist.`,
+      interface: (id) => `Component "${id}" does not exist.`,
+      implementation: (id) => `Interface contract "${id}" does not exist.`
+    };
+    REWRITE_LABEL = {
+      system: "System spec",
+      subsystem: "Subsystem",
+      component: "Component",
+      interface: "Interface",
+      implementation: "Implementation",
+      type: "Type"
+    };
+    SPEC_SCHEMA = {
+      system: SystemSpecSchema,
+      subsystem: SubsystemSpecSchema,
+      component: ComponentSpecSchema,
+      interface: InterfaceSpecSchema,
+      implementation: ImplementationSpecSchema,
+      type: TypeSpecSchema
+    };
+    METHOD_SCHEMA = {
+      interface: MethodSignatureSchema,
+      implementation: MethodImplementationSchema,
+      type: TypeMethodSchema
+    };
+  }
+});
+
 // src/core/instructions.ts
 function governingProfile() {
   try {
@@ -29405,93 +29871,6 @@ var init_skills = __esm({
   }
 });
 
-// src/core/authoring.ts
-function candidateOptions() {
-  try {
-    const config = loadProjectConfig();
-    return config ? { rules: config.rules, projectType: config.projectType } : {};
-  } catch {
-    return {};
-  }
-}
-function noticesFrom(verdict) {
-  return verdict.warnings.map((w) => `${w.code}: ${w.message}`);
-}
-function componentCandidateGate(options = candidateOptions()) {
-  return {
-    gate: (kind, merged) => {
-      if (kind !== "component") return;
-      const verdict = validateComponentCandidate(merged, options);
-      if (verdict.errors.length) throw new Error(formatCandidateRefusal(verdict));
-      return noticesFrom(verdict);
-    }
-  };
-}
-function addComponent(candidate) {
-  const verdict = validateComponentCandidate(candidate, candidateOptions());
-  if (verdict.errors.length) throw new Error(formatCandidateRefusal(verdict));
-  return [...noticesFrom(verdict), ...saveComponentSpec(candidate)];
-}
-function updateSpecGated(kind, id, delta, dryRun) {
-  const bound2 = candidateOptions();
-  const gate = componentCandidateGate(bound2);
-  const report2 = updateSpec(kind, id, delta, gate, dryRun);
-  const testRoots = bound2.rules?.conformance?.testRoots ?? [];
-  const changed = changedMethods(report2, delta);
-  if (changed.length > 0 && testRoots.length > 0) {
-    report2.testsToRevisit = findTestsReferencing2(changed, getProjectRoot(), testRoots);
-  }
-  return report2;
-}
-function changedMethods(report2, delta) {
-  const named = /* @__PURE__ */ new Set();
-  for (const change of report2.changes) {
-    const [field, name] = change.path.split(".");
-    if (field === "methods" && name) named.add(name);
-  }
-  const written = Array.isArray(delta?.methods) ? delta.methods : [];
-  return [...named].map((name) => ({
-    name,
-    symbol: written.find((m) => m?.name === name)?.symbol
-  }));
-}
-function methodMoveGate(source) {
-  const bound2 = candidateOptions();
-  return {
-    gate: (kind, merged) => {
-      if (kind !== "component") return;
-      const { codes, verdict, ceiling } = judgeMoveHome(merged, source, bound2);
-      if (codes.length === 0) return noticesFrom(verdict);
-      throw new Error(
-        `${codes.join(", ")} refuses "${merged.id}" as the home for these methods. ` + (verdict.errors.length ? formatCandidateRefusal(verdict) : `It would reach ${merged.dependsOn?.length ?? 0} dependencies against a ceiling of ${ceiling}.`)
-      );
-    },
-    assess: (kind, merged) => kind === "component" ? judgeMoveHome(merged, source, bound2).codes : []
-  };
-}
-function judgeMoveHome(component, source, options) {
-  const ceiling = options.rules?.complexity?.maxComponentDependencies;
-  const verdict = validateComponentCandidate(component, options);
-  const codes = verdict.errors.map((e) => e.code);
-  if (component.id !== source && ceiling !== void 0 && (component.dependsOn?.length ?? 0) > ceiling) {
-    codes.push("EXCESSIVE_DEPENDENCIES");
-  }
-  return { codes: [...new Set(codes)], verdict, ceiling };
-}
-function moveMethods2(from, to, methods, dryRun) {
-  return moveMethods(from, to, methods, methodMoveGate(from), dryRun);
-}
-var init_authoring = __esm({
-  "src/core/authoring.ts"() {
-    "use strict";
-    init_specs2();
-    init_validation();
-    init_candidate();
-    init_core();
-    init_fs();
-  }
-});
-
 // src/mcp/server.ts
 var server_exports = {};
 __export(server_exports, {
@@ -29567,6 +29946,30 @@ function qualifiedComponentId(id) {
   const chained = ids.filter((known) => known.endsWith(`::${bare}`));
   return chained.length === 1 ? chained[0] : id;
 }
+function publicInterfacesReplacement(subsystem, stored, list2) {
+  const identity = (pi) => pi.component ? `${pi.component}${pi.interface ? `.${pi.interface}` : ""}` : `${pi.type} ${pi.details}`;
+  const restated = /* @__PURE__ */ new Map();
+  for (const pi of list2) restated.set(identity(pi), (restated.get(identity(pi)) ?? 0) + 1);
+  const twice = [...restated].filter(([, n]) => n > 1).map(([key]) => `"${key}"`);
+  if (twice.length) {
+    return `Refusing to set the public interfaces of subsystem "${subsystem}": the list names ${twice.join(", ")} more than once. An entry is identified by the component and interface it is bound to \u2014 or, not yet bound, by its type and details \u2014 so two entries sharing one are the same entry stated twice. Drop the duplicate. Nothing was written.`;
+  }
+  const seen = /* @__PURE__ */ new Map();
+  const deletes = [];
+  for (const pi of stored) {
+    const key = identity(pi);
+    seen.set(key, (seen.get(key) ?? 0) + 1);
+    if (seen.get(key) > (restated.get(key) ?? 0)) {
+      deletes.push(pi.component ? { component: pi.component, interface: pi.interface, action: "delete" } : { type: pi.type, details: pi.details, action: "delete" });
+    }
+  }
+  const restatedEntries = list2.map((pi) => {
+    const prev = stored.find((s) => identity(s) === identity(pi));
+    const dropped = prev ? Object.keys(prev).filter((f) => prev[f] !== void 0 && pi[f] === void 0) : [];
+    return dropped.length ? { ...pi, unset: dropped } : pi;
+  });
+  return { publicInterfaces: [...deletes, ...restatedEntries] };
+}
 function text(content) {
   return { content: [{ type: "text", text: content }] };
 }
@@ -29576,6 +29979,9 @@ function json(value) {
 function errText(message) {
   return { content: [{ type: "text", text: `Error: ${message}` }], isError: true };
 }
+function errMessage(e) {
+  return errText(e instanceof Error ? e.message : String(e));
+}
 function structured(content, data) {
   return { content: [{ type: "text", text: content }], structuredContent: data };
 }
@@ -29593,25 +29999,30 @@ function renderChangeReport(report2) {
     lines.push("", "NO EFFECT:", ...report2.ineffective.map((i) => `- ${i}`));
   }
   if (report2.notices.length) lines.push("", "NOTICE:", ...report2.notices.map((n) => `- ${n}`));
-  if (report2.testsToRevisit.length) {
-    lines.push("", "TESTS TO REVISIT:");
-    for (const entry of report2.testsToRevisit) {
-      lines.push(`- ${entry.method} (searched as "${entry.symbol}")`);
-      if (entry.imported.length) lines.push(`  imports it: ${entry.imported.join(", ")}`);
-      if (entry.mentioned.length) lines.push(`  names it: ${entry.mentioned.join(", ")}`);
-      if (entry.indiscriminate) {
-        lines.push("  names it: withheld \u2014 the bare name matches more than a tenth of the suite, so the list carries no signal.");
-      }
+  lines.push(...renderTestsToRevisit(report2.testsToRevisit));
+  return lines.join("\n");
+}
+function renderTestsToRevisit(entries) {
+  if (!entries.length) return [];
+  const lines = ["", "TESTS TO REVISIT:"];
+  for (const entry of entries) {
+    lines.push(`- ${entry.method} (searched as "${entry.symbol}")`);
+    if (entry.imported.length) lines.push(`  imports it: ${entry.imported.join(", ")}`);
+    if (entry.mentioned.length) lines.push(`  names it: ${entry.mentioned.join(", ")}`);
+    if (entry.indiscriminate) {
+      lines.push("  names it: withheld \u2014 the bare name matches more than a tenth of the suite, so the list carries no signal.");
     }
   }
-  return lines.join("\n");
+  return lines;
 }
 function writeReceipt(sentence, receipt) {
   const noticeBlock = receipt.notices.length ? `
 
 NOTICE:
 - ${receipt.notices.join("\n- ")}` : "";
-  return structured(`${sentence}${noticeBlock}`, receipt);
+  const testsBlock = renderTestsToRevisit(receipt.testsToRevisit).join("\n");
+  return structured(`${sentence}${noticeBlock}${testsBlock ? `
+${testsBlock}` : ""}`, receipt);
 }
 function captureBuildStamp(entryPath) {
   try {
@@ -29653,74 +30064,6 @@ function reg(server, name, config, cb) {
   const strictConfig = config.inputSchema ? { ...config, inputSchema: import_zod11.z.object(config.inputSchema).strict() } : config;
   server.registerTool(name, strictConfig, guarded);
 }
-function statusForCreate(label, stated, existing) {
-  const stored = existing?.status;
-  const held = stored !== void 0 && STATUS_ORDER.includes(stored) ? stored : void 0;
-  if (stated === void 0) return { status: held ?? "draft" };
-  if (held === void 0) return { status: stated };
-  const rank = (s) => STATUS_ORDER.indexOf(s);
-  if (rank(stated) < rank(held)) {
-    return {
-      refusal: `Refusing to re-author ${label} at status "${stated}": it is stored at "${held}", and a create tool never lowers a spec's status \u2014 a restatement that reopened a frozen spec would undo a lock without saying so. Nothing was written. To reopen it deliberately, use sdd_update_spec with {"status": "${stated}"}; to keep the level it has, leave status out.`
-    };
-  }
-  return { status: stated };
-}
-function isEmptyValue(value) {
-  if (value === void 0 || value === null) return true;
-  if (Array.isArray(value)) return value.length === 0;
-  if (typeof value === "string") return value.trim() === "";
-  if (typeof value === "object") return Object.keys(value).length === 0;
-  return false;
-}
-function carryUnexpressed(existing, next, expressed) {
-  if (!existing) return [];
-  const carried = [];
-  for (const [field, value] of Object.entries(existing)) {
-    if (value === void 0) continue;
-    if (STORE_MANAGED_FIELDS.has(field)) continue;
-    if (expressed.includes(field) && !ALWAYS_CARRIED_FIELDS.has(field)) continue;
-    if (next[field] !== void 0) continue;
-    next[field] = value;
-    carried.push(field);
-  }
-  return carried;
-}
-function clearedByOmission(existing, next, expressed) {
-  if (!existing) return [];
-  const cleared = [];
-  for (const field of expressed) {
-    const before = existing[field];
-    if (STORE_MANAGED_FIELDS.has(field) || ALWAYS_CARRIED_FIELDS.has(field)) continue;
-    if (isEmptyValue(before) || !isEmptyValue(next[field])) continue;
-    cleared.push(Array.isArray(before) ? `${field} (had ${before.length})` : field);
-  }
-  return cleared;
-}
-function removedByName(before, after) {
-  if (!before?.length) return [];
-  const kept = new Set((after ?? []).map((m) => m.name));
-  return before.map((m) => m.name).filter((n) => !kept.has(n));
-}
-function rewriteNotices(opts) {
-  const notices = [`${opts.label} already existed \u2014 re-authored in place; this input REPLACES what it expresses.`];
-  if (opts.carried.length) {
-    notices.push(`Carried forward (not expressible through this tool): ${opts.carried.join(", ")}.`);
-  }
-  if (opts.removed.length) {
-    const noun = opts.removedNoun ?? "method";
-    const plural = opts.removed.length === 1 ? noun : `${noun}s`;
-    notices.push(
-      `REMOVED by this restatement: ${plural} ${opts.removed.map((n) => `"${n}"`).join(", ")}${opts.removedSuffix ?? ""} \u2014 absent from the input, so no longer in the spec. Restate them to keep them, or use sdd_update_spec to edit one member at a time.`
-    );
-  }
-  if (opts.cleared.length) {
-    notices.push(
-      `CLEARED by omission: ${opts.cleared.join(", ")} \u2014 the argument was not repeated, so the previous value is gone. Use sdd_update_spec if you meant to leave it untouched.`
-    );
-  }
-  return notices;
-}
 function listSkillResources2() {
   return listResources();
 }
@@ -29975,30 +30318,24 @@ function createMcpServer(options = {}) {
     },
     ({ name, vision, boundaries, globalRequirements, targetLanguage }) => {
       try {
-        const { loadSystemSpec: loadSystemSpec3, saveSystemSpec: saveSystemSpec2 } = requireSpecs();
-        const now = (/* @__PURE__ */ new Date()).toISOString();
-        const existing = loadSystemSpec3();
-        const next = {
-          name,
-          vision,
-          boundaries: boundaries ?? [],
-          globalRequirements: globalRequirements ?? [],
-          ...targetLanguage ? { targetLanguage } : {}
+        const restatement = {
+          kind: "system",
+          spec: {
+            name,
+            vision,
+            boundaries: boundaries ?? [],
+            globalRequirements: globalRequirements ?? [],
+            ...targetLanguage ? { targetLanguage } : {}
+          },
+          fields: systemInputFields
         };
-        const carried = carryUnexpressed(existing, next, systemInputFields);
-        const cleared = clearedByOmission(existing, next, systemInputFields);
-        next.schemaVersion ??= "1.0.0";
-        next.databases ??= [];
-        next.createdAt ??= now;
-        next.updatedAt = now;
-        saveSystemSpec2(next);
-        const notices = existing ? rewriteNotices({ label: `System spec "${existing.name}"`, carried, cleared, removed: [] }) : [];
+        const receipt = writeSpec(restatement);
         return writeReceipt(
-          `Successfully ${existing ? "re-authored" : "initialized"} L0 System Spec for "${name}".`,
-          { kind: "system", id: "system", name, replacedExisting: Boolean(existing), notices }
+          `Successfully ${receipt.replacedExisting ? "re-authored" : "initialized"} L0 System Spec for "${name}".`,
+          receipt
         );
       } catch (e) {
-        return errText(String(e));
+        return errMessage(e);
       }
     }
   );
@@ -30010,7 +30347,8 @@ function createMcpServer(options = {}) {
       type: import_zod11.z.enum(["REST", "GraphQL", "MessageBus", "RPC", "Custom"]),
       details: import_zod11.z.string(),
       component: import_zod11.z.string().optional().describe("The L2 component id that realizes this interface (this subsystem's published surface)"),
-      interface: import_zod11.z.string().optional().describe("Optional L3 interface id on that component backing this entry")
+      interface: import_zod11.z.string().optional().describe("Optional L3 interface id on that component backing this entry"),
+      consumers: import_zod11.z.array(import_zod11.z.string()).optional().describe("The subsystem ids this surface is published to. Absent, any subsystem may depend on the component; present, only these may \u2014 when every entry publishing the component names consumers, the union of the lists is the whole set, and a dependency from any other subsystem is CROSS_SUBSYSTEM_UNLISTED_CONSUMER. Every id must name a subsystem of the tree (PUBLIC_INTERFACE_UNKNOWN_CONSUMER).")
     }).strict()).optional().describe("Public entrypoints exposed by this subsystem, each bound to a realizing component"),
     projectPath: import_zod11.z.string().optional().describe("Relative path to external project root for subsystem chaining"),
     targetLanguage: import_zod11.z.string().optional().describe("Override of the system-level targetLanguage for this subsystem"),
@@ -30039,53 +30377,33 @@ function createMcpServer(options = {}) {
     },
     ({ id, name, description, publicInterfaces, projectPath, targetLanguage, profile, designDepth, trustedLinks, lifecycle, status: status2 }) => {
       try {
-        const { loadSystemSpec: loadSystemSpec3, loadSubsystemSpec: loadSubsystemSpec2, saveSubsystemSpec: saveSubsystemSpec2 } = requireSpecs();
-        const system = loadSystemSpec3();
-        if (!system) return errText("System spec must be initialized (sdd_initialize_system) first.");
-        const now = (/* @__PURE__ */ new Date()).toISOString();
-        const existing = loadSubsystemSpec2(id);
-        const resolved = statusForCreate(`subsystem "${id}"`, status2, existing);
-        if ("refusal" in resolved) return errText(resolved.refusal);
-        const spec = {
-          id,
-          name,
-          description,
-          parentSystem: system.name,
-          publicInterfaces: publicInterfaces ?? [],
-          projectPath,
-          ...targetLanguage ? { targetLanguage } : {},
-          ...profile ? { profile } : {},
-          ...designDepth ? { designDepth } : {},
-          ...lifecycle ? { lifecycle } : {},
-          trustedLinks: trustedLinks ?? [],
-          status: resolved.status,
-          createdAt: now,
-          updatedAt: now
-        };
-        const carried = carryUnexpressed(existing, spec, subsystemInputFields);
-        const cleared = clearedByOmission(existing, spec, subsystemInputFields);
-        if (existing) spec.createdAt = existing.createdAt;
-        const notices = existing ? rewriteNotices({ label: `Subsystem "${id}"`, carried: ["createdAt", ...carried], cleared, removed: [] }) : [];
-        const receipt = {
+        const restatement = {
           kind: "subsystem",
-          id,
-          name,
-          replacedExisting: Boolean(existing),
-          status: resolved.status,
-          notices
+          spec: {
+            id,
+            name,
+            description,
+            publicInterfaces: publicInterfaces ?? [],
+            projectPath,
+            ...targetLanguage ? { targetLanguage } : {},
+            ...profile ? { profile } : {},
+            ...designDepth ? { designDepth } : {},
+            ...lifecycle ? { lifecycle } : {},
+            trustedLinks: trustedLinks ?? []
+          },
+          fields: subsystemInputFields,
+          status: status2
         };
-        if (projectPath && projectPath.trim() !== "") {
-          const { createChainedSubsystem: createChainedSubsystem3 } = requireProvision();
-          createChainedSubsystem3(spec, name);
+        const receipt = writeSpec(restatement);
+        if (receipt.scaffoldedProjectPath) {
           return writeReceipt(
-            `Successfully added external subsystem "${name}" (${id}) and scaffolded its child project at ${projectPath}.`,
-            { ...receipt, scaffoldedProjectPath: projectPath }
+            `Successfully added external subsystem "${name}" (${id}) and scaffolded its child project at ${receipt.scaffoldedProjectPath}.`,
+            receipt
           );
         }
-        saveSubsystemSpec2(spec);
         return writeReceipt(`Successfully added L1 Subsystem Spec "${name}" (${id}).`, receipt);
       } catch (e) {
-        return errText(String(e));
+        return errMessage(e);
       }
     }
   );
@@ -30093,30 +30411,34 @@ function createMcpServer(options = {}) {
     server,
     "sdd_set_public_interfaces",
     {
-      description: "Set (replace) an existing subsystem's publicInterfaces, binding each to the component (and optional interface) that realizes it. Use this to backfill bindings once the subsystem's components exist \u2014 cross-subsystem dependencies may only target a published public component.",
+      description: "Set (replace) an existing subsystem's publicInterfaces, binding each to the component (and optional interface) that realizes it. Use this to backfill bindings once the subsystem's components exist \u2014 cross-subsystem dependencies may only target a published public component. A replacement, not a merge: an entry left out is removed. An entry's identity is its component and interface, so a list naming one identity twice is refused. Written through the authoring seam as one gated delta, and answered with the change report \u2014 every entry added, changed or removed, or that nothing changed \u2014 as structured content beside the sentence.",
       inputSchema: {
         subsystem: import_zod11.z.string().describe("The L1 subsystem id to update"),
         publicInterfaces: import_zod11.z.array(import_zod11.z.object({
           type: import_zod11.z.enum(["REST", "GraphQL", "MessageBus", "RPC", "Custom"]),
           details: import_zod11.z.string(),
           component: import_zod11.z.string().optional().describe("The L2 component id that realizes this interface"),
-          interface: import_zod11.z.string().optional().describe("Optional L3 interface id on that component")
+          interface: import_zod11.z.string().optional().describe("Optional L3 interface id on that component"),
+          consumers: import_zod11.z.array(import_zod11.z.string()).optional().describe("The subsystem ids this surface is published to. Absent, any subsystem may depend on the component; present, only these may \u2014 when every entry publishing the component names consumers, the union of the lists is the whole set, and a dependency from any other subsystem is CROSS_SUBSYSTEM_UNLISTED_CONSUMER. Every id must name a subsystem of the tree (PUBLIC_INTERFACE_UNKNOWN_CONSUMER).")
         }).strict()).describe("The full replacement list of public interfaces for this subsystem")
-      }
+      },
+      outputSchema: specChangeReportOutput
     },
     ({ subsystem, publicInterfaces }) => {
       try {
-        const { loadSubsystemSpec: loadSubsystemSpec2, saveSubsystemSpec: saveSubsystemSpec2 } = requireSpecs();
-        const sub = loadSubsystemSpec2(subsystem);
+        const { loadSubsystemSpec: loadSubsystemSpec3 } = requireSpecs();
+        const sub = loadSubsystemSpec3(subsystem);
         if (!sub) return errText(`Subsystem "${subsystem}" does not exist.`);
-        saveSubsystemSpec2({
-          ...sub,
-          publicInterfaces,
-          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
-        return text(`Updated public interfaces for subsystem "${subsystem}" (${publicInterfaces.length} ${publicInterfaces.length === 1 ? "entry" : "entries"}).`);
+        const delta = publicInterfacesReplacement(subsystem, sub.publicInterfaces ?? [], publicInterfaces);
+        if (typeof delta === "string") return errText(delta);
+        const report2 = updateSpecGated("subsystem", subsystem, delta);
+        return structured(
+          `Updated public interfaces for subsystem "${subsystem}" (${publicInterfaces.length} ${publicInterfaces.length === 1 ? "entry" : "entries"}).
+${renderChangeReport(report2)}`,
+          report2
+        );
       } catch (e) {
-        return errText(String(e));
+        return errMessage(e);
       }
     }
   );
@@ -30124,25 +30446,24 @@ function createMcpServer(options = {}) {
     server,
     "sdd_set_subsystem_project_path",
     {
-      description: "Set (or clear) the projectPath of an L1 Subsystem for subsystem chaining. projectPath should be a relative path to the external project root directory.",
+      description: "Set (or clear) the projectPath of an L1 Subsystem for subsystem chaining. projectPath should be a relative path to the external project root directory. It rewrites the link only (sdd_move_subsystem_project relocates the directory with it). Written through the authoring seam as a gated delta, and answered with the change report as structured content beside the sentence.",
       inputSchema: {
         subsystem: import_zod11.z.string().describe("The L1 subsystem id to update"),
         projectPath: import_zod11.z.string().optional().describe("Relative path to external project root (or omit to clear)")
-      }
+      },
+      outputSchema: specChangeReportOutput
     },
     ({ subsystem, projectPath }) => {
       try {
-        const { loadSubsystemSpec: loadSubsystemSpec2, saveSubsystemSpec: saveSubsystemSpec2 } = requireSpecs();
-        const sub = loadSubsystemSpec2(subsystem);
-        if (!sub) return errText(`Subsystem "${subsystem}" does not exist.`);
-        saveSubsystemSpec2({
-          ...sub,
-          projectPath,
-          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-        });
-        return text(`Updated projectPath for subsystem "${subsystem}" to: ${projectPath || "none (cleared)"}`);
+        const delta = projectPath ? { projectPath } : { unset: ["projectPath"] };
+        const report2 = updateSpecGated("subsystem", subsystem, delta);
+        return structured(
+          `Updated projectPath for subsystem "${subsystem}" to: ${projectPath || "none (cleared)"}
+${renderChangeReport(report2)}`,
+          report2
+        );
       } catch (e) {
-        return errText(String(e));
+        return errMessage(e);
       }
     }
   );
@@ -30315,53 +30636,37 @@ function createMcpServer(options = {}) {
     },
     ({ id, name, description, subsystem, componentType, owns, dependsOn, portalType, basePath, dispatch, mounts, durability, dependencyClass, emits, subscribesTo, ext, status: status2 }) => {
       try {
-        const { loadSubsystemSpec: loadSubsystemSpec2, loadComponentSpec: loadComponentSpec2 } = requireSpecs();
-        const sub = loadSubsystemSpec2(subsystem);
-        if (!sub) return errText(`Parent subsystem "${subsystem}" does not exist.`);
-        const now = (/* @__PURE__ */ new Date()).toISOString();
-        const existing = loadComponentSpec2(id);
-        const resolved = statusForCreate(`component "${id}"`, status2, existing);
-        if ("refusal" in resolved) return errText(resolved.refusal);
-        const candidate = {
-          id,
-          name,
-          description,
-          subsystem,
-          componentType,
-          owns: owns ?? [],
-          dependsOn: dependsOn ?? [],
-          ...portalType ? { portalType } : {},
-          ...basePath ? { basePath } : {},
-          ...dispatch ? { dispatch } : {},
-          // An EMPTY list is kept: declaring the field is what marks a listener.
-          ...mounts ? { mounts } : {},
-          ...durability ? { durability } : {},
-          ...dependencyClass ? { dependencyClass } : {},
-          ...emits ? { emits } : {},
-          ...subscribesTo ? { subscribesTo } : {},
-          ...ext ? { ext } : {},
-          status: resolved.status,
-          createdAt: now,
-          updatedAt: now
+        const restatement = {
+          kind: "component",
+          spec: {
+            id,
+            name,
+            description,
+            subsystem,
+            componentType,
+            owns: owns ?? [],
+            dependsOn: dependsOn ?? [],
+            ...portalType ? { portalType } : {},
+            ...basePath ? { basePath } : {},
+            ...dispatch ? { dispatch } : {},
+            // An EMPTY list is kept: declaring the field is what marks a listener.
+            ...mounts ? { mounts } : {},
+            ...durability ? { durability } : {},
+            ...dependencyClass ? { dependencyClass } : {},
+            ...emits ? { emits } : {},
+            ...subscribesTo ? { subscribesTo } : {},
+            ...ext ? { ext } : {}
+          },
+          fields: componentInputFields,
+          status: status2
         };
-        const carried = carryUnexpressed(existing, candidate, componentInputFields);
-        const cleared = clearedByOmission(existing, candidate, componentInputFields);
-        if (existing) candidate.createdAt = existing.createdAt;
-        const notices = addComponent(candidate);
-        if (existing) {
-          notices.push(...rewriteNotices({
-            label: `Component "${id}"`,
-            carried: ["createdAt", ...carried],
-            cleared,
-            removed: []
-          }));
-        }
+        const receipt = writeSpec(restatement);
         return writeReceipt(
-          `Successfully ${existing ? "re-authored" : "added"} L2 Component Spec "${name}" (${id}, ${componentType}).`,
-          { kind: "component", id, name, replacedExisting: Boolean(existing), status: resolved.status, notices }
+          `Successfully ${receipt.replacedExisting ? "re-authored" : "added"} L2 Component Spec "${name}" (${id}, ${componentType}).`,
+          receipt
         );
       } catch (e) {
-        return errText(String(e));
+        return errMessage(e);
       }
     }
   );
@@ -30411,51 +30716,20 @@ function createMcpServer(options = {}) {
     },
     ({ id, name, description, component, methods, status: status2 }) => {
       try {
-        const { loadComponentSpec: loadComponentSpec2, loadInterfaceSpec: loadInterfaceSpec2, saveInterfaceSpec: saveInterfaceSpec2 } = requireSpecs();
-        const comp = loadComponentSpec2(component);
-        if (!comp) return errText(`Component "${component}" does not exist.`);
-        const now = (/* @__PURE__ */ new Date()).toISOString();
-        const existing = loadInterfaceSpec2(id);
-        const resolved = statusForCreate(`interface "${id}"`, status2, existing);
-        if ("refusal" in resolved) return errText(resolved.refusal);
-        const carried = [];
-        const specMethods = (methods ?? []).map((m) => {
-          const prev = existing?.methods.find((p) => p.name === m.name);
-          const next = { ...m };
-          for (const field of carryUnexpressed(prev, next, interfaceMethodInputFields)) {
-            carried.push(`${field} (${m.name})`);
-          }
-          return next;
-        });
-        const spec = {
-          id,
-          name,
-          description,
-          component,
-          methods: specMethods,
-          status: resolved.status,
-          createdAt: now,
-          updatedAt: now
+        const restatement = {
+          kind: "interface",
+          spec: { id, name, description, component, methods: methods ?? [] },
+          fields: interfaceInputFields,
+          memberFields: interfaceMethodInputFields,
+          status: status2
         };
-        carried.push(...carryUnexpressed(existing, spec, interfaceInputFields));
-        const cleared = clearedByOmission(existing, spec, interfaceInputFields);
-        if (existing) spec.createdAt = existing.createdAt;
-        const notices = saveInterfaceSpec2(spec);
-        if (existing) {
-          notices.push(...rewriteNotices({
-            label: `Interface "${id}"`,
-            carried: ["createdAt", ...carried],
-            cleared,
-            removed: removedByName(existing.methods, specMethods),
-            removedSuffix: " (endpoint bindings included)"
-          }));
-        }
+        const receipt = writeSpec(restatement);
         return writeReceipt(
-          `Successfully ${existing ? "re-authored" : "defined"} L3 Interface Contract "${name}" (${id}).`,
-          { kind: "interface", id, name, replacedExisting: Boolean(existing), status: resolved.status, notices }
+          `Successfully ${receipt.replacedExisting ? "re-authored" : "defined"} L3 Interface Contract "${name}" (${id}).`,
+          receipt
         );
       } catch (e) {
-        return errText(String(e));
+        return errMessage(e);
       }
     }
   );
@@ -30463,7 +30737,7 @@ function createMcpServer(options = {}) {
     server,
     "sdd_set_endpoints",
     {
-      description: "Bind concrete wire endpoints to existing L3 interface methods (required for every Portal). Pick `transport` and fill that transport's address fields. Run after sdd_define_interface.",
+      description: "Bind concrete wire endpoints to existing L3 interface methods (required for every Portal). Pick `transport` and fill that transport's address fields. Run after sdd_define_interface. Written through the authoring seam as one gated delta, and answered with the change report \u2014 every binding set or changed, or that nothing changed \u2014 as structured content beside the sentence.",
       inputSchema: {
         interface: import_zod11.z.string().describe('The L3 interface ID (e.g. "ibilling-gateway")'),
         endpoints: import_zod11.z.array(import_zod11.z.object({
@@ -30484,11 +30758,12 @@ function createMcpServer(options = {}) {
           command: import_zod11.z.string().optional().describe("CLI: command/subcommand"),
           address: import_zod11.z.string().optional().describe("Custom: free-form address")
         }).strict()).describe("One binding per method")
-      }
+      },
+      outputSchema: specChangeReportOutput
     },
     ({ interface: interfaceId, endpoints }) => {
       try {
-        const { loadInterfaceSpec: loadInterfaceSpec2, saveInterfaceSpec: saveInterfaceSpec2 } = requireSpecs();
+        const { loadInterfaceSpec: loadInterfaceSpec2 } = requireSpecs();
         const intf = loadInterfaceSpec2(interfaceId);
         if (!intf) return errText(`Interface "${interfaceId}" does not exist.`);
         const buildRaw = (e) => {
@@ -30512,6 +30787,7 @@ function createMcpServer(options = {}) {
           }
         };
         const bound2 = [];
+        const methods = [];
         for (const e of endpoints) {
           const m = intf.methods.find((x) => x.name === e.method);
           if (!m) return errText(`Method "${e.method}" not found on interface "${interfaceId}". Define it via sdd_define_interface first.`);
@@ -30520,14 +30796,17 @@ function createMcpServer(options = {}) {
             const detail = parsed.error.issues.map((i) => `${i.path.join(".") || "(root)"}: ${i.message}`).join("; ");
             return errText(`Invalid ${e.transport} endpoint for method "${e.method}": ${detail}`);
           }
-          m.endpoint = parsed.data;
+          methods.push({ name: e.method, endpoint: parsed.data });
           bound2.push(`${e.method}\u2192${e.transport}`);
         }
-        intf.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-        saveInterfaceSpec2(intf);
-        return text(`Bound ${bound2.length} endpoint(s) on "${interfaceId}": ${bound2.join(", ")}.`);
+        const report2 = updateSpecGated("interface", interfaceId, { methods });
+        return structured(
+          `Bound ${bound2.length} endpoint(s) on "${interfaceId}": ${bound2.join(", ")}.
+${renderChangeReport(report2)}`,
+          report2
+        );
       } catch (e) {
-        return errText(String(e));
+        return errMessage(e);
       }
     }
   );
@@ -30607,65 +30886,35 @@ function createMcpServer(options = {}) {
     },
     ({ id, name, description, contract, sourcePath, simPath, technologies, injectedParams, detail, conformance, methods, status: status2 }) => {
       try {
-        const { loadInterfaceSpec: loadInterfaceSpec2, loadImplementationSpec: loadImplementationSpec2, saveImplementationSpec: saveImplementationSpec2 } = requireSpecs();
-        const intf = loadInterfaceSpec2(contract);
-        if (!intf) return errText(`Interface contract "${contract}" does not exist.`);
-        const existing = loadImplementationSpec2(id);
-        const resolved = statusForCreate(`implementation "${id}"`, status2, existing);
-        if ("refusal" in resolved) return errText(resolved.refusal);
-        const carried = [];
-        const resolvedMethods = (methods ?? []).map((m) => {
-          const prev = existing?.methods.find((p) => p.name === m.name);
-          const next = {
-            ...m,
-            narrative: (m.narrative ?? []).map((s, i) => ({ ...s, stepNumber: s.stepNumber ?? i + 1 }))
-          };
-          for (const field of carryUnexpressed(prev, next, implMethodInputFields)) {
-            carried.push(`${field} (${m.name})`);
-          }
-          return next;
-        });
-        const labelErrors = resolvedMethods.flatMap((m) => resolveNarrativeLabels(m.name, m.narrative));
-        if (labelErrors.length) return errText(`Unresolved narrative label references \u2014 nothing was saved:
-- ${labelErrors.join("\n- ")}`);
-        const now = (/* @__PURE__ */ new Date()).toISOString();
-        const spec = {
-          id,
-          name,
-          description,
-          contract,
-          sourcePath,
-          simPath,
-          technologies,
-          injectedParams,
-          detail,
-          conformance,
-          // Post-resolution every cases/catches entry has its numeric step —
-          // the *Label twins exist only in the input type, not the spec's.
-          methods: resolvedMethods,
-          status: resolved.status,
-          createdAt: now,
-          updatedAt: now
+        const restatement = {
+          kind: "implementation",
+          spec: {
+            id,
+            name,
+            description,
+            contract,
+            sourcePath,
+            simPath,
+            technologies,
+            injectedParams,
+            detail,
+            conformance,
+            methods: (methods ?? []).map((m) => ({
+              ...m,
+              narrative: (m.narrative ?? []).map((s, i) => ({ ...s, stepNumber: s.stepNumber ?? i + 1 }))
+            }))
+          },
+          fields: implInputFields,
+          memberFields: implMethodInputFields,
+          status: status2
         };
-        carried.push(...carryUnexpressed(existing, spec, implInputFields));
-        const cleared = clearedByOmission(existing, spec, implInputFields);
-        if (existing) spec.createdAt = existing.createdAt;
-        const notices = saveImplementationSpec2(spec);
-        if (existing) {
-          notices.push(...rewriteNotices({
-            label: `Implementation "${id}"`,
-            carried: ["createdAt", ...carried],
-            cleared,
-            removed: removedByName(existing.methods, resolvedMethods),
-            removedSuffix: " (L5 narratives included)"
-          }));
-        }
+        const receipt = writeSpec(restatement);
         return writeReceipt(
           `Successfully saved L4 Implementation Spec "${name}" (${id}) with method narratives.`,
-          { kind: "implementation", id, name, replacedExisting: Boolean(existing), status: resolved.status, notices }
+          receipt
         );
       } catch (e) {
-        return errText(String(e));
+        return errMessage(e);
       }
     }
   );
@@ -30714,9 +30963,6 @@ function createMcpServer(options = {}) {
     },
     ({ kind, id, name, description, subsystem, group, fields, methods, componentClass, invariants, database, table, linkedEntity, sourcePath, symbol }) => {
       try {
-        const { loadTypeSpec: loadTypeSpec2, saveTypeSpec: saveTypeSpec2 } = requireSpecs();
-        const now = (/* @__PURE__ */ new Date()).toISOString();
-        const existing = loadTypeSpec2(id);
         const spec = {
           kind,
           id,
@@ -30739,32 +30985,15 @@ function createMcpServer(options = {}) {
           ...table ? { table } : {},
           ...linkedEntity ? { linkedEntity } : {},
           ...sourcePath ? { sourcePath } : {},
-          ...symbol ? { symbol } : {},
-          createdAt: now,
-          updatedAt: now
+          ...symbol ? { symbol } : {}
         };
-        const carried = carryUnexpressed(existing, spec, typeInputFields);
-        const cleared = clearedByOmission(existing, spec, typeInputFields);
-        if (existing) spec.createdAt = existing.createdAt;
-        const notices = saveTypeSpec2(spec);
-        if (existing) {
-          notices.push(...rewriteNotices({
-            label: `Type "${id}"`,
-            carried: ["createdAt", ...carried],
-            cleared,
-            removed: [
-              ...removedByName(existing.fields, spec.fields).map((n) => `field ${n}`),
-              ...removedByName(existing.methods, spec.methods).map((n) => `method ${n}`)
-            ],
-            removedNoun: "member"
-          }));
-        }
+        const receipt = writeSpec({ kind: "type", spec, fields: typeInputFields });
         return writeReceipt(
-          `Successfully ${existing ? "re-authored" : "defined"} ${kind} type "${name}" (${id}).`,
-          { kind: "type", id, name, replacedExisting: Boolean(existing), notices }
+          `Successfully ${receipt.replacedExisting ? "re-authored" : "defined"} ${kind} type "${name}" (${id}).`,
+          receipt
         );
       } catch (e) {
-        return errText(String(e));
+        return errMessage(e);
       }
     }
   );
@@ -30883,35 +31112,20 @@ function createMcpServer(options = {}) {
     server,
     "sdd_delete_spec",
     {
-      description: "Delete a specification file from the spec tree and clean up any empty parent directories.",
+      description: "Delete a specification file from the spec tree and clean up any empty parent directories. Answers with a structured deletion beside the sentence: whether a spec was removed, and the tests that encode a method the deletion took away (when the project declares test roots).",
       inputSchema: {
         kind: import_zod11.z.enum(["subsystem", "component", "interface", "implementation", "type"]).describe("The kind of spec to delete"),
         id: import_zod11.z.string().describe("The ID of the spec to delete")
-      }
+      },
+      outputSchema: specDeletionOutput
     },
     ({ kind, id }) => {
       try {
-        const specs = requireSpecs();
-        let deleted = false;
-        switch (kind) {
-          case "subsystem":
-            deleted = specs.deleteSubsystemSpec(id);
-            break;
-          case "component":
-            deleted = specs.deleteComponentSpec(id);
-            break;
-          case "interface":
-            deleted = specs.deleteInterfaceSpec(id);
-            break;
-          case "implementation":
-            deleted = specs.deleteImplementationSpec(id);
-            break;
-          case "type":
-            deleted = specs.deleteTypeSpec(id);
-            break;
-        }
-        if (!deleted) return errText(`Spec of kind "${kind}" with ID "${id}" could not be deleted (file may not exist).`);
-        return text(`Successfully deleted ${kind} spec "${id}".`);
+        const deletion = deleteSpec2(kind, id);
+        if (!deletion.deleted) return errText(`Spec of kind "${kind}" with ID "${id}" could not be deleted (file may not exist).`);
+        const testsBlock = renderTestsToRevisit(deletion.testsToRevisit).join("\n");
+        return structured(`Successfully deleted ${kind} spec "${id}".${testsBlock ? `
+${testsBlock}` : ""}`, deletion);
       } catch (e) {
         return errText(String(e));
       }
@@ -30925,7 +31139,7 @@ function createMcpServer(options = {}) {
       inputSchema: {
         kind: import_zod11.z.enum(["system", "subsystem", "component", "interface", "implementation", "type"]).describe("The spec kind to update (system = the singleton L0 \u2014 vision, boundaries, globalRequirements, databases, and publicInterfaces: the project gateway surface, each entry {id, name, subsystem, component, type, details, audience: project|department|instance|partner|external}; id is informational)"),
         id: import_zod11.z.string().describe("The ID of the spec to update (namespaced if needed)"),
-        delta: import_zod11.z.record(import_zod11.z.any()).describe(`The partial fields to merge into the spec. ARRAYS UPSERT, they do not replace: an array whose elements carry an identity is merged element-by-element, so a delta naming ONE element leaves the others intact. Identity is "name" or "id" by default, and per field: dispatch by "capability", a listener's mounts by "portal", lifecycle by phase+component+method, emits/subscribesTo by topic+event, trustedLinks by "subsystem", invariants and patterns by "id", lint.allow by "code" AND "at" (an allow covers one occurrence, so several may share a code on one spec), an interface method's findings by "code", boundaries by "name", globalRequirements by "description", switch cases by "value", try catches by "error". Identity merging applies at EVERY depth, including an array INSIDE an element (a method's params, a step's catches). Add "action: 'delete'" (or "remove: true") alongside that identity to REMOVE an element \u2014 including a stale lint allow. Arrays of plain STRINGS (owns, dependsOn, guarantees) carry no per-element identity and are replaced wholesale; pass [] to clear any array outright. To REMOVE an optional field entirely, list it in "unset": e.g. {"unset": ["basePath", "variant"]} \u2014 passing null/undefined means "no change" (they are skipped), and writing "" would leave the field present but empty, which is a different and usually wrong spec. Unsetting a required field is refused by schema validation, which names it. For narrative steps, match by "stepNumber" and use "action: 'insert'" (shifts subsequent steps up) or "action: 'delete'" (shifts subsequent steps down and removes it). Step entries apply in ASCENDING stepNumber order, each against the numbering the earlier entries of the SAME delta left behind \u2014 delete step 3 and step 7 becomes step 6 \u2014 so prefer labels, and restate the step's "label" or "description" on a delete to have it checked against the step actually addressed. Renumbering RELOCATES every flow jump field (onTrueStep/onFalseStep/cases.step/defaultStep/endStep/catches.step/finallyStep/toStep) in the same narrative. A delete is REJECTED when the narrative has no such step, when a jump still targets it (retarget the referrers first), when a restated label/description does not match, or when it is a loop/try/parallel header whose body would be left standing (retype the header first to dissolve the region, then delete it). Changing a step's "type" REBUILDS it for the new type: its description and label are kept and every field the new type cannot carry is dropped (returned as a NOTICE); a delta that retypes AND sets such a field is refused. A step delta is also refused when it carries a marker the merge does not recognise: a non-boolean "remove", an "action" that is neither "insert" nor "delete", a "captureJumps" outside an insert, or no "stepNumber" to address. Inserting AT a jump target relocates those jumps past the inserted step by default (a NOTICE is returned) \u2014 add "captureJumps": true on the inserted step to retarget entry jumps onto it (loop/try endStep region tails always relocate with the body and are never captured). Every jump field has a "*Label" twin (toLabel, onFalseLabel, endLabel, \u2026, and "label" on a cases/catches entry) resolved against step labels AFTER the merge, so a delta may anchor on a label only pre-existing steps carry; a label the delta supplies REPLACES the stored number it twins, while setting the number and its label together in one delta is refused as a contradiction. Reference ids in deltas may use LOCAL names \u2014 they are qualified against the spec's namespace exactly as the loader would. Per-spec lint suppression: set "lint: { allow: [{ code, at, covers, reason }] }" to silence a WARNING code on this spec only (errors always surface; stale allows are flagged). An allow covers EXACTLY the occurrence it names: "at" is the site the finding names (a contract method, an import edge "from -> to", a declared edge "component -> target") and is REQUIRED for a code whose findings report one, while a finding that reports no site is covered only by an allow that names none; "covers" lists the units an aggregating finding reports, and the allow silences it only when every one is listed. This delta is deliberately OPEN below its top level \u2014 the shapes nest further than a schema here should restate \u2014 so a key that is not a field at its depth is not refused, it is NAMED BACK under NO EFFECT in the answer, together with any value the spec already held and any "unset" that removed nothing. Read that list: it is where a nested typo shows up.`),
+        delta: import_zod11.z.record(import_zod11.z.any()).describe(`The partial fields to merge into the spec. ARRAYS UPSERT, they do not replace: an array whose elements carry an identity is merged element-by-element, so a delta naming ONE element leaves the others intact. Identity is "name" or "id" by default, and per field: dispatch by "capability", a listener's mounts by "portal", lifecycle by phase+component+method, emits/subscribesTo by topic+event, trustedLinks by "subsystem", a subsystem's publicInterfaces by component+interface (or type+details for an entry not yet bound to a component), invariants and patterns by "id", lint.allow by "code" AND "at" (an allow covers one occurrence, so several may share a code on one spec), an interface method's findings by "code", boundaries by "name", globalRequirements by "description", switch cases by "value", try catches by "error". Identity merging applies at EVERY depth, including an array INSIDE an element (a method's params, a step's catches). Add "action: 'delete'" (or "remove: true") alongside that identity to REMOVE an element \u2014 including a stale lint allow. Arrays of plain STRINGS (owns, dependsOn, guarantees) carry no per-element identity and are replaced wholesale; pass [] to clear any array outright. To REMOVE an optional field entirely, list it in "unset": e.g. {"unset": ["basePath", "variant"]} \u2014 passing null/undefined means "no change" (they are skipped), and writing "" would leave the field present but empty, which is a different and usually wrong spec. Unsetting a required field is refused by schema validation, which names it. For narrative steps, match by "stepNumber" and use "action: 'insert'" (shifts subsequent steps up) or "action: 'delete'" (shifts subsequent steps down and removes it). Step entries apply in ASCENDING stepNumber order, each against the numbering the earlier entries of the SAME delta left behind \u2014 delete step 3 and step 7 becomes step 6 \u2014 so prefer labels, and restate the step's "label" or "description" on a delete to have it checked against the step actually addressed. Renumbering RELOCATES every flow jump field (onTrueStep/onFalseStep/cases.step/defaultStep/endStep/catches.step/finallyStep/toStep) in the same narrative. A delete is REJECTED when the narrative has no such step, when a jump still targets it (retarget the referrers first), when a restated label/description does not match, or when it is a loop/try/parallel header whose body would be left standing (retype the header first to dissolve the region, then delete it). Changing a step's "type" REBUILDS it for the new type: its description and label are kept and every field the new type cannot carry is dropped (returned as a NOTICE); a delta that retypes AND sets such a field is refused. A step delta is also refused when it carries a marker the merge does not recognise: a non-boolean "remove", an "action" that is neither "insert" nor "delete", a "captureJumps" outside an insert, or no "stepNumber" to address. Inserting AT a jump target relocates those jumps past the inserted step by default (a NOTICE is returned) \u2014 add "captureJumps": true on the inserted step to retarget entry jumps onto it (loop/try endStep region tails always relocate with the body and are never captured). Every jump field has a "*Label" twin (toLabel, onFalseLabel, endLabel, \u2026, and "label" on a cases/catches entry) resolved against step labels AFTER the merge, so a delta may anchor on a label only pre-existing steps carry; a label the delta supplies REPLACES the stored number it twins, while setting the number and its label together in one delta is refused as a contradiction. Reference ids in deltas may use LOCAL names \u2014 they are qualified against the spec's namespace exactly as the loader would. Per-spec lint suppression: set "lint: { allow: [{ code, at, covers, reason }] }" to silence a WARNING code on this spec only (errors always surface; stale allows are flagged). An allow covers EXACTLY the occurrence it names: "at" is the site the finding names (a contract method, an import edge "from -> to", a declared edge "component -> target") and is REQUIRED for a code whose findings report one, while a finding that reports no site is covered only by an allow that names none; "covers" lists the units an aggregating finding reports, and the allow silences it only when every one is listed. This delta is deliberately OPEN below its top level \u2014 the shapes nest further than a schema here should restate \u2014 so a key that is not a field at its depth is not refused, it is NAMED BACK under NO EFFECT in the answer, together with any value the spec already held and any "unset" that removed nothing. Read that list: it is where a nested typo shows up.`),
         dryRun: import_zod11.z.boolean().optional().describe("Ask what this delta WOULD do instead of doing it. The whole write runs, the candidate gate included, and the answer is the change report it would have produced \u2014 marked DRY RUN, with nothing stamped and not one byte of the stored file moved. Use it before a delta that renumbers a long narrative.")
       },
       outputSchema: specChangeReportOutput
@@ -31142,7 +31356,7 @@ async function startMcpServer() {
   } catch {
   }
 }
-var import_mcp, import_stdio, import_zod11, import_types3, fs21, path32, import_url, TYPE_REF_GRAMMAR, staleServerOutput, SPEC_KINDS, STATUS_ORDER, specWriteReceiptOutput, specChangeOutput, specChangeReportOutput, validationIssueOutput, validateTreeOutput, getSpecOutput, SERVER_BUILD_STAMP, STALE_SERVER_WARNING, SPEC_WRITE_TOOLS, listChangedEmitters, STORE_MANAGED_FIELDS, statusInput, ALWAYS_CARRIED_FIELDS, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
+var import_mcp, import_stdio, import_zod11, import_types3, fs21, path32, import_url, TYPE_REF_GRAMMAR, staleServerOutput, SPEC_KINDS, STATUS_VALUES, testsToRevisitOutput, specWriteReceiptOutput, specDeletionOutput, specChangeOutput, specChangeReportOutput, validationIssueOutput, validateTreeOutput, getSpecOutput, SERVER_BUILD_STAMP, STALE_SERVER_WARNING, SPEC_WRITE_TOOLS, listChangedEmitters, statusInput, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
 var init_server = __esm({
   "src/mcp/server.ts"() {
     "use strict";
@@ -31159,7 +31373,6 @@ var init_server = __esm({
     init_core();
     init_core();
     init_defaults();
-    init_narrative_labels();
     init_specs();
     init_skills();
     init_specs2();
@@ -31181,7 +31394,16 @@ var init_server = __esm({
       )
     };
     SPEC_KINDS = ["system", "subsystem", "component", "interface", "implementation", "type"];
-    STATUS_ORDER = ["draft", "design", "complete"];
+    STATUS_VALUES = ["draft", "design", "complete"];
+    testsToRevisitOutput = import_zod11.z.array(import_zod11.z.object({
+      method: import_zod11.z.string().describe("The contract method this write changed or deleted."),
+      symbol: import_zod11.z.string().describe("The code-level name searched for: the method's `symbol` when it declares one, else its name."),
+      imported: import_zod11.z.array(import_zod11.z.string()).describe("Test files that IMPORT that symbol \u2014 the high-confidence list, because an import is a binding and not a coincidence."),
+      mentioned: import_zod11.z.array(import_zod11.z.string()).describe("Test files that name the symbol without importing it \u2014 usually a test driving it through a portal. Empty when `indiscriminate` is true."),
+      indiscriminate: import_zod11.z.boolean().describe("True when the bare name matched more than a tenth of the test suite, so the mention list was withheld as noise.")
+    })).describe(
+      "The tests that encode a method this write changed or deleted, one entry per such method. Empty when the write touched no method, when the project declares no `rules.conformance.testRoots`, or when nothing references them. Read it before promising that existing tests still pass."
+    );
     specWriteReceiptOutput = {
       kind: import_zod11.z.enum(SPEC_KINDS).describe("The spec kind written."),
       id: import_zod11.z.string().describe('The id the spec is stored under; "system" for the L0 singleton.'),
@@ -31189,8 +31411,8 @@ var init_server = __esm({
       replacedExisting: import_zod11.z.boolean().describe(
         "True when a spec already held this id and the call re-authored it in place rather than adding one. The notices then say what was carried forward, removed or cleared by the restatement."
       ),
-      status: import_zod11.z.enum(STATUS_ORDER).optional().describe(
-        "The lifecycle status written. Absent for a type, which carries none."
+      status: import_zod11.z.enum(STATUS_VALUES).optional().describe(
+        "The lifecycle status written. Absent for the L0 and a type, which carry none."
       ),
       notices: import_zod11.z.array(import_zod11.z.string()).describe(
         "The notice lines the text answer lists, one per entry: what was carried forward, what a restatement removed, what an omission cleared, and every gate warning the write raised. Empty for a clean create."
@@ -31198,6 +31420,14 @@ var init_server = __esm({
       scaffoldedProjectPath: import_zod11.z.string().optional().describe(
         "The child project directory a chained subsystem's create scaffolded; absent for every other write."
       ),
+      testsToRevisit: testsToRevisitOutput,
+      ...staleServerOutput
+    };
+    specDeletionOutput = {
+      kind: import_zod11.z.enum(SPEC_KINDS).describe("The spec kind deleted."),
+      id: import_zod11.z.string().describe("The id the spec was stored under."),
+      deleted: import_zod11.z.boolean().describe("True when a spec document was removed."),
+      testsToRevisit: testsToRevisitOutput,
       ...staleServerOutput
     };
     specChangeOutput = {
@@ -31221,15 +31451,7 @@ var init_server = __esm({
       ),
       notices: import_zod11.z.array(import_zod11.z.string()).describe("Store placement notices, gate warnings and delta notices."),
       summary: import_zod11.z.string().describe("One line for people."),
-      testsToRevisit: import_zod11.z.array(import_zod11.z.object({
-        method: import_zod11.z.string().describe("The contract method this write changed or deleted."),
-        symbol: import_zod11.z.string().describe("The code-level name searched for: the method's `symbol` when it declares one, else its name."),
-        imported: import_zod11.z.array(import_zod11.z.string()).describe("Test files that IMPORT that symbol \u2014 the high-confidence list, because an import is a binding and not a coincidence."),
-        mentioned: import_zod11.z.array(import_zod11.z.string()).describe("Test files that name the symbol without importing it \u2014 usually a test driving it through a portal. Empty when `indiscriminate` is true."),
-        indiscriminate: import_zod11.z.boolean().describe("True when the bare name matched more than a tenth of the test suite, so the mention list was withheld as noise.")
-      })).describe(
-        "The tests that encode a method this write changed or deleted, one entry per such method. Empty when the write touched no method, when the project declares no `rules.conformance.testRoots`, or when nothing references them. Read it before promising that existing tests still pass."
-      ),
+      testsToRevisit: testsToRevisitOutput,
       ...staleServerOutput
     };
     validationIssueOutput = {
@@ -31303,11 +31525,9 @@ var init_server = __esm({
       "sdd_update_spec"
     ]);
     listChangedEmitters = /* @__PURE__ */ new WeakMap();
-    STORE_MANAGED_FIELDS = /* @__PURE__ */ new Set(["status", "updatedAt"]);
-    statusInput = import_zod11.z.enum(STATUS_ORDER).optional().describe(
+    statusInput = import_zod11.z.enum(STATUS_VALUES).optional().describe(
       "The spec's lifecycle status. Omitted means draft for a NEW spec and the status already stored for a re-authoring, so a restatement never reopens a frozen spec. State it to author straight at design or complete instead of promoting afterwards. A status that would LOWER the stored one is refused \u2014 reopening a spec for revision is sdd_update_spec's job, which sets the demotion deliberately."
     );
-    ALWAYS_CARRIED_FIELDS = /* @__PURE__ */ new Set(["ext"]);
     SKILL_RESOURCE_MIME = "text/markdown";
     AGENT_BRIEF_SCHEME = "wairon-agent://";
   }
@@ -31861,6 +32081,7 @@ init_errors();
 init_fs();
 init_core();
 init_core();
+init_authoring();
 init_core();
 function composeAgentBrief2(agentId) {
   return composeAgentBrief(agentId);
@@ -31886,8 +32107,11 @@ function projectConfigExists2() {
 function loadSystemSpec2() {
   return loadSystemSpec();
 }
-function createChainedSubsystem2(subsystem, projectName) {
-  createChainedSubsystem(subsystem, projectName);
+function loadSubsystemSpec2(id) {
+  return loadSubsystemSpec(id);
+}
+function writeSpec2(restatement) {
+  return writeSpec(restatement);
 }
 function resolveAgentTopology2() {
   return resolveAgentTopology();
@@ -31970,6 +32194,19 @@ function getStatusReport2(options, decor) {
 function approvalVerdict2() {
   return approvalVerdict();
 }
+function subsystemAddRestatement(id, projectPath, name, stored) {
+  const spec = { id, projectPath };
+  const fields = ["id", "projectPath"];
+  if (name !== void 0 || !stored) {
+    spec.name = name ?? id;
+    fields.push("name");
+  }
+  if (!stored) {
+    spec.description = `External subsystem ${spec.name}`;
+    fields.push("description");
+  }
+  return { kind: "subsystem", spec, fields };
+}
 async function runSubsystemAdd(id, options = {}) {
   logger.header("wairon subsystem add");
   if (!projectConfigExists2()) {
@@ -31984,23 +32221,12 @@ async function runSubsystemAdd(id, options = {}) {
   if (!system) {
     throw new WaironError("System spec is missing. Run `wairon init` first.");
   }
-  const displayName = options.name ?? id;
-  const now = (/* @__PURE__ */ new Date()).toISOString();
-  const subsystem = {
-    id,
-    name: displayName,
-    description: `External subsystem ${displayName}`,
-    parentSystem: system.name,
-    publicInterfaces: [],
-    projectPath: options.projectPath,
-    trustedLinks: [],
-    status: "draft",
-    createdAt: now,
-    updatedAt: now
-  };
-  createChainedSubsystem2(subsystem, displayName);
+  const stored = loadSubsystemSpec2(id);
+  const restatement = subsystemAddRestatement(id, options.projectPath, options.name, stored);
+  const receipt = writeSpec2(restatement);
   const childDir = path30.resolve(getProjectRoot(), options.projectPath);
-  logger.success(`Added external subsystem "${id}" \u2192 ${options.projectPath}`);
+  logger.success(`${receipt.replacedExisting ? "Re-authored" : "Added"} external subsystem "${id}" \u2192 ${options.projectPath}`);
+  for (const notice of receipt.notices) logger.info(notice);
   logger.info(`Scaffolded child project at ${path30.relative(process.cwd(), childDir) || "."}`);
   logger.info(`Design its spec tree from this parent using namespaced ids (e.g. ${id}::<component>).`);
 }
@@ -32136,20 +32362,16 @@ async function runInitAsExternalSubsystem(parentRoot, cwd, options) {
     if (!system) {
       throw new WaironError(`Parent project at ${parentRoot} has no system spec.`);
     }
-    const now = (/* @__PURE__ */ new Date()).toISOString();
-    const subsystem = {
-      id: subsystemId,
-      name: subsystemId,
-      description: `External subsystem ${subsystemId}`,
-      parentSystem: system.name,
-      publicInterfaces: [],
-      projectPath: relPath,
-      trustedLinks: [],
-      status: "draft",
-      createdAt: now,
-      updatedAt: now
-    };
-    createChainedSubsystem2(subsystem, subsystemId);
+    const stored = loadSubsystemSpec2(subsystemId);
+    const spec = { id: subsystemId, projectPath: relPath };
+    const fields = ["id", "projectPath"];
+    if (!stored) {
+      Object.assign(spec, { name: subsystemId, description: `External subsystem ${subsystemId}` });
+      fields.push("name", "description");
+    }
+    const restatement = { kind: "subsystem", spec, fields };
+    const receipt = writeSpec2(restatement);
+    for (const notice of receipt.notices) logger.info(notice);
   } finally {
     setProjectRoot(prevOverride);
   }
@@ -39217,8 +39439,8 @@ function buildEvaluation(input) {
   let unresolvedPacks;
   if (requiredDefaultResolution) {
     unresolvedPacks = requiredDefaultResolution.unresolved;
-    const canonical = [...new Set(requiredDefaultResolution.resolved.map((r) => r.name))];
-    missingPackNames = canonical.filter((n) => !present.has(n));
+    const canonical2 = [...new Set(requiredDefaultResolution.resolved.map((r) => r.name))];
+    missingPackNames = canonical2.filter((n) => !present.has(n));
   } else {
     missingPackNames = requiredDefaultNames(policy).filter((n) => !present.has(n));
     unresolvedPacks = [];