@wairon/cli 5.1.1-dev.81 → 5.1.1-dev.82

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.81";
+    WAIRON_VERSION = "5.1.1-dev.82";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     SUPPORTED_ALIASES = ["wai"];
     SCAN_EXCLUDE_DIRS = /* @__PURE__ */ new Set([
@@ -155,7 +155,7 @@ var init_logger = __esm({
 });
 
 // src/utils/errors.ts
-var WaironError, ProjectNotInitializedError, TemplateNotFoundError;
+var WaironError, ProjectNotInitializedError, TemplateNotFoundError, DoctorOptionsError, ChainingMigrationRefusedError;
 var init_errors = __esm({
   "src/utils/errors.ts"() {
     "use strict";
@@ -179,6 +179,20 @@ var init_errors = __esm({
         this.name = "TemplateNotFoundError";
       }
     };
+    DoctorOptionsError = class extends WaironError {
+      constructor(detail) {
+        super(`wairon doctor: ${detail}`);
+        this.name = "DoctorOptionsError";
+      }
+    };
+    ChainingMigrationRefusedError = class extends WaironError {
+      constructor(reasons) {
+        super(`The chaining migration was not applied; nothing was written:
+${reasons.map((r) => `  - ${r}`).join("\n")}`);
+        this.reasons = reasons;
+        this.name = "ChainingMigrationRefusedError";
+      }
+    };
   }
 });
 
@@ -1122,7 +1136,12 @@ function projectConfigFsAdapterAt(rootDir) {
       return readYamlFile(file());
     },
     writeDocument(document) {
-      writeYamlFile(file(), document);
+      const text2 = readFileOrNull(file());
+      if (text2 === null) {
+        writeYamlFile(file(), document);
+        return;
+      }
+      writeFile(file(), editDocumentText(text2, document, root));
     },
     documentExists() {
       return fs4.existsSync(file());
@@ -1216,21 +1235,21 @@ function childrenOf(tokens, index) {
   }
   return out;
 }
-function locateScalar(tokens, path76) {
+function locateScalar(tokens, path77) {
   let region = tokens;
-  for (let k = 0; k < path76.length; k += 1) {
-    const segment = path76[k];
-    if (region.length === 0) return `nothing is nested at ${path76.slice(0, k).join(".")}`;
+  for (let k = 0; k < path77.length; k += 1) {
+    const segment = path77[k];
+    if (region.length === 0) return `nothing is nested at ${path77.slice(0, k).join(".")}`;
     const base = Math.min(...region.map((t) => t.col));
-    const last = k === path76.length - 1;
+    const last = k === path77.length - 1;
     let at;
     if (typeof segment === "string") {
       at = region.findIndex((t) => t.kind === "key" && t.col === base && t.name === segment);
-      if (at < 0) return `no block key "${segment}" at ${path76.slice(0, k).join(".") || "the document root"}`;
+      if (at < 0) return `no block key "${segment}" at ${path77.slice(0, k).join(".") || "the document root"}`;
       if (last) return region[at].valueStart !== void 0 ? region[at] : `"${segment}" holds no inline scalar`;
     } else {
       const items = region.map((t, i) => ({ t, i })).filter(({ t }) => t.kind === "item" && t.col === base);
-      if (segment >= items.length) return `no block sequence item ${segment} at ${path76.slice(0, k).join(".")}`;
+      if (segment >= items.length) return `no block sequence item ${segment} at ${path77.slice(0, k).join(".")}`;
       at = items[segment].i;
       if (last) {
         const value = region[at + 1];
@@ -1278,10 +1297,10 @@ function writeScalar(value, style) {
   if (style === "plain" && /^[A-Za-z0-9_][A-Za-z0-9_./-]*$/.test(value)) return value;
   return `'${value.replace(/'/g, "''")}'`;
 }
-function setAt(document, path76, value) {
+function setAt(document, path77, value) {
   let node = document;
-  for (const segment of path76.slice(0, -1)) node = node[segment];
-  node[path76[path76.length - 1]] = value;
+  for (const segment of path77.slice(0, -1)) node = node[segment];
+  node[path77[path77.length - 1]] = value;
 }
 function rewriteScalarsInText(text2, edits, root) {
   const refuse = (why) => {
@@ -1309,6 +1328,95 @@ function rewriteScalarsInText(text2, edits, root) {
   }
   return next;
 }
+function sameValue(a, b) {
+  if (a instanceof Date || b instanceof Date) {
+    return a instanceof Date && b instanceof Date && a.getTime() === b.getTime();
+  }
+  if (Array.isArray(a) || Array.isArray(b)) {
+    return Array.isArray(a) && Array.isArray(b) && a.length === b.length && a.every((item, i) => sameValue(item, b[i]));
+  }
+  if (isPlainObject(a) || isPlainObject(b)) {
+    if (!isPlainObject(a) || !isPlainObject(b)) return false;
+    const keysA = Object.keys(a).filter((k) => a[k] !== void 0);
+    const keysB = Object.keys(b).filter((k) => b[k] !== void 0);
+    return keysA.length === keysB.length && keysA.every((k) => hasOwn(b, k) && sameValue(a[k], b[k]));
+  }
+  return a === b;
+}
+function lineStartOf(text2, pos) {
+  return text2.lastIndexOf("\n", pos - 1) + 1;
+}
+function lineEndFrom(text2, pos) {
+  if (pos === 0 || text2[pos - 1] === "\n") return pos;
+  const newline = text2.indexOf("\n", pos);
+  return newline < 0 ? text2.length : newline + 1;
+}
+function indentBlock(text2, col) {
+  const pad = " ".repeat(col);
+  const body = text2.endsWith("\n") ? text2 : `${text2}
+`;
+  return body.split("\n").map((line2, i, all) => line2 === "" || i === all.length - 1 ? line2 : pad + line2).join("\n");
+}
+function freshBlock(value, col) {
+  return indentBlock(YAML.stringify(value, FRESH_TEXT_OPTIONS), col);
+}
+function schemaFieldOrder(at) {
+  const objectsOf = (schema) => {
+    const shape = shapeOf(schema);
+    if (shape instanceof import_zod4.z.ZodObject) return [shape];
+    if (shape instanceof import_zod4.z.ZodUnion) return shape._def.options.flatMap(objectsOf);
+    return [];
+  };
+  let current2 = ProjectConfigSchema;
+  for (const segment of at) {
+    if (current2 === null) return null;
+    const shape = shapeOf(current2);
+    if (typeof segment === "number") {
+      current2 = shape instanceof import_zod4.z.ZodArray ? shape.element : null;
+    } else if (shape instanceof import_zod4.z.ZodRecord) {
+      current2 = shape._def.valueType;
+    } else {
+      current2 = objectsOf(current2).map((o) => o.shape[segment]).find((s) => s !== void 0) ?? null;
+    }
+  }
+  if (current2 === null) return null;
+  const fields = objectsOf(current2).flatMap((o) => Object.keys(o.shape));
+  return fields.length > 0 ? [...new Set(fields)] : null;
+}
+function inlineScalar(value, style) {
+  if (value !== null && typeof value === "object") return null;
+  const quoting = style === "QUOTE_SINGLE" || style === "QUOTE_DOUBLE" ? style : "PLAIN";
+  const text2 = YAML.stringify(value, { ...FRESH_TEXT_OPTIONS, lineWidth: 0, defaultStringType: quoting }).replace(/\n$/, "");
+  return text2.includes("\n") ? null : text2;
+}
+function applySplices(text2, splices) {
+  const ordered = [...splices].sort((a, b) => b.start - a.start || b.end - a.end || b.rank - a.rank);
+  let out = text2;
+  for (const splice of ordered) out = out.slice(0, splice.start) + splice.text + out.slice(splice.end);
+  return out;
+}
+function editDocumentText(text2, document, root) {
+  const refuse = (why) => {
+    throw new WaironError(`Cannot write .wai/project.yaml at ${root} as an edit of the file: ${why}. Nothing was written.`);
+  };
+  const crlf = text2.includes("\r\n");
+  const source = crlf ? text2.replace(/\r\n/g, "\n") : text2;
+  const doc = YAML.parseDocument(source, PARSE_OPTIONS);
+  if (doc.errors.length > 0) refuse(`the file does not parse (${doc.errors[0].message})`);
+  const reconciler = new DocumentReconciler(source, doc);
+  reconciler.node(doc.contents, document, [], (value) => {
+    reconciler.splices.push({ start: 0, end: source.length, text: YAML.stringify(value, FRESH_TEXT_OPTIONS), rank: 0 });
+  });
+  const edited = applySplices(source, reconciler.splices);
+  let reread;
+  try {
+    reread = parseYaml(edited);
+  } catch (e) {
+    refuse(`the edited text does not parse (${e instanceof Error ? e.message : String(e)})`);
+  }
+  if (!sameValue(reread, document)) refuse("the edited text does not read back as the document to write");
+  return crlf ? edited.replace(/\n/g, "\r\n") : edited;
+}
 function parseConfig(document, root) {
   try {
     return ProjectConfigSchema.parse(document);
@@ -1467,9 +1575,9 @@ function registryOver(store, root) {
           const next = rekeyAnchor(rename, { spec: entry.spec, at, covers });
           const base = ["rules", "conformance", "carried", g, "findings", f];
           const named = { code: String(entry.code), spec: entry.spec, at: at ?? "" };
-          const change = (path76, field, from, to) => {
+          const change = (path77, field, from, to) => {
             if (from === to) return;
-            edits.push({ path: [...base, ...path76], from, to });
+            edits.push({ path: [...base, ...path77], from, to });
             rekeys.push({ ...named, field, from, to });
           };
           change(["spec"], "spec", entry.spec, next.spec);
@@ -1479,6 +1587,38 @@ function registryOver(store, root) {
       });
       store.rewriteScalars(edits, dryRun);
       return rekeys;
+    },
+    setId(id) {
+      if (!PROJECT_ID_RE.test(id)) {
+        throw new WaironError(`Refusing to declare the project id "${id}" at ${root}: it breaks the project-id grammar ([a-z0-9-_.], starting and ending alphanumeric).`);
+      }
+      const config = current2();
+      if (config.id === id) return false;
+      if (config.id !== void 0) {
+        throw new WaironError(
+          `Refusing to declare the project id "${id}" at ${root}: the project already declares "${config.id}". An id is immutable; moving it is the rename migration, never a set.`
+        );
+      }
+      save4({ ...config, id });
+      return true;
+    },
+    declareExternal(alias, declaration2) {
+      if (!EXTERNAL_ALIAS_RE.test(alias)) {
+        throw new WaironError(`Refusing to declare the external "${alias}" at ${root}: an alias must fit [a-z0-9-_]+.`);
+      }
+      if (declaration2.project !== void 0 && !PROJECT_ID_RE.test(declaration2.project)) {
+        throw new WaironError(`Refusing to declare the external "${alias}" at ${root}: the producer id "${declaration2.project}" breaks the project-id grammar.`);
+      }
+      const config = current2();
+      const existing = config.externals?.[alias];
+      if (existing !== void 0) {
+        if (sameValue(existing, declaration2)) return false;
+        throw new WaironError(
+          `Refusing to declare the external "${alias}" at ${root} as ${JSON.stringify(declaration2)}: it is already declared as ${JSON.stringify(existing)}, and a declaration a person wrote is never overwritten.`
+        );
+      }
+      save4({ ...config, externals: { ...config.externals, [alias]: declaration2 } });
+      return true;
     }
   };
 }
@@ -1566,18 +1706,25 @@ function projectConfigRepositoryOver(adapter, rootDir) {
     },
     rekeyCarried(rename, dryRun) {
       return registry.rekeyCarried(rename, dryRun);
+    },
+    setId(id) {
+      return registry.setId(id);
+    },
+    declareExternal(alias, declaration2) {
+      return registry.declareExternal(alias, declaration2);
     }
   };
 }
 function projectConfigRepositoryAt(rootDir) {
   return projectConfigRepositoryOver(projectConfigFsAdapterAt(rootDir), rootDir);
 }
-var fs4, path6, import_zod4, KEY_RE, USE_GLOBAL_PACKS_DEFAULT, bound, projectConfigRepository;
+var fs4, path6, YAML, import_zod4, KEY_RE, FRESH_TEXT_OPTIONS, PARSE_OPTIONS, DocumentReconciler, USE_GLOBAL_PACKS_DEFAULT, bound, projectConfigRepository;
 var init_project_config = __esm({
   "src/config/project-config.ts"() {
     "use strict";
     fs4 = __toESM(require("fs"));
     path6 = __toESM(require("path"));
+    YAML = __toESM(require("yaml"));
     import_zod4 = require("zod");
     init_fs();
     init_yaml();
@@ -1586,6 +1733,124 @@ var init_project_config = __esm({
     init_identity_rename();
     init_project();
     KEY_RE = /^('(?:[^']|'')*'|"(?:[^"\\]|\\.)*"|[^\s'"#{}[\],&*!|>%@`][^:#]*?)\s*:(?=\s|$)/;
+    FRESH_TEXT_OPTIONS = {
+      indent: 2,
+      indentSeq: true,
+      lineWidth: 100,
+      customTags: ["timestamp"]
+    };
+    PARSE_OPTIONS = { customTags: ["timestamp"] };
+    DocumentReconciler = class {
+      constructor(text2, doc) {
+        this.text = text2;
+        this.doc = doc;
+        this.splices = [];
+      }
+      /** Reconcile one node to its target; `replace` rewrites the node wholesale where an edit cannot be precise. */
+      node(node, target, at, replace) {
+        if (YAML.isNode(node) && sameValue(node.toJS(this.doc, { maxAliasCount: -1 }), target)) return;
+        if (YAML.isMap(node) && !node.flow && node.items.length > 0 && isPlainObject(target) && Object.keys(target).length > 0) {
+          this.mapping(node, target, at, replace);
+        } else if (YAML.isSeq(node) && !node.flow && node.items.length > 0 && Array.isArray(target) && target.length > 0) {
+          this.sequence(node, target, at);
+        } else if (YAML.isScalar(node) && !this.scalarInPlace(node, target)) {
+          replace(target);
+        } else if (!YAML.isScalar(node)) {
+          replace(target);
+        }
+      }
+      /** A changed one-line scalar, replaced in its own quoting; false when it is not one. */
+      scalarInPlace(node, target) {
+        const [start2, end] = node.range ?? [0, 0];
+        const flowStyle = node.type === "PLAIN" || node.type === "QUOTE_SINGLE" || node.type === "QUOTE_DOUBLE";
+        if (!flowStyle || start2 === end) return false;
+        const written = inlineScalar(target, node.type);
+        if (written === null) return false;
+        this.splices.push({ start: start2, end, text: written, rank: 0 });
+        return true;
+      }
+      /** Where a pair's text starts (its key's line) and ends (the line after its value). */
+      pairSpan(pair) {
+        const key = pair.key;
+        const start2 = lineStartOf(this.text, key.range[0]);
+        const value = pair.value;
+        const valueEnd = value && value.range ? value.range[1] : key.range[1];
+        return { start: start2, end: lineEndFrom(this.text, valueEnd), col: key.range[0] - start2 };
+      }
+      /** Where a sequence item's text starts (its dash's line) and ends, and the dash's column. */
+      itemSpan(item) {
+        let dash = item.range[0] - 1;
+        while (dash >= 0 && /\s/.test(this.text[dash])) dash -= 1;
+        const start2 = lineStartOf(this.text, dash);
+        return { start: start2, end: lineEndFrom(this.text, item.range[1]), col: dash - start2 };
+      }
+      /** The first line of the comment block directly above the line starting at `lineStart`. */
+      commentBlockStart(lineStart) {
+        let start2 = lineStart;
+        while (start2 > 0) {
+          const above = lineStartOf(this.text, start2 - 1);
+          if (!this.text.slice(above, start2).trim().startsWith("#")) break;
+          start2 = above;
+        }
+        return start2;
+      }
+      mapping(map, target, at, replace) {
+        const keyOf = (pair) => String(YAML.isScalar(pair.key) ? pair.key.value : pair.key);
+        const kept = map.items.filter((pair) => target[keyOf(pair)] !== void 0);
+        if (kept.length === 0) {
+          replace(target);
+          return;
+        }
+        for (const pair of map.items) {
+          const key = keyOf(pair);
+          const span = this.pairSpan(pair);
+          if (target[key] === void 0) {
+            this.splices.push({ start: span.start, end: span.end, text: "", rank: 0 });
+            continue;
+          }
+          this.node(pair.value, target[key], [...at, key], (value) => {
+            this.splices.push({ start: span.start, end: span.end, text: freshBlock({ [key]: value }, span.col), rank: 0 });
+          });
+        }
+        this.insertNewKeys(map, kept, target, at, keyOf);
+      }
+      /**
+       * Insert the keys the document adds at their place in the schema's field
+       * order: after the nearest preceding schema field the mapping keeps, else
+       * before the nearest following one (above its comments), else after the
+       * mapping's last key.
+       */
+      insertNewKeys(map, kept, target, at, keyOf) {
+        const present = new Map(kept.map((pair) => [keyOf(pair), pair]));
+        const order = schemaFieldOrder(at) ?? [];
+        const col = this.pairSpan(kept[0]).col;
+        const added = Object.keys(target).filter((key) => target[key] !== void 0 && !map.items.some((pair) => keyOf(pair) === key));
+        added.forEach((key, n) => {
+          const index = order.indexOf(key);
+          const before = index < 0 ? void 0 : order.slice(0, index).reverse().find((k) => present.has(k));
+          const after = index < 0 ? void 0 : order.slice(index + 1).find((k) => present.has(k));
+          const offset = before !== void 0 ? this.pairSpan(present.get(before)).end : after !== void 0 ? this.commentBlockStart(this.pairSpan(present.get(after)).start) : this.pairSpan(kept[kept.length - 1]).end;
+          const rank = -at.length * 1e5 + (index < 0 ? order.length + n : index);
+          this.splices.push({ start: offset, end: offset, text: freshBlock({ [key]: target[key] }, col), rank });
+        });
+      }
+      sequence(seq, target, at) {
+        seq.items.forEach((item, i) => {
+          const span = this.itemSpan(item);
+          if (i >= target.length) {
+            this.splices.push({ start: span.start, end: span.end, text: "", rank: 0 });
+            return;
+          }
+          this.node(item, target[i], [...at, i], (value) => {
+            this.splices.push({ start: span.start, end: span.end, text: freshBlock([value], span.col), rank: 0 });
+          });
+        });
+        if (target.length > seq.items.length) {
+          const last = this.itemSpan(seq.items[seq.items.length - 1]);
+          this.splices.push({ start: last.end, end: last.end, text: freshBlock(target.slice(seq.items.length), last.col), rank: -(at.length + 1) * 1e5 });
+        }
+      }
+    };
     USE_GLOBAL_PACKS_DEFAULT = ProjectConfigSchema.shape.extensions.unwrap().parse({}).useGlobalPacks;
     bound = () => projectConfigRepositoryAt(getProjectRoot());
     projectConfigRepository = {
@@ -1633,6 +1898,12 @@ var init_project_config = __esm({
       },
       rekeyCarried(rename, dryRun) {
         return bound().rekeyCarried(rename, dryRun);
+      },
+      setId(id) {
+        return bound().setId(id);
+      },
+      declareExternal(alias, declaration2) {
+        return bound().declareExternal(alias, declaration2);
       }
     };
   }
@@ -3269,10 +3540,10 @@ function stepGraph(method2) {
     const s = byNum.get(n);
     if (s.type !== "parallel" || s.endStep === void 0 || !s.branches?.length) continue;
     const entries = s.branches.map((b) => b.step).sort((a, b) => a - b);
-    const join55 = fallNext(s.endStep);
+    const join56 = fallNext(s.endStep);
     for (let i = 0; i < entries.length; i++) {
       const armEnd = i + 1 < entries.length ? prevOf(entries[i + 1]) : s.endStep;
-      if (armEnd !== void 0 && armEnd >= entries[i]) armEndJoin.set(armEnd, join55);
+      if (armEnd !== void 0 && armEnd >= entries[i]) armEndJoin.set(armEnd, join56);
     }
   }
   const successorsOf = (n) => {
@@ -3363,17 +3634,17 @@ function stepConfigVerdict(method2) {
   };
   const labelled = /* @__PURE__ */ new Map();
   for (const step of steps) {
-    const label2 = step.label;
-    if (!label2) continue;
-    const first = labelled.get(label2);
+    const label3 = step.label;
+    if (!label3) continue;
+    const first = labelled.get(label3);
     if (first !== void 0) {
       problems.push({
         stepNumber: step.stepNumber,
         code: "DUPLICATE_STEP_LABEL",
-        detail: `steps ${first} and ${step.stepNumber} share the label "${label2}". A label anchors one step for later deltas to address; two steps holding it makes every symbolic reference ambiguous and blocks all further edits to this implementation. Rename one.`
+        detail: `steps ${first} and ${step.stepNumber} share the label "${label3}". A label anchors one step for later deltas to address; two steps holding it makes every symbolic reference ambiguous and blocks all further edits to this implementation. Rename one.`
       });
     } else {
-      labelled.set(label2, step.stepNumber);
+      labelled.set(label3, step.stepNumber);
     }
   }
   const byNum = /* @__PURE__ */ new Map();
@@ -4051,9 +4322,9 @@ function buildDrawioXml(model, L) {
     const parentId = nestInPattern ? "comp_" + owner.id : "sub_" + comp.subsystem;
     const parentBox = nestInPattern ? L.boxes[owner.id] : L.subs[comp.subsystem];
     const colors = COLORS[stereo(comp.componentType)];
-    const label2 = comp.name + "\n\xAB" + comp.componentType + (comp.portalType ? "/" + comp.portalType : "") + "\xBB";
+    const label3 = comp.name + "\n\xAB" + comp.componentType + (comp.portalType ? "/" + comp.portalType : "") + "\xBB";
     const style = isPattern2 ? "rounded=1;fillColor=" + colors.fill + ";strokeColor=" + colors.stroke + ";dashed=1;verticalAlign=top;fontStyle=1;container=1;collapsible=1;whiteSpace=wrap;" : "rounded=1;fillColor=" + colors.fill + ";strokeColor=" + colors.stroke + ";whiteSpace=wrap;fontSize=11;" + (comp.public ? "strokeWidth=3;" : "");
-    vertex("comp_" + comp.id, parentId, label2, style, box, parentBox);
+    vertex("comp_" + comp.id, parentId, label3, style, box, parentBox);
   });
   let edgeN = 0;
   model.edges.forEach(function(edge) {
@@ -4137,19 +4408,19 @@ function buildExcalidrawScene(model, L) {
   }
   function boundLabel(rect, text2, fontSize, verticalAlign) {
     const id = rect.id + "-label";
-    const label2 = base(id, "text", { x: rect.x + 8, y: rect.y + 6, w: rect.width - 16, h: 20 });
-    label2.roundness = null;
-    label2.text = text2;
-    label2.originalText = text2;
-    label2.fontSize = fontSize;
-    label2.fontFamily = 1;
-    label2.textAlign = "center";
-    label2.verticalAlign = verticalAlign;
-    label2.containerId = rect.id;
-    label2.autoResize = true;
-    label2.lineHeight = 1.25;
+    const label3 = base(id, "text", { x: rect.x + 8, y: rect.y + 6, w: rect.width - 16, h: 20 });
+    label3.roundness = null;
+    label3.text = text2;
+    label3.originalText = text2;
+    label3.fontSize = fontSize;
+    label3.fontFamily = 1;
+    label3.textAlign = "center";
+    label3.verticalAlign = verticalAlign;
+    label3.containerId = rect.id;
+    label3.autoResize = true;
+    label3.lineHeight = 1.25;
     rect.boundElements.push({ id, type: "text" });
-    return label2;
+    return label3;
   }
   const elements = [];
   const rectById = {};
@@ -4174,8 +4445,8 @@ function buildExcalidrawScene(model, L) {
     rect.strokeStyle = isPattern2 || stereo(comp.componentType) === "pattern" ? "dashed" : "solid";
     elements.push(rect);
     rectById[comp.id] = rect;
-    const label2 = comp.name + "\n\xAB" + comp.componentType + (comp.portalType ? "/" + comp.portalType : "") + "\xBB";
-    elements.push(boundLabel(rect, label2, 11, isPattern2 ? "top" : "middle"));
+    const label3 = comp.name + "\n\xAB" + comp.componentType + (comp.portalType ? "/" + comp.portalType : "") + "\xBB";
+    elements.push(boundLabel(rect, label3, 11, isPattern2 ? "top" : "middle"));
   });
   let edgeN = 0;
   model.edges.forEach(function(edge) {
@@ -9586,8 +9857,8 @@ function pinExternals(aliases) {
       pins.push({ alias: binding.external.alias, outcome: "unresolved", project: binding.external.project, usedNames: 0, unexported: [], detail: binding.external.problem });
       continue;
     }
-    const { pin, changed } = pinBinding(binding, lock);
-    pins.push(pin);
+    const { pin: pin2, changed } = pinBinding(binding, lock);
+    pins.push(pin2);
     lockChanged ||= changed;
   }
   if (!named) {
@@ -10500,21 +10771,21 @@ function buildCodeIndex(model) {
   const declarations = /* @__PURE__ */ new Map();
   const anchors = /* @__PURE__ */ new Map();
   const findingAnchors = /* @__PURE__ */ new Map();
-  const namesAt = (cache2, path76, make) => {
-    const cached = cache2.get(path76);
+  const namesAt = (cache2, path77, make) => {
+    const cached = cache2.get(path77);
     if (cached) return cached;
-    const f = facts.get(path76);
+    const f = facts.get(path77);
     if (!f) return NO_NAMES;
     const built = make(f);
-    cache2.set(path76, built);
+    cache2.set(path77, built);
     return built;
   };
   const republished = /* @__PURE__ */ new Map();
-  const republishedFrom = (path76) => {
-    const cached = republished.get(path76);
+  const republishedFrom = (path77) => {
+    const cached = republished.get(path77);
     if (cached) return cached;
-    const out = /* @__PURE__ */ new Set([path76]);
-    const queue = [path76];
+    const out = /* @__PURE__ */ new Set([path77]);
+    const queue = [path77];
     while (queue.length) {
       const from = queue.pop();
       const f = facts.get(from);
@@ -10527,7 +10798,7 @@ function buildCodeIndex(model) {
         }
       }
     }
-    republished.set(path76, out);
+    republished.set(path77, out);
     return out;
   };
   const NO_ORIGIN = /* @__PURE__ */ new Set();
@@ -10536,9 +10807,9 @@ function buildCodeIndex(model) {
     return to ? republishedFrom(to) : NO_ORIGIN;
   };
   const scopeOf2 = (site, from) => {
-    const path76 = pathKey(site.from ?? from);
-    const f = facts.get(path76);
-    return f?.status === "analyzed" && f.analysisGrade === "exact" ? { path: path76, facts: f } : void 0;
+    const path77 = pathKey(site.from ?? from);
+    const f = facts.get(path77);
+    return f?.status === "analyzed" && f.analysisGrade === "exact" ? { path: path77, facts: f } : void 0;
   };
   const originOf2 = (site, from) => {
     const resolved = scopeOf2(site, from);
@@ -10577,7 +10848,7 @@ function buildCodeIndex(model) {
     if (site.via) for (const typeName of localTypesOf(f, site.via)) widenThroughType(typeName);
     return out;
   };
-  const declarationsAt = (path76) => namesAt(declarations, pathKey(path76), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames]));
+  const declarationsAt = (path77) => namesAt(declarations, pathKey(path77), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames]));
   const forwardsOf = (start2, name) => {
     const out = [];
     const seen = /* @__PURE__ */ new Set();
@@ -10603,10 +10874,10 @@ function buildCodeIndex(model) {
   return {
     paths,
     exactPaths,
-    factsAt: (path76) => facts.get(pathKey(path76)),
+    factsAt: (path77) => facts.get(pathKey(path77)),
     declarationsAt,
-    anchorsAt: (path76) => namesAt(anchors, pathKey(path76), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames, ...f.anchoredNames])),
-    findingAnchorsAt: (path76) => namesAt(findingAnchors, pathKey(path76), (f) => new Set(f.anchoredNames)),
+    anchorsAt: (path77) => namesAt(anchors, pathKey(path77), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames, ...f.anchoredNames])),
+    findingAnchorsAt: (path77) => namesAt(findingAnchors, pathKey(path77), (f) => new Set(f.anchoredNames)),
     originOf: originOf2,
     possibleOriginsOf,
     forwardsOf
@@ -10645,10 +10916,10 @@ function buildRealizationIndex(ctx) {
   return {
     paths,
     implementationsOf: (compId) => implsByComponent.get(compId) ?? NONE_IMPL,
-    implementationsAt: (path76) => implsByPath.get(pathKey(path76)) ?? NONE_IMPL,
+    implementationsAt: (path77) => implsByPath.get(pathKey(path77)) ?? NONE_IMPL,
     filesOf: (compId) => filesByComponent.get(compId) ?? NONE_PATH,
     filesIn: (subsystemId) => filesBySubsystem.get(subsystemId) ?? NONE_PATH,
-    componentsAt: (path76) => componentsByPath.get(pathKey(path76)) ?? NONE_COMP
+    componentsAt: (path77) => componentsByPath.get(pathKey(path77)) ?? NONE_COMP
   };
 }
 function buildImportGraph(index, universe) {
@@ -10660,22 +10931,22 @@ function buildImportGraph(index, universe) {
       if (to && to !== from) into.add(to);
     }
   };
-  const importsOf = (path76) => {
-    const cached = imports.get(path76);
+  const importsOf = (path77) => {
+    const cached = imports.get(path77);
     if (cached) return cached;
-    const facts = index.factsAt(path76);
+    const facts = index.factsAt(path77);
     const out = /* @__PURE__ */ new Set();
-    if (facts?.status === "analyzed") resolveAll(path76, facts.imports, out);
-    imports.set(path76, out);
+    if (facts?.status === "analyzed") resolveAll(path77, facts.imports, out);
+    imports.set(path77, out);
     return out;
   };
-  const tracesOf = (path76) => {
-    const cached = traces.get(path76);
+  const tracesOf = (path77) => {
+    const cached = traces.get(path77);
     if (cached) return cached;
-    const facts = index.factsAt(path76);
-    const out = new Set(importsOf(path76));
-    if (facts?.status === "analyzed") resolveAll(path76, facts.reexports, out);
-    traces.set(path76, out);
+    const facts = index.factsAt(path77);
+    const out = new Set(importsOf(path77));
+    if (facts?.status === "analyzed") resolveAll(path77, facts.reexports, out);
+    traces.set(path77, out);
     return out;
   };
   return {
@@ -12455,11 +12726,11 @@ var init_unconditional_call_cycles = __esm({
           const memberEdges = keys.flatMap((k) => (adjacency.get(k) ?? []).filter((e) => inScc.has(e.toKey)));
           if (memberEdges.length === 0) continue;
           const anchor = [...memberEdges].sort((a, b) => byCodeUnit(a.fromKey, b.fromKey) || byCodeUnit(a.impl.id, b.impl.id) || a.stepNumber - b.stepNumber)[0];
-          const path76 = [...keys].sort(byCodeUnit).join(" \u2192 ");
+          const path77 = [...keys].sort(byCodeUnit).join(" \u2192 ");
           ctx.addIssue(
             "warning",
             "UNCONDITIONAL_CALL_CYCLE",
-            `Call cycle with no guard: ${path76} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
+            `Call cycle with no guard: ${path77} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
             anchor.impl.id,
             memberEdges.some((e) => ctx.isImplementationDraft(e.impl))
           );
@@ -14382,8 +14653,8 @@ var init_lifecycle_entrypoints = __esm({
 });
 
 // src/core/rules/wiring/portal-mounts.ts
-function liesUnder(path76, prefix) {
-  return path76 === prefix || path76.startsWith(prefix + "/");
+function liesUnder(path77, prefix) {
+  return path77 === prefix || path77.startsWith(prefix + "/");
 }
 var portalMountsRule;
 var init_portal_mounts = __esm({
@@ -15378,12 +15649,12 @@ var init_method_realization = __esm({
               );
               continue;
             }
-            const label2 = methodImpl?.symbol ? `"${method2.name}" (symbol "${symbol}")` : `"${method2.name}"`;
+            const label3 = methodImpl?.symbol ? `"${method2.name}" (symbol "${symbol}")` : `"${method2.name}"`;
             const weakHint = tier === "declared" && inAnchored ? " Only a weak string/word anchor exists \u2014 declare the symbol, map it via a per-method `symbol`, or dial this method to `anchored`." : "";
             ctx.addIssue(
               "warning",
               "UNREALIZED_METHOD",
-              `Method ${label2} of contract "${impl.contract}" is not realized in "${file}" at the "${tier}" tier (analysis grade: ${facts.analysisGrade}).${weakHint}`,
+              `Method ${label3} of contract "${impl.contract}" is not realized in "${file}" at the "${tier}" tier (analysis grade: ${facts.analysisGrade}).${weakHint}`,
               impl.id,
               draft
             );
@@ -15693,11 +15964,11 @@ var init_hidden_state = __esm({
             byPath.set(key, list2);
           }
         }
-        for (const path76 of code.exactPaths) {
-          const facts = code.factsAt(path76);
+        for (const path77 of code.exactPaths) {
+          const facts = code.factsAt(path77);
           const bindings = facts.topLevelMutableBindings ?? [];
           if (bindings.length === 0) continue;
-          const mapped = byPath.get(path76) ?? [];
+          const mapped = byPath.get(path77) ?? [];
           if (mapped.length === 0) continue;
           if (!mapped.every((m) => isStatelessLogic(m.component))) continue;
           const anchor = [...mapped].sort((a, b) => a.impl.id.localeCompare(b.impl.id))[0];
@@ -15770,7 +16041,7 @@ var init_dependency_conformance = __esm({
           }
           return false;
         };
-        const draftAt = (path76) => realization.implementationsAt(path76).some((impl) => ctx.isImplementationDraft(impl));
+        const draftAt = (path77) => realization.implementationsAt(path77).some((impl) => ctx.isImplementationDraft(impl));
         for (const fromPath of mappedPaths) {
           const fromComponents = realization.componentsAt(fromPath);
           for (const toPath of graph2.importsOf(fromPath)) {
@@ -15861,7 +16132,7 @@ var init_portal_imports = __esm({
           }
           return files;
         };
-        const draftAt = (path76) => realization.implementationsAt(path76).some((impl) => ctx.isImplementationDraft(impl));
+        const draftAt = (path77) => realization.implementationsAt(path77).some((impl) => ctx.isImplementationDraft(impl));
         for (const fromPath of mappedPaths) {
           const fromSubsystems = new Set(realization.componentsAt(fromPath).map((c) => c.subsystem));
           for (const toPath of graph2.importsOf(fromPath)) {
@@ -16012,8 +16283,8 @@ var init_integration_sim_wiring = __esm({
             const depFiles = depComp.subsystem !== comp.subsystem ? modulesIn(depComp.subsystem) : modulesOf(dep);
             if (depFiles.length === 0) continue;
             if (!depFiles.some((f) => reach2.has(f))) {
-              const label2 = depComp.subsystem !== comp.subsystem ? `"${dep}" (any module of subsystem "${depComp.subsystem}")` : `"${dep}" (${depFiles.join(" | ")})`;
-              missing.push(label2);
+              const label3 = depComp.subsystem !== comp.subsystem ? `"${dep}" (any module of subsystem "${depComp.subsystem}")` : `"${dep}" (${depFiles.join(" | ")})`;
+              missing.push(label3);
             }
           }
           if (missing.length === 0) continue;
@@ -16131,27 +16402,27 @@ var init_type_realization = __esm({
         for (const type of ctx.types) {
           if (!type.sourcePath) continue;
           if (type.subsystem && ctx.isInChainedSubproject(type.subsystem)) continue;
-          const blocked = /* @__PURE__ */ new Set();
+          const blocked2 = /* @__PURE__ */ new Set();
           for (const file of typeSourceFiles(type)) {
             const key = pathKey(file);
             const facts = code.factsAt(key);
             if (!facts || facts.status === "analyzed") continue;
-            blocked.add(key);
+            blocked2.add(key);
             const problem = FILE_PROBLEMS[facts.status];
             if (!problem) continue;
             ctx.addIssue(problem.severity, problem.code, `${ownerOf2(type, file)} sourcePath "${file}" ${problem.detail}`, type.id);
           }
           const typeKey = pathKey(type.sourcePath);
           const typeFacts = code.factsAt(typeKey);
-          if (typeFacts && !blocked.has(typeKey)) {
+          if (typeFacts && !blocked2.has(typeKey)) {
             const symbol = type.symbol ?? type.name;
             const published = typeFacts.analysisGrade === "exact" ? new Set(typeFacts.reexportOnly ? [] : typeFacts.exportedNames) : code.declarationsAt(typeKey);
             if (!published.has(symbol)) {
-              const label2 = type.symbol ? `"${type.name}" (symbol "${symbol}")` : `"${type.name}"`;
+              const label3 = type.symbol ? `"${type.name}" (symbol "${symbol}")` : `"${type.name}"`;
               ctx.addIssue(
                 "warning",
                 "UNREALIZED_TYPE",
-                `Type ${label2} is not published by "${type.sourcePath}" (analysis grade: ${typeFacts.analysisGrade})${typeFacts.reexportOnly ? ", which is a pure re-export barrel and declares nothing of its own" : ""} \u2014 name the file the declaration lives in, or bind the code-level name with \`symbol\`.`,
+                `Type ${label3} is not published by "${type.sourcePath}" (analysis grade: ${typeFacts.analysisGrade})${typeFacts.reexportOnly ? ", which is a pure re-export barrel and declares nothing of its own" : ""} \u2014 name the file the declaration lives in, or bind the code-level name with \`symbol\`.`,
                 type.id
               );
             }
@@ -16159,16 +16430,16 @@ var init_type_realization = __esm({
           for (const method2 of type.methods ?? []) {
             const file = method2.sourcePath ?? type.sourcePath;
             const key = pathKey(file);
-            if (blocked.has(key)) continue;
+            if (blocked2.has(key)) continue;
             const facts = code.factsAt(key);
             if (!facts || facts.status !== "analyzed") continue;
             const symbol = method2.symbol ?? method2.name;
             if (code.declarationsAt(key).has(symbol)) continue;
-            const label2 = method2.symbol ? `"${method2.name}" (symbol "${symbol}")` : `"${method2.name}"`;
+            const label3 = method2.symbol ? `"${method2.name}" (symbol "${symbol}")` : `"${method2.name}"`;
             ctx.addIssue(
               "warning",
               "UNREALIZED_TYPE_METHOD",
-              `Method ${label2} of type "${type.id}" is not declared in "${file}" (analysis grade: ${facts.analysisGrade}) \u2014 a pure type method is often a free function named after its type; bind that name with \`symbol\`, or name the file it lives in with the method's own \`sourcePath\`.`,
+              `Method ${label3} of type "${type.id}" is not declared in "${file}" (analysis grade: ${facts.analysisGrade}) \u2014 a pure type method is often a free function named after its type; bind that name with \`symbol\`, or name the file it lives in with the method's own \`sourcePath\`.`,
               type.id
             );
           }
@@ -16447,8 +16718,8 @@ var init_param_conformance = __esm({
 });
 
 // src/core/rules/conformance/route-coverage.ts
-function liesUnder2(path76, prefix) {
-  return path76 === prefix || path76.startsWith(prefix + "/");
+function liesUnder2(path77, prefix) {
+  return path77 === prefix || path77.startsWith(prefix + "/");
 }
 function normalizeSegment(segment) {
   return /^\{.+\}$/.test(segment) || segment.startsWith(":") ? "*" : segment;
@@ -20553,8 +20824,8 @@ function truncate(text2, max) {
   const clean = text2.replace(/\s+/g, " ").trim();
   return clean.length <= max ? clean : `${clean.slice(0, max - 1)}\u2026`;
 }
-function nodeDecl(id, label2, comp) {
-  const l = escapeLabel(label2);
+function nodeDecl(id, label3, comp) {
+  const l = escapeLabel(label3);
   if (comp.componentType === "Portal" || comp.componentType === "Observer") return `${id}(["${l}"])`;
   if (comp.componentType === "Store" || comp.componentType === "Index") return `${id}[("${l}")]`;
   if (PATTERN_TYPES.has(comp.componentType)) return `${id}[["${l}"]]`;
@@ -20631,8 +20902,8 @@ function generateComponentDiagram(options) {
     lines.push(`  subgraph ${ids.idFor(`sub:${subId}`)}["${subLabel}"]`);
     for (const comp of comps) {
       const nodeId = ids.idFor(comp.id);
-      const label2 = `${comp.name}<br/>\xAB${comp.componentType}\xBB`;
-      lines.push(`    ${nodeDecl(nodeId, label2, comp)}`);
+      const label3 = `${comp.name}<br/>\xAB${comp.componentType}\xBB`;
+      lines.push(`    ${nodeDecl(nodeId, label3, comp)}`);
       assignClass(stereotypeClass(comp), nodeId);
       if (graph2.publicComponents.has(comp.id)) assignClass("publicSurface", nodeId);
     }
@@ -20977,8 +21248,8 @@ function makeNodes(roots) {
   });
 }
 function describe(node) {
-  const label2 = node.id ?? node.name ?? "(no id)";
-  return node.namespace === "" ? `"${label2}" (the bound root)` : `"${label2}" (mounted at "${node.namespace}")`;
+  const label3 = node.id ?? node.name ?? "(no id)";
+  return node.namespace === "" ? `"${label3}" (the bound root)` : `"${label3}" (mounted at "${node.namespace}")`;
 }
 function identityProblems(nodes) {
   const problems = [];
@@ -21410,8 +21681,8 @@ function reach(audience) {
   const idx = SURFACE_AUDIENCES.indexOf(audience ?? "instance");
   return idx === -1 ? SURFACE_AUDIENCES.indexOf("instance") : idx;
 }
-function classifySource(world, sourceId, label2, context) {
-  if (!sourceId) return { kind: "unresolvable", detail: `"${label2}" names no source subsystem and no item whose owner could supply one` };
+function classifySource(world, sourceId, label3, context) {
+  if (!sourceId) return { kind: "unresolvable", detail: `"${label3}" names no source subsystem and no item whose owner could supply one` };
   const sub = world.subsystems.get(sourceId);
   const ownSub = sub && (!context || (context.family.owners.get(sourceId) ?? context.namespace) === context.namespace);
   if (sub && ownSub) return { kind: "subsystem", subsystem: sub };
@@ -21424,13 +21695,13 @@ function classifySource(world, sourceId, label2, context) {
       return { kind: "project", namespace: external.producer, label: `external "${external.alias}"` };
     }
     if (external?.sourceKind === "path") {
-      return { kind: "unresolvable", detail: `"${label2}" re-exports from external "${external.alias}", which is found only through source.path \xE2\u20AC\u201D the scan cannot follow its table, so a project re-exports only from projects of its family` };
+      return { kind: "unresolvable", detail: `"${label3}" re-exports from external "${external.alias}", which is found only through source.path \xE2\u20AC\u201D the scan cannot follow its table, so a project re-exports only from projects of its family` };
     }
     if (external) {
-      return { kind: "unresolvable", detail: `"${label2}" re-exports from external "${external.alias}", which does not resolve: ${external.problem}` };
+      return { kind: "unresolvable", detail: `"${label3}" re-exports from external "${external.alias}", which does not resolve: ${external.problem}` };
     }
   }
-  return { kind: "unresolvable", detail: `"${label2}" re-exports from "${sourceId}", which is neither a subsystem of this project, a member nor a declared external` };
+  return { kind: "unresolvable", detail: `"${label3}" re-exports from "${sourceId}", which is neither a subsystem of this project, a member nor a declared external` };
 }
 function bindFromProject(owner, e, source, table, index, problems) {
   const named = e.component !== void 0 || e.typeDef !== void 0 || e.interface !== void 0;
@@ -21465,16 +21736,16 @@ function resolveProjectTable(system, subsystems, components, interfaces, types,
   const problems = [];
   const candidates = [];
   (system.publicInterfaces ?? []).forEach((e, index) => {
-    const label2 = e.as ?? e.id ?? e.interface ?? e.component ?? e.typeDef ?? `#${index + 1}`;
-    const source = classifySource(world, sourceOf(world, e), label2, context);
+    const label3 = e.as ?? e.id ?? e.interface ?? e.component ?? e.typeDef ?? `#${index + 1}`;
+    const source = classifySource(world, sourceOf(world, e), label3, context);
     if (source.kind === "unresolvable") {
-      problems.push({ kind: "invalid", owner, publicName: label2, detail: source.detail });
+      problems.push({ kind: "invalid", owner, publicName: label3, detail: source.detail });
       return;
     }
     if (source.kind === "project") {
       const table = context.projectTable(source.namespace);
       if (!table) {
-        problems.push({ kind: "named-cycle", owner, publicName: label2, targets: [owner, source.namespace], detail: `re-exports "${label2}" from ${source.label}, whose table leads back to this project without reaching the item` });
+        problems.push({ kind: "named-cycle", owner, publicName: label3, targets: [owner, source.namespace], detail: `re-exports "${label3}" from ${source.label}, whose table leads back to this project without reaching the item` });
         return;
       }
       candidates.push(...bindFromProject(owner, e, source, table, index, problems));
@@ -21488,7 +21759,10 @@ function resolveProjectTable(system, subsystems, components, interfaces, types,
         source.subsystem,
         sourceTable,
         { component: e.component, interface: e.interface, typeDef: e.typeDef },
-        () => e.as ?? e.id ?? e.interface ?? e.component ?? e.typeDef,
+        // The default public name is the item's own LOCAL id: a member's L0 is
+        // read with its ids qualified into its mount, and its entry names the
+        // item as the member wrote it.
+        () => e.as ?? e.id ?? localName2(e.interface ?? e.component ?? e.typeDef),
         false,
         problems
       );
@@ -21606,7 +21880,7 @@ function landingEntries(ref, visible, interfaces, componentIds) {
     });
   }
   if (ref.position === "type" || ref.position === "reexport") {
-    const typed = visible.filter((e) => e.kind === "type" && (e.typeDef === ref.target || matchTypeRef(ref.target, e.typeDef ?? "")));
+    const typed = visible.filter((e) => e.kind === "type" && (e.typeDef === ref.target || matchTypeRef(ref.target, e.typeDef ?? "") || ref.target === `${e.source}::${localName2(e.typeDef ?? "")}`));
     if (typed.length > 0 || ref.position === "type") return typed;
   }
   return [];
@@ -22422,13 +22696,13 @@ function ineffectiveDeltaPaths(delta, merged, stored) {
   const isPlain = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
   const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
   const at = (prefix, key) => prefix ? `${prefix}.${key}` : key;
-  const say = (path76, why) => {
-    out.push(`${path76} \u2014 ${why}`);
+  const say = (path77, why) => {
+    out.push(`${path77} \u2014 ${why}`);
   };
-  const walkValue = (d, m, s, path76, field) => {
+  const walkValue = (d, m, s, path77, field) => {
     if (Array.isArray(d)) {
       if (!Array.isArray(m)) {
-        say(path76, "the level does not have this field, so the write dropped it");
+        say(path77, "the level does not have this field, so the write dropped it");
         return;
       }
       if (field === "narrative" && d.some(carriesEditMarker)) return;
@@ -22436,32 +22710,32 @@ function ineffectiveDeltaPaths(delta, merged, stored) {
         if (carriesEditMarker(element)) continue;
         const key = reportIdentityOf(field, element);
         if (key === null) {
-          if (!same(m, d)) say(path76, "the level does not keep this value, so the write dropped it");
-          else if (same(s, d)) say(path76, "the stored spec already held this value");
+          if (!same(m, d)) say(path77, "the level does not keep this value, so the write dropped it");
+          else if (same(s, d)) say(path77, "the stored spec already held this value");
           return;
         }
         const mMatch = m.find((i) => reportIdentityOf(field, i) === key);
         const sMatch = Array.isArray(s) ? s.find((i) => reportIdentityOf(field, i) === key) : void 0;
         if (mMatch === void 0) {
-          say(at(path76, key), "the write did not store this element");
+          say(at(path77, key), "the write did not store this element");
           continue;
         }
-        walk2(element, mMatch, sMatch, at(path76, key), field);
+        walk2(element, mMatch, sMatch, at(path77, key), field);
       }
       return;
     }
     if (isPlain(d)) {
       if (!isPlain(m)) {
-        say(path76, "the level does not have this field, so the write dropped it");
+        say(path77, "the level does not have this field, so the write dropped it");
         return;
       }
-      walk2(d, m, s, path76, field);
+      walk2(d, m, s, path77, field);
       return;
     }
-    if (!same(m, d)) say(path76, "the write did not store it \u2014 the level's schema does not keep this value");
-    else if (same(s, d)) say(path76, "the stored spec already held this value");
+    if (!same(m, d)) say(path77, "the write did not store it \u2014 the level's schema does not keep this value");
+    else if (same(s, d)) say(path77, "the stored spec already held this value");
   };
-  function walk2(d, m, s, path76, container) {
+  function walk2(d, m, s, path77, container) {
     for (const [key, value] of Object.entries(d)) {
       if (DELTA_VERBS.has(key) || JUMP_LABEL_TWINS.has(key)) continue;
       if (key === "label" && LABEL_TWIN_CONTAINERS.has(container)) continue;
@@ -22471,13 +22745,13 @@ function ineffectiveDeltaPaths(delta, merged, stored) {
           if (typeof name !== "string") continue;
           const had = isPlain(s) && s[name] !== void 0;
           const still = isPlain(m) && m[name] !== void 0;
-          if (!had) say(at(path76, name), "unset named a field the stored spec did not have");
-          else if (still) say(at(path76, name), "unset did not remove it");
+          if (!had) say(at(path77, name), "unset named a field the stored spec did not have");
+          else if (still) say(at(path77, name), "unset did not remove it");
         }
         continue;
       }
       if (value === void 0 || value === null) continue;
-      const here = at(path76, key);
+      const here = at(path77, key);
       const mValue = isPlain(m) ? m[key] : void 0;
       const sValue = isPlain(s) ? s[key] : void 0;
       if (mValue === void 0) {
@@ -22523,10 +22797,10 @@ function namesInProse(value, named) {
   if (!value || typeof value !== "object") return false;
   return Object.entries(value).some(([key, nested]) => typeof nested === "string" ? PROSE_FIELDS.has(key) && named.test(nested) : namesInProse(nested, named));
 }
-function judgeMoveResult(hooks, plan) {
+function judgeMoveResult(hooks, plan2) {
   const refusals = [];
   const notices = [];
-  for (const resulting of [plan.edits.get(`component:${plan.source.id}`), plan.edits.get(`component:${plan.target.id}`)]) {
+  for (const resulting of [plan2.edits.get(`component:${plan2.source.id}`), plan2.edits.get(`component:${plan2.target.id}`)]) {
     if (!resulting) continue;
     try {
       const raised = hooks.gate?.("component", resulting.after);
@@ -22565,9 +22839,9 @@ function moveChangeReports(edits, dryRun) {
     summary: edit.before === null ? `${dryRun ? "Would create" : "Created"} ${edit.kind} "${edit.id}" to receive the moved methods.` : `${dryRun ? "Would move" : "Moved"} into ${edit.kind} "${edit.id}": ${changes.length} change${changes.length === 1 ? "" : "s"}.`
   }));
 }
-function moveRename(from, to, methods, plan) {
+function moveRename(from, to, methods, plan2) {
   return {
-    specs: plan.rehomed.map(({ from: left, to: arrived }) => ({ from: left, to: arrived, sites: [...methods] })),
+    specs: plan2.rehomed.map(({ from: left, to: arrived }) => ({ from: left, to: arrived, sites: [...methods] })),
     methods: methods.map((method2) => ({ component: from, method: method2, toComponent: to, toMethod: method2 }))
   };
 }
@@ -22816,6 +23090,12 @@ function deregisterPackRef(ref) {
 function markSelectionsBundled(bundled) {
   projectConfigRepository.markSelectionsBundled(bundled);
 }
+function setProjectId(id) {
+  return projectConfigRepository.setId(id);
+}
+function declareExternal(alias, declaration2) {
+  return projectConfigRepository.declareExternal(alias, declaration2);
+}
 function specPathsInScope(scopeSubsystem) {
   return current().specPathsInScope(scopeSubsystem);
 }
@@ -24446,23 +24726,23 @@ var init_specs2 = __esm({
           for (const field of fields) delete out[field];
           return out;
         };
-        const assertDeltaMarkers = (item, label2) => {
+        const assertDeltaMarkers = (item, label3) => {
           if (!item || typeof item !== "object") return;
           if ("remove" in item && typeof item.remove !== "boolean") {
             throw new Error(
-              `Refusing to update ${label2}: "remove" must be the boolean true, got ${JSON.stringify(item.remove)}. A non-boolean is ignored, which would leave the element in place while reporting success.`
+              `Refusing to update ${label3}: "remove" must be the boolean true, got ${JSON.stringify(item.remove)}. A non-boolean is ignored, which would leave the element in place while reporting success.`
             );
           }
           if ("action" in item && item.action !== "add" && item.action !== "delete") {
             throw new Error(
-              `Refusing to update ${label2}: unknown action ${JSON.stringify(item.action)} \u2014 expected "add" or "delete". An unknown verb is ignored, which would leave the element in place while reporting success.`
+              `Refusing to update ${label3}: unknown action ${JSON.stringify(item.action)} \u2014 expected "add" or "delete". An unknown verb is ignored, which would leave the element in place while reporting success.`
             );
           }
         };
-        const assertUnmatchedIsAnAddition = (deltaItem, key, existingKeys, label2) => {
+        const assertUnmatchedIsAnAddition = (deltaItem, key, existingKeys, label3) => {
           if (deltaItem?.remove === true || deltaItem?.action === "delete") {
             throw new Error(
-              `Refusing to delete ${label2} "${String(key)}": nothing with that identity exists. ` + (existingKeys.length ? `Present: ${existingKeys.map(String).join(", ")}.` : "The collection is empty.")
+              `Refusing to delete ${label3} "${String(key)}": nothing with that identity exists. ` + (existingKeys.length ? `Present: ${existingKeys.map(String).join(", ")}.` : "The collection is empty.")
             );
           }
           const near = existingKeys.find(
@@ -24470,7 +24750,7 @@ var init_specs2 = __esm({
           );
           if (near !== void 0) {
             throw new Error(
-              `Refusing to add ${label2} "${String(key)}": "${String(near)}" already exists and differs only in case or separators. Use the existing identity to edit it, or pick a name that is not a near-duplicate.`
+              `Refusing to add ${label3} "${String(key)}": "${String(near)}" already exists and differs only in case or separators. Use the existing identity to edit it, or pick a name that is not a near-duplicate.`
             );
           }
         };
@@ -24963,16 +25243,16 @@ var init_specs2 = __esm({
         const complaint = this.unmovableRequest(source, from, to, methods);
         if (complaint) throw new Error(`unmovable request: ${complaint}`);
         const contracts = this.loadInterfaceSpecs();
-        const plan = this.planMethodMove(source, to, methods, contracts);
-        const repointed = this.repointToNewHome(from, to, methods, plan);
-        const mentions = this.moveMentions(from, plan);
-        const rename = moveRename(from, to, methods, plan);
-        this.rekeyMoveAllows(plan, rename);
+        const plan2 = this.planMethodMove(source, to, methods, contracts);
+        const repointed = this.repointToNewHome(from, to, methods, plan2);
+        const mentions = this.moveMentions(from, plan2);
+        const rename = moveRename(from, to, methods, plan2);
+        this.rekeyMoveAllows(plan2, rename);
         if (hooks) {
-          const verdict = judgeMoveResult(hooks, plan);
-          plan.notices.push(...verdict.notices);
+          const verdict = judgeMoveResult(hooks, plan2);
+          plan2.notices.push(...verdict.notices);
           if (verdict.refusals.length > 0) {
-            const alternatives = this.rankMoveHomes(hooks, from, to, plan);
+            const alternatives = this.rankMoveHomes(hooks, from, to, plan2);
             return {
               moved: false,
               from,
@@ -24982,7 +25262,7 @@ var init_specs2 = __esm({
               repointed: 0,
               refusals: verdict.refusals,
               alternatives,
-              notices: plan.notices,
+              notices: plan2.notices,
               summary: refusedMoveSummary(from, to, methods, verdict.refusals, alternatives),
               dryRun,
               mentions,
@@ -24993,7 +25273,7 @@ var init_specs2 = __esm({
         }
         const carried = projectConfigRepository.rekeyCarried(rename, true);
         if (dryRun) {
-          const edits2 = moveChangeReports([...plan.edits.values()], true);
+          const edits2 = moveChangeReports([...plan2.edits.values()], true);
           return {
             moved: false,
             from,
@@ -25003,15 +25283,15 @@ var init_specs2 = __esm({
             repointed,
             refusals: [],
             alternatives: [],
-            notices: plan.notices,
-            summary: `Dry run: moving ${namedMethods(methods)} from "${from}" to "${to}" would touch ${edits2.length} spec${edits2.length === 1 ? "" : "s"}${createdClause(plan.created, "would create")} and re-point ${repointed} reference${repointed === 1 ? "" : "s"}${registerClause(carried, "would rekey")}. Nothing was written.`,
+            notices: plan2.notices,
+            summary: `Dry run: moving ${namedMethods(methods)} from "${from}" to "${to}" would touch ${edits2.length} spec${edits2.length === 1 ? "" : "s"}${createdClause(plan2.created, "would create")} and re-point ${repointed} reference${repointed === 1 ? "" : "s"}${registerClause(carried, "would rekey")}. Nothing was written.`,
             dryRun: true,
             mentions,
-            created: plan.created,
+            created: plan2.created,
             carried
           };
         }
-        const edits = this.writeMoveEdits([...plan.edits.values()], () => {
+        const edits = this.writeMoveEdits([...plan2.edits.values()], () => {
           projectConfigRepository.rekeyCarried(rename);
         });
         return {
@@ -25023,11 +25303,11 @@ var init_specs2 = __esm({
           repointed,
           refusals: [],
           alternatives: [],
-          notices: plan.notices,
-          summary: `Moved ${namedMethods(methods)} from "${from}" to "${to}": ${edits.length} spec${edits.length === 1 ? "" : "s"} written${createdClause(plan.created, "created")}, ${repointed} reference${repointed === 1 ? "" : "s"} re-pointed${registerClause(carried, "rekeyed")}${mentions.length ? `, ${mentions.length} still naming the old home in prose or on the wire` : ""}.`,
+          notices: plan2.notices,
+          summary: `Moved ${namedMethods(methods)} from "${from}" to "${to}": ${edits.length} spec${edits.length === 1 ? "" : "s"} written${createdClause(plan2.created, "created")}, ${repointed} reference${repointed === 1 ? "" : "s"} re-pointed${registerClause(carried, "rekeyed")}${mentions.length ? `, ${mentions.length} still naming the old home in prose or on the wire` : ""}.`,
           dryRun: false,
           mentions,
-          created: plan.created,
+          created: plan2.created,
           carried
         };
       }
@@ -25038,15 +25318,15 @@ var init_specs2 = __esm({
        * covered `<from>.<method>` unit anywhere names `<to>.<method>`. An allow
        * whose new home the plan does not stage stays where it is.
        */
-      rekeyMoveAllows(plan, rename) {
+      rekeyMoveAllows(plan2, rename) {
         const subjects = [...this.everySpecInTree()];
-        for (const edit of plan.edits.values()) if (edit.before === null) subjects.push({ kind: edit.kind, id: edit.id, spec: edit.after });
-        const stagedAfter = (kind, id) => plan.edits.get(`${kind}:${id}`)?.after;
+        for (const edit of plan2.edits.values()) if (edit.before === null) subjects.push({ kind: edit.kind, id: edit.id, spec: edit.after });
+        const stagedAfter = (kind, id) => plan2.edits.get(`${kind}:${id}`)?.after;
         for (const { kind, id, spec } of subjects) {
           if (id.includes("::")) continue;
           const allows = spec?.lint?.allow ?? [];
           if (allows.length === 0) continue;
-          const staged = plan.edits.get(`${kind}:${id}`);
+          const staged = plan2.edits.get(`${kind}:${id}`);
           const subject = staged ? staged.after : cloneSpec(spec);
           const kept = [];
           let changed = false;
@@ -25064,7 +25344,7 @@ var init_specs2 = __esm({
           }
           if (!changed) continue;
           subject.lint = { ...subject.lint, allow: kept };
-          if (!staged) this.stageMoveEdit(plan, kind, id, spec, subject);
+          if (!staged) this.stageMoveEdit(plan2, kind, id, spec, subject);
         }
       }
       /**
@@ -25131,7 +25411,7 @@ var init_specs2 = __esm({
         const target = this.loadComponentSpec(to);
         const stated = this.moveTargetContract(to, contracts.filter((i) => i.component === to));
         const implementations = this.loadImplementationSpecs();
-        const plan = {
+        const plan2 = {
           edits: /* @__PURE__ */ new Map(),
           source,
           target,
@@ -25153,10 +25433,10 @@ var init_specs2 = __esm({
           arriving.push(...cloneSpec(leaving));
           const remaining = cloneSpec(contract);
           remaining.methods = remaining.methods.filter((m) => !methods.includes(m.name));
-          this.stageMoveEdit(plan, "interface", contract.id, contract, remaining);
-          plan.rehomed.push({ from: contract.id, to: receiving.id });
+          this.stageMoveEdit(plan2, "interface", contract.id, contract, remaining);
+          plan2.rehomed.push({ from: contract.id, to: receiving.id });
           if (contract.methods.length === leaving.length) {
-            plan.notices.push(`"${contract.id}" is left with no methods \u2014 "${source.id}" no longer declares anything on it.`);
+            plan2.notices.push(`"${contract.id}" is left with no methods \u2014 "${source.id}" no longer declares anything on it.`);
           }
           for (const impl of implementations.filter((i) => i.contract === contract.id)) {
             const moving = impl.methods.filter((m) => methods.includes(m.name));
@@ -25165,22 +25445,22 @@ var init_specs2 = __esm({
             for (const entry of moving) if (impl.sourcePath) realizedIn.set(entry.name, impl.sourcePath);
             const kept = cloneSpec(impl);
             kept.methods = kept.methods.filter((m) => !methods.includes(m.name));
-            this.stageMoveEdit(plan, "implementation", impl.id, impl, kept);
+            this.stageMoveEdit(plan2, "implementation", impl.id, impl, kept);
             leftImplementations.push(impl.id);
           }
         }
-        this.stageMoveEdit(plan, "interface", receiving.id, stated, {
+        this.stageMoveEdit(plan2, "interface", receiving.id, stated, {
           ...cloneSpec(receiving),
           methods: [...cloneSpec(receiving.methods), ...arriving]
         });
-        if (!stated) plan.created.push(`interface "${receiving.id}"`);
-        if (arriving.some((m) => m.endpoint)) plan.wireBound.push(receiving.id);
+        if (!stated) plan2.created.push(`interface "${receiving.id}"`);
+        if (arriving.some((m) => m.endpoint)) plan2.wireBound.push(receiving.id);
         if (stated && receiving.status !== void 0 && receiving.status !== statusOfContracts(contracts, source.id)) {
-          plan.notices.push(`"${receiving.id}" is ${receiving.status} where the methods came from a ${statusOfContracts(contracts, source.id)} contract \u2014 the status of a moved method is the status of its new home.`);
+          plan2.notices.push(`"${receiving.id}" is ${receiving.status} where the methods came from a ${statusOfContracts(contracts, source.id)} contract \u2014 the status of a moved method is the status of its new home.`);
         }
         for (const entry of travelling) {
           if ((entry.narrative ?? []).length === 0 && !entry.intent) {
-            plan.notices.push(`"${entry.name}" moves with an empty narrative and no intent \u2014 nothing followed it but its name.`);
+            plan2.notices.push(`"${entry.name}" moves with an empty narrative and no intent \u2014 nothing followed it but its name.`);
           }
         }
         const targetImpl = implementations.find((i) => i.contract === receiving.id);
@@ -25189,33 +25469,33 @@ var init_specs2 = __esm({
             const file = realizedIn.get(entry.name);
             if (entry.sourcePath || !file || file === targetImpl.sourcePath) continue;
             entry.sourcePath = file;
-            plan.notices.push(`"${entry.name}" keeps ${file} as its own sourcePath: it was realized there by default, and "${targetImpl.id}" names ${targetImpl.sourcePath ? targetImpl.sourcePath : "no file"} \u2014 moving a method is not moving its code.`);
+            plan2.notices.push(`"${entry.name}" keeps ${file} as its own sourcePath: it was realized there by default, and "${targetImpl.id}" names ${targetImpl.sourcePath ? targetImpl.sourcePath : "no file"} \u2014 moving a method is not moving its code.`);
           }
-          this.stageMoveEdit(plan, "implementation", targetImpl.id, targetImpl, {
+          this.stageMoveEdit(plan2, "implementation", targetImpl.id, targetImpl, {
             ...cloneSpec(targetImpl),
             methods: [...cloneSpec(targetImpl.methods), ...travelling]
           });
-          for (const id of leftImplementations) plan.rehomed.push({ from: id, to: targetImpl.id });
+          for (const id of leftImplementations) plan2.rehomed.push({ from: id, to: targetImpl.id });
         } else if (travelling.length > 0) {
           const created = createdImplementation(target, receiving.id, source.id, travelling, implementations, contracts);
-          this.stageMoveEdit(plan, "implementation", created.spec.id, null, created.spec);
-          for (const id of leftImplementations) plan.rehomed.push({ from: id, to: created.spec.id });
-          plan.created.push(created.named);
-          plan.notices.push(...created.notices);
+          this.stageMoveEdit(plan2, "implementation", created.spec.id, null, created.spec);
+          for (const id of leftImplementations) plan2.rehomed.push({ from: id, to: created.spec.id });
+          plan2.created.push(created.named);
+          plan2.notices.push(...created.notices);
         }
-        plan.reach = reachOf(travelling, source.id, new Set(methods)).filter((id) => id !== to);
+        plan2.reach = reachOf(travelling, source.id, new Set(methods)).filter((id) => id !== to);
         const held = /* @__PURE__ */ new Set([...target.dependsOn ?? [], ...target.owns ?? []]);
-        plan.newDependencies = plan.reach.filter((id) => !held.has(id) && id !== to);
-        this.stageMoveEdit(plan, "component", source.id, source, cloneSpec(source));
-        this.stageMoveEdit(plan, "component", target.id, target, {
+        plan2.newDependencies = plan2.reach.filter((id) => !held.has(id) && id !== to);
+        this.stageMoveEdit(plan2, "component", source.id, source, cloneSpec(source));
+        this.stageMoveEdit(plan2, "component", target.id, target, {
           ...cloneSpec(target),
-          dependsOn: [...target.dependsOn ?? [], ...plan.newDependencies]
+          dependsOn: [...target.dependsOn ?? [], ...plan2.newDependencies]
         });
-        return plan;
+        return plan2;
       }
       /** Stage one spec's rewrite, keeping the version it started from as the snapshot a failed write restores. */
-      stageMoveEdit(plan, kind, id, before, after) {
-        plan.edits.set(`${kind}:${id}`, { kind, id, before, after });
+      stageMoveEdit(plan2, kind, id, before, after) {
+        plan2.edits.set(`${kind}:${id}`, { kind, id, before, after });
       }
       /**
        * Re-point every reference that names the old home, through the one
@@ -25225,7 +25505,7 @@ var init_specs2 = __esm({
        * that is moving: another method of the same component, and another
        * component's method of the same name, stay exactly where they point.
        */
-      repointToNewHome(from, to, methods, plan) {
+      repointToNewHome(from, to, methods, plan2) {
         const moved = new Set(methods);
         let repointed = 0;
         const remap = (ref, position, owner) => {
@@ -25234,21 +25514,21 @@ var init_specs2 = __esm({
           return to;
         };
         for (const { kind, id, spec } of this.everySpecInTree()) {
-          const staged = plan.edits.get(`${kind}:${id}`);
+          const staged = plan2.edits.get(`${kind}:${id}`);
           const subject = staged ? staged.after : cloneSpec(spec);
           if (!rewriteSpecRefs(subject, remap)) continue;
           if (staged) continue;
           if (id.includes("::")) {
-            plan.notices.push(`"${id}" lives in a chained subproject and still names "${from}" \u2014 re-point it from that project's own root.`);
+            plan2.notices.push(`"${id}" lives in a chained subproject and still names "${from}" \u2014 re-point it from that project's own root.`);
             repointed -= 1;
             continue;
           }
-          this.stageMoveEdit(plan, kind, id, spec, subject);
+          this.stageMoveEdit(plan2, kind, id, spec, subject);
         }
-        for (const edit of plan.edits.values()) {
+        for (const edit of plan2.edits.values()) {
           if (edit.before === null) rewriteSpecRefs(edit.after, remap);
         }
-        plan.notices.push(...this.callersOwingADependency(to, plan));
+        plan2.notices.push(...this.callersOwingADependency(to, plan2));
         return repointed;
       }
       /**
@@ -25257,13 +25537,13 @@ var init_specs2 = __esm({
        * list, because a dependency nobody judged is exactly what the gate exists to
        * prevent.
        */
-      callersOwingADependency(to, plan) {
+      callersOwingADependency(to, plan2) {
         const contracts = this.loadInterfaceSpecs();
         const owing = /* @__PURE__ */ new Set();
-        for (const edit of plan.edits.values()) {
+        for (const edit of plan2.edits.values()) {
           const owner = edit.kind === "component" ? edit.id : contracts.find((i) => i.id === edit.after.contract)?.component;
           if (!owner || owner === to) continue;
-          const component = owner === plan.target.id ? plan.target : this.loadComponentSpec(owner);
+          const component = owner === plan2.target.id ? plan2.target : this.loadComponentSpec(owner);
           if (!component) continue;
           const held = /* @__PURE__ */ new Set([...component.dependsOn ?? [], ...component.owns ?? []]);
           if (!held.has(to)) owing.add(owner);
@@ -25278,11 +25558,11 @@ var init_specs2 = __esm({
        * because the gate holds the judgement. `assess` answers rather than throws,
        * so this is a search and not a sequence of caught exceptions.
        */
-      rankMoveHomes(hooks, from, to, plan) {
+      rankMoveHomes(hooks, from, to, plan2) {
         const limit = this.dependencyLimit();
-        const pool = this.loadComponentSpecs().filter((c) => c.subsystem === plan.source.subsystem && c.id !== from);
-        if (!pool.some((c) => c.id === to)) pool.push(plan.target);
-        return pool.map((candidate) => weighMoveHome(hooks, candidate, plan.reach, limit)).sort((a, b) => Number(b.legal) - Number(a.legal) || a.newDependencies.length - b.newDependencies.length || a.component.localeCompare(b.component));
+        const pool = this.loadComponentSpecs().filter((c) => c.subsystem === plan2.source.subsystem && c.id !== from);
+        if (!pool.some((c) => c.id === to)) pool.push(plan2.target);
+        return pool.map((candidate) => weighMoveHome(hooks, candidate, plan2.reach, limit)).sort((a, b) => Number(b.legal) - Number(a.legal) || a.newDependencies.length - b.newDependencies.length || a.component.localeCompare(b.component));
       }
       /**
        * The project's `maxComponentDependencies`, so a candidate's dependency count
@@ -25312,8 +25592,8 @@ var init_specs2 = __esm({
        * receiving contract whose moved methods keep their wire address. A move
        * never edits prose and never re-addresses an RPC.
        */
-      moveMentions(from, plan) {
-        const mentions = new Set(plan.wireBound);
+      moveMentions(from, plan2) {
+        const mentions = new Set(plan2.wireBound);
         const named = new RegExp(`(?<![A-Za-z0-9_])${from}(?![A-Za-z0-9_])`);
         for (const { kind, id, spec } of this.everySpecInTree()) {
           if (namesInProse(spec, named)) mentions.add(kind === "system" ? "system" : id);
@@ -25333,9 +25613,9 @@ var init_specs2 = __esm({
         const reports = moveChangeReports(edits, false);
         const written = [];
         try {
-          for (const report2 of reports) {
-            const edit = edits.find((e) => e.kind === report2.kind && e.id === report2.id);
-            report2.notices.push(...this.saveMovedSpec(edit.kind, edit.after));
+          for (const report3 of reports) {
+            const edit = edits.find((e) => e.kind === report3.kind && e.id === report3.id);
+            report3.notices.push(...this.saveMovedSpec(edit.kind, edit.after));
             written.push(edit);
           }
           finish?.();
@@ -26107,11 +26387,11 @@ function renameMethod(componentId, methodName, newName, pinSymbol) {
     if (!movingContracts.has(implementation.contract)) continue;
     const realization = implementation.methods.find((m) => m.name === methodName);
     if (!realization) continue;
-    const pin = realization.symbol === void 0 && pinSymbol !== false;
-    if (pin) pinnedSymbol = methodName;
+    const pin2 = realization.symbol === void 0 && pinSymbol !== false;
+    if (pin2) pinnedSymbol = methodName;
     saveImplementationSpec({
       ...implementation,
-      methods: implementation.methods.map((m) => m.name === methodName ? { ...m, name: newName, ...pin ? { symbol: methodName } : {} } : m)
+      methods: implementation.methods.map((m) => m.name === methodName ? { ...m, name: newName, ...pin2 ? { symbol: methodName } : {} } : m)
     });
     renamed.push(implementation.id);
   }
@@ -27206,14 +27486,14 @@ var init_custom = __esm({
       }
       export(ctx) {
         const { agent, target, renderedInstructions } = ctx;
-        const label2 = "label" in target ? target.label : "Custom";
+        const label3 = "label" in target ? target.label : "Custom";
         const filePath = this.outputPath(ctx);
         const content = [
           "---",
           `name: ${agent.name}`,
           `description: ${agent.description}`,
           `id: ${agent.id}`,
-          `target: ${label2}`,
+          `target: ${label3}`,
           "---",
           "",
           renderedInstructions,
@@ -30410,7 +30690,7 @@ var require_dist = __commonJS({
       return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
     }
     var fs60 = __toESM2(require("fs"));
-    var path76 = __toESM2(require("path"));
+    var path77 = __toESM2(require("path"));
     var import_fflate = require_node();
     var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".hg", ".svn"]);
     function listEntries(archive) {
@@ -30448,8 +30728,8 @@ var require_dist = __commonJS({
     }
     function writeTree(destDir, files) {
       for (const file of files) {
-        const absolute = path76.join(destDir, file.path);
-        fs60.mkdirSync(path76.dirname(absolute), { recursive: true });
+        const absolute = path77.join(destDir, file.path);
+        fs60.mkdirSync(path77.dirname(absolute), { recursive: true });
         fs60.writeFileSync(absolute, file.contents);
       }
     }
@@ -30462,10 +30742,10 @@ var require_dist = __commonJS({
       for (const entry of fs60.readdirSync(current2, { withFileTypes: true })) {
         if (entry.isDirectory()) {
           if (SKIP_DIRS.has(entry.name)) continue;
-          walkPackDir(root, path76.join(current2, entry.name), out);
+          walkPackDir(root, path77.join(current2, entry.name), out);
         } else if (entry.isFile()) {
-          const absolute = path76.join(current2, entry.name);
-          const relative22 = path76.relative(root, absolute).split(path76.sep).join("/");
+          const absolute = path77.join(current2, entry.name);
+          const relative22 = path77.relative(root, absolute).split(path77.sep).join("/");
           out.push({ path: relative22, contents: fs60.readFileSync(absolute) });
         }
       }
@@ -30561,9 +30841,9 @@ var require_dist = __commonJS({
     function extractPack3(archiveBytes, destDir, limits) {
       const effectiveLimits = limits === void 0 ? defaultLimits() : limits;
       const entries = listEntries(archiveBytes);
-      const plan = planExtraction(entries, effectiveLimits);
+      const plan2 = planExtraction(entries, effectiveLimits);
       const files = [];
-      for (const approvedPath of plan.paths) {
+      for (const approvedPath of plan2.paths) {
         const contents = inflateEntry(archiveBytes, approvedPath);
         files.push({ path: approvedPath, contents });
       }
@@ -30636,12 +30916,12 @@ var require_dist = __commonJS({
     function extractTreeArchive3(archiveBytes, destDir, limits, refuseExecutableEntries) {
       const effectiveLimits = limits === void 0 ? defaultTreeLimits() : limits;
       const entries = listEntries(archiveBytes);
-      const plan = planTreeExtraction(entries, effectiveLimits);
+      const plan2 = planTreeExtraction(entries, effectiveLimits);
       if (refuseExecutableEntries === true) {
-        assertPortableTreePaths(plan.paths);
+        assertPortableTreePaths(plan2.paths);
       }
       const files = [];
-      for (const approvedPath of plan.paths) {
+      for (const approvedPath of plan2.paths) {
         const contents = inflateEntry(archiveBytes, approvedPath);
         files.push({ path: approvedPath, contents });
       }
@@ -30899,7 +31179,7 @@ var init_treetransfer = __esm({
 });
 
 // src/core/stereotype-migration.ts
-function retireSpecialists(apply) {
+function retireSpecialists(apply2) {
   const components = loadComponentSpecs();
   const byId = new Map(components.map((c) => [c.id, c]));
   const specialists = components.filter((c) => c.componentType === "Specialist" && !c.id.includes("::")).sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
@@ -30986,7 +31266,7 @@ function retireSpecialists(apply) {
       reason: reasons.get(specialist.id)
     };
   });
-  if (!apply) return { retyped, rebasedVariants: specialistVariants, applied: false };
+  if (!apply2) return { retyped, rebasedVariants: specialistVariants, applied: false };
   for (const retype of retyped) {
     const orchestrator = { ...byId.get(retype.component), componentType: "Orchestrator" };
     delete orchestrator.dependencyClass;
@@ -31008,7 +31288,7 @@ var init_stereotype_migration = __esm({
 });
 
 // src/core/narrative-repair.ts
-function repairForeignStepFields(apply) {
+function repairForeignStepFields(apply2) {
   const implementations = loadImplementationSpecs();
   const repairs = [];
   const changed = [];
@@ -31031,7 +31311,7 @@ function repairForeignStepFields(apply) {
     }
     if (touched) changed.push(impl);
   }
-  if (apply && changed.length) {
+  if (apply2 && changed.length) {
     for (const impl of changed) saveImplementationSpec(impl);
     invalidateSpecCache();
   }
@@ -31047,8 +31327,8 @@ var init_narrative_repair = __esm({
 
 // src/models/lock.ts
 function describeApprover(who) {
-  const label2 = who.name ? `${who.name} (${who.id})` : who.id;
-  return who.source === "hosted" ? `${label2} [authenticated]` : label2;
+  const label3 = who.name ? `${who.name} (${who.id})` : who.id;
+  return who.source === "hosted" ? `${label3} [authenticated]` : label3;
 }
 var init_lock = __esm({
   "src/models/lock.ts"() {
@@ -32244,9 +32524,9 @@ function statusForCreate(restatement, existing) {
   const held = stored !== void 0 && STATUS_ORDER.includes(stored) ? stored : void 0;
   if (stated === void 0) return { status: held ?? "draft" };
   if (held === void 0 || STATUS_ORDER.indexOf(stated) >= STATUS_ORDER.indexOf(held)) return { status: stated };
-  const label2 = `${restatement.kind} "${restatement.spec.id}"`;
+  const label3 = `${restatement.kind} "${restatement.spec.id}"`;
   return {
-    refusal: `Refusing to re-author ${label2} at status "${stated}": it is stored at "${held}", and a create tool never lowers a spec's status \u2014 a restatement that reopened a frozen spec would undo a lock without saying so. Nothing was written. To reopen it deliberately, use sdd_update_spec with {"status": "${stated}"}; to keep the level it has, leave status out.`
+    refusal: `Refusing to re-author ${label3} at status "${stated}": it is stored at "${held}", and a create tool never lowers a spec's status \u2014 a restatement that reopened a frozen spec would undo a lock without saying so. Nothing was written. To reopen it deliberately, use sdd_update_spec with {"status": "${stated}"}; to keep the level it has, leave status out.`
   };
 }
 function carryInto(restatement, existing, candidate) {
@@ -32430,17 +32710,17 @@ function updateSpecGated(kind, id, delta, dryRun) {
   const testRoots = bound2.rules?.conformance?.testRoots ?? [];
   const stored = loadSpec(kind, id);
   const gate = componentCandidateGate(bound2, stored?.subsystem);
-  const report2 = updateSpec(kind, id, delta, gate, dryRun);
-  const changed = changedMethods(report2);
+  const report3 = updateSpec(kind, id, delta, gate, dryRun);
+  const changed = changedMethods(report3);
   if (changed.length > 0 && testRoots.length > 0) {
     const written = Array.isArray(delta?.methods) ? delta.methods : [];
-    report2.testsToRevisit = testsInvalidatedBy(kind, id, changed, [stored], bound2, written);
+    report3.testsToRevisit = testsInvalidatedBy(kind, id, changed, [stored], bound2, written);
   }
-  return report2;
+  return report3;
 }
-function changedMethods(report2) {
+function changedMethods(report3) {
   const named = /* @__PURE__ */ new Set();
-  for (const change of report2.changes) {
+  for (const change of report3.changes) {
     const [field, name] = change.path.split(".");
     if (field === "methods" && name) named.add(name);
   }
@@ -32725,18 +33005,18 @@ function structured(content, data) {
 function jsonStructured(value) {
   return structured(JSON.stringify(value, null, 2), value);
 }
-function renderChangeReport(report2) {
-  const lines = [report2.dryRun ? `DRY RUN \u2014 nothing was written. ${report2.summary}` : report2.summary];
-  for (const change of report2.changes) {
+function renderChangeReport(report3) {
+  const lines = [report3.dryRun ? `DRY RUN \u2014 nothing was written. ${report3.summary}` : report3.summary];
+  for (const change of report3.changes) {
     const to = change.after === void 0 ? "" : `: ${JSON.stringify(change.after)}`;
     const from = change.before === void 0 ? "" : ` (was ${JSON.stringify(change.before)})`;
-    lines.push(`- ${change.path} ${report2.dryRun ? `would be ${change.change}` : change.change}${to}${from}`);
+    lines.push(`- ${change.path} ${report3.dryRun ? `would be ${change.change}` : change.change}${to}${from}`);
   }
-  if (report2.ineffective.length) {
-    lines.push("", "NO EFFECT:", ...report2.ineffective.map((i) => `- ${i}`));
+  if (report3.ineffective.length) {
+    lines.push("", "NO EFFECT:", ...report3.ineffective.map((i) => `- ${i}`));
   }
-  if (report2.notices.length) lines.push("", "NOTICE:", ...report2.notices.map((n) => `- ${n}`));
-  lines.push(...renderTestsToRevisit(report2.testsToRevisit));
+  if (report3.notices.length) lines.push("", "NOTICE:", ...report3.notices.map((n) => `- ${n}`));
+  lines.push(...renderTestsToRevisit(report3.testsToRevisit));
   return lines.join("\n");
 }
 function renderTestsToRevisit(entries) {
@@ -33251,11 +33531,11 @@ function createMcpServer(options = {}) {
         if (!sub) return errText(`Subsystem "${subsystem}" does not exist.`);
         const delta = publicInterfacesReplacement(subsystem, sub.publicInterfaces ?? [], publicInterfaces);
         if (typeof delta === "string") return errText(delta);
-        const report2 = updateSpecGated("subsystem", subsystem, delta);
+        const report3 = updateSpecGated("subsystem", subsystem, delta);
         return structured(
           `Updated public interfaces for subsystem "${subsystem}" (${publicInterfaces.length} ${publicInterfaces.length === 1 ? "entry" : "entries"}).
-${renderChangeReport(report2)}`,
-          report2
+${renderChangeReport(report3)}`,
+          report3
         );
       } catch (e) {
         return errMessage(e);
@@ -33276,11 +33556,11 @@ ${renderChangeReport(report2)}`,
     ({ subsystem, projectPath }) => {
       try {
         const delta = projectPath ? { projectPath } : { unset: ["projectPath"] };
-        const report2 = updateSpecGated("subsystem", subsystem, delta);
+        const report3 = updateSpecGated("subsystem", subsystem, delta);
         return structured(
           `Updated projectPath for subsystem "${subsystem}" to: ${projectPath || "none (cleared)"}
-${renderChangeReport(report2)}`,
-          report2
+${renderChangeReport(report3)}`,
+          report3
         );
       } catch (e) {
         return errMessage(e);
@@ -33614,11 +33894,11 @@ ${renderChangeReport(report2)}`,
           methods.push({ name: e.method, endpoint: parsed.data });
           bound2.push(`${e.method}\u2192${e.transport}`);
         }
-        const report2 = updateSpecGated("interface", interfaceId, { methods });
+        const report3 = updateSpecGated("interface", interfaceId, { methods });
         return structured(
           `Bound ${bound2.length} endpoint(s) on "${interfaceId}": ${bound2.join(", ")}.
-${renderChangeReport(report2)}`,
-          report2
+${renderChangeReport(report3)}`,
+          report3
         );
       } catch (e) {
         return errMessage(e);
@@ -33960,8 +34240,8 @@ ${testsBlock}` : ""}`, deletion);
     },
     ({ kind, id, delta, dryRun }) => {
       try {
-        const report2 = updateSpecGated(kind, id, delta, dryRun);
-        return structured(renderChangeReport(report2), report2);
+        const report3 = updateSpecGated(kind, id, delta, dryRun);
+        return structured(renderChangeReport(report3), report3);
       } catch (e) {
         return errText(String(e));
       }
@@ -33979,13 +34259,13 @@ ${testsBlock}` : ""}`, deletion);
     },
     ({ subsystem, recursive }) => {
       try {
-        const report2 = getStatusReport({
+        const report3 = getStatusReport({
           subsystem,
           recursive: recursive ?? true
         });
         const family = statusFamilyContext();
         const verdict = approvalVerdict();
-        return text(`${family}${report2.text}${verdict.text}`);
+        return text(`${family}${report3.text}${verdict.text}`);
       } catch (e) {
         return errText(String(e));
       }
@@ -34662,18 +34942,18 @@ async function runMcpStatus() {
     { label: "Antigravity (project)", filePath: geminiProject, fallbackName: "settings.json" },
     { label: "Antigravity (global)", filePath: geminiGlobal, fallbackName: "mcp_config.json" }
   ];
-  for (const { label: label2, filePath, fallbackName } of checks) {
+  for (const { label: label3, filePath, fallbackName } of checks) {
     if (!fs24.existsSync(filePath)) {
-      console.log(`  ${label2}: ${import_chalk3.default.gray(`${fallbackName} not found`)}`);
+      console.log(`  ${label3}: ${import_chalk3.default.gray(`${fallbackName} not found`)}`);
       continue;
     }
     try {
       const s = JSON.parse(fs24.readFileSync(filePath, "utf8"));
       const registered = !!s["mcpServers"]?.["wairon"];
       const mark = registered ? import_chalk3.default.green("\u2713 registered") : import_chalk3.default.gray("not registered");
-      console.log(`  ${label2}: ${mark}  ${import_chalk3.default.gray(filePath)}`);
+      console.log(`  ${label3}: ${mark}  ${import_chalk3.default.gray(filePath)}`);
     } catch {
-      console.log(`  ${label2}: ${import_chalk3.default.red("parse error")}  ${import_chalk3.default.gray(filePath)}`);
+      console.log(`  ${label3}: ${import_chalk3.default.red("parse error")}  ${import_chalk3.default.gray(filePath)}`);
     }
   }
   logger.blank();
@@ -34732,7 +35012,7 @@ var init_mcp = __esm({
 });
 
 // src/cli/index.ts
-var path75 = __toESM(require("path"));
+var path76 = __toESM(require("path"));
 var import_commander = require("commander");
 init_defaults();
 init_logger();
@@ -36015,14 +36295,14 @@ var http = __toESM(require("http"));
 var https = __toESM(require("https"));
 init_defaults();
 function downloadFile(url, dest) {
-  return new Promise((resolve36, reject) => {
+  return new Promise((resolve37, reject) => {
     const file = fs26.createWriteStream(dest);
     const get4 = url.startsWith("https://") ? https.get : http.get;
     get4(url, { headers: { "User-Agent": `wairon/${WAIRON_VERSION}` }, agent: false }, (res) => {
       if (res.statusCode === 301 || res.statusCode === 302) {
         file.close();
         res.destroy();
-        downloadFile(res.headers.location, dest).then(resolve36).catch(reject);
+        downloadFile(res.headers.location, dest).then(resolve37).catch(reject);
         return;
       }
       if (res.statusCode !== 200) {
@@ -36034,7 +36314,7 @@ function downloadFile(url, dest) {
       res.pipe(file);
       file.on("finish", () => {
         res.destroy();
-        file.close(() => resolve36());
+        file.close(() => resolve37());
       });
       file.on("error", (err) => {
         res.destroy();
@@ -36086,8 +36366,8 @@ async function runUpdate(options = {}) {
     return;
   }
   const latestVersion = release.tag_name.replace(/^v/, "");
-  const label2 = releaseChannelLabel(release.tag_name);
-  const channelLabel = label2 === "stable" ? "" : ` [${label2}]`;
+  const label3 = releaseChannelLabel(release.tag_name);
+  const channelLabel = label3 === "stable" ? "" : ` [${label3}]`;
   logger.info(`New version available: ${release.tag_name}${channelLabel}  (current: ${WAIRON_VERSION})`);
   if (release.body) {
     logger.blank();
@@ -36176,19 +36456,19 @@ function releaseTier(tag, githubPrerelease = false) {
   if (dash === -1) {
     return githubPrerelease ? CHANNEL_RANK.dev : CHANNEL_RANK.stable;
   }
-  const label2 = version.slice(dash + 1).replace(/\.\d+$/, "");
-  const rank = CHANNEL_RANK[label2];
+  const label3 = version.slice(dash + 1).replace(/\.\d+$/, "");
+  const rank = CHANNEL_RANK[label3];
   return rank === void 0 || rank === CHANNEL_RANK.stable ? CHANNEL_RANK.dev : rank;
 }
 function reportOffChannelBuild(channel, currentVersion, newestOnChannel) {
   const tier = releaseTier(currentVersion);
   if (tier <= (CHANNEL_RANK[channel] ?? CHANNEL_RANK.stable)) return;
-  const label2 = releaseChannelLabel(currentVersion);
+  const label3 = releaseChannelLabel(currentVersion);
   logger.warn(
-    `This is a ${label2} build (${WAIRON_VERSION}) but the update channel is ${channel}.`
+    `This is a ${label3} build (${WAIRON_VERSION}) but the update channel is ${channel}.`
   );
   const target = newestOnChannel ? ` The newest ${channel} release is ${newestOnChannel}.` : "";
-  const track = isUpdateChannel(label2) ? `Track this build with \`wairon update --channel ${label2}\`, or reinstall` : "Reinstall";
+  const track = isUpdateChannel(label3) ? `Track this build with \`wairon update --channel ${label3}\`, or reinstall` : "Reinstall";
   logger.info(`It will not update until ${channel} passes it.${target} ${track} to return to ${channel}.`);
   logger.blank();
 }
@@ -36197,9 +36477,9 @@ function reportWiderChannel(releases, channel, currentVersion) {
     (r) => !isEligibleForChannel(r.tag_name, channel, r.prerelease) && isNewer(currentVersion, r.tag_name.replace(/^v/, ""))
   );
   if (!wider) return;
-  const label2 = releaseChannelLabel(wider.tag_name);
-  const hint = isUpdateChannel(label2) ? ` \u2014 install it with \`wairon update --channel ${label2}\`.` : ".";
-  logger.info(`A newer pre-release exists: ${wider.tag_name} [${label2}]${hint}`);
+  const label3 = releaseChannelLabel(wider.tag_name);
+  const hint = isUpdateChannel(label3) ? ` \u2014 install it with \`wairon update --channel ${label3}\`.` : ".";
+  logger.info(`A newer pre-release exists: ${wider.tag_name} [${label3}]${hint}`);
 }
 function isEligibleForChannel(tag, channel, githubPrerelease = false) {
   return releaseTier(tag, githubPrerelease) <= (CHANNEL_RANK[channel] ?? CHANNEL_RANK.stable);
@@ -36211,7 +36491,7 @@ function releaseChannelLabel(tag) {
   return version.slice(dash + 1).replace(/\.\d+$/, "") || "stable";
 }
 function fetchReleases(repo) {
-  return new Promise((resolve36, reject) => {
+  return new Promise((resolve37, reject) => {
     const url = `https://api.github.com/repos/${repo}/releases?per_page=100`;
     const options = {
       headers: {
@@ -36231,7 +36511,7 @@ function fetchReleases(repo) {
           return;
         }
         try {
-          resolve36(JSON.parse(data));
+          resolve37(JSON.parse(data));
         } catch {
           reject(new Error("Failed to parse GitHub API response"));
         }
@@ -36375,13 +36655,13 @@ function withoutTrailingNewline(text2) {
 }
 async function runStatus(options = {}) {
   assertProjectInitialized();
-  const report2 = getStatusReport(options, TERMINAL_DECOR);
-  if (report2.failed) {
-    refuseUnreadableTree(report2.text);
+  const report3 = getStatusReport(options, TERMINAL_DECOR);
+  if (report3.failed) {
+    refuseUnreadableTree(report3.text);
   }
   logger.header("Architecture Status Dashboard");
   logger.blank();
-  console.log(withoutTrailingNewline(report2.text));
+  console.log(withoutTrailingNewline(report3.text));
   const lock = approvalVerdict();
   if (lock.text.trim()) {
     logger.blank();
@@ -36458,7 +36738,7 @@ async function filteredCheckbox(config) {
     32,
     Math.max(...items.map((i) => i.label.length))
   );
-  return new Promise((resolve36) => {
+  return new Promise((resolve37) => {
     const checked = /* @__PURE__ */ new Set();
     let cursor = 0;
     let filterIdx = 0;
@@ -36525,7 +36805,7 @@ async function filteredCheckbox(config) {
       );
       teardown();
       const result = items.filter((_, idx) => checked.has(idx)).map((i) => i.value);
-      resolve36(result);
+      resolve37(result);
     }
     function abort() {
       process.stdout.write("\n");
@@ -36797,8 +37077,9 @@ async function runSkillsInstall() {
 // src/commands/doctor.ts
 var fs28 = __toESM(require("fs"));
 var os9 = __toESM(require("os"));
-var path42 = __toESM(require("path"));
+var path43 = __toESM(require("path"));
 var import_chalk12 = __toESM(require("chalk"));
+var import_inquirer4 = __toESM(require("inquirer"));
 init_logger();
 init_defaults();
 init_paths();
@@ -36807,6 +37088,356 @@ init_fs();
 init_project();
 init_lock();
 init_mcp();
+
+// src/commands/chaining-migration.ts
+var path42 = __toESM(require("path"));
+
+// src/commands/adapters/surfaces.ts
+init_surface_portal();
+
+// src/commands/chaining-migration.ts
+init_fs();
+init_paths();
+init_errors();
+init_project();
+init_project_family();
+init_exports();
+function isEmpty(migration) {
+  return migration.projects.every((p) => !hasWrites(p));
+}
+function blocked(migration) {
+  return migration.findings.some((f) => f.blocking);
+}
+function hasWrites(p) {
+  return p.idToWrite !== void 0 || p.exports.length > 0 || p.externals.length > 0 || p.pins.length > 0;
+}
+function plan() {
+  const bound2 = getProjectRoot();
+  const climbed = climb2(bound2);
+  return runWithProjectRoot(climbed.top, () => planFamily(climbed.top, climbed.whole));
+}
+function climb2(start2) {
+  let current2 = start2;
+  let parent;
+  do {
+    parent = runWithProjectRoot(current2, () => resolveChainingParent());
+    if (parent) current2 = parent.parentRoot;
+  } while (parent);
+  return { top: current2, whole: !parentWithheld() };
+}
+function parentWithheld() {
+  const reach2 = getRequestParentReach();
+  return reach2 !== null && !reach2.parentReach;
+}
+function planFamily(top, whole) {
+  const ctx = { family: graph(), projects: /* @__PURE__ */ new Map(), findings: [], absent: /* @__PURE__ */ new Map() };
+  if (!whole) {
+    ctx.findings.push({
+      kind: "family-partial",
+      project: "",
+      blocking: true,
+      detail: "the climb stopped at a hop out of reach, so a producer above it could need writes this plan cannot see \u2014 run the migration from the family's top root"
+    });
+  }
+  decideIds(ctx);
+  planCrossings(ctx);
+  convertLegacyPins(ctx);
+  return settle2(ctx, top, whole);
+}
+function entryOf(ctx, node) {
+  let entry = ctx.projects.get(node.namespace);
+  if (!entry) {
+    entry = { project: node.namespace, directory: node.directory, exports: [], externals: [], pins: [], supersededPins: [] };
+    ctx.projects.set(node.namespace, entry);
+  }
+  return entry;
+}
+function idOf(ctx, namespace) {
+  return ctx.projects.get(namespace)?.id;
+}
+var label2 = (namespace) => namespace === "" ? "the top root" : `"${namespace}"`;
+function decideIds(ctx) {
+  for (const node of ctx.family.nodes) {
+    const approved = approvalRecord(node.directory)?.projectId;
+    decideId(ctx, node, approved);
+  }
+  checkPlannedIds(ctx);
+}
+function decideId(ctx, node, approved) {
+  const entry = entryOf(ctx, node);
+  const member = node.parent !== void 0;
+  if (node.idSource === "declared") {
+    entry.id = node.id;
+    return;
+  }
+  const planned = approved ?? (member ? node.mountAlias : node.id);
+  if (node.name === void 0) absentProject(ctx, node);
+  if (planned === void 0) {
+    ctx.findings.push({ kind: "id-ambiguous", project: node.namespace, blocking: false, detail: `${label2(node.namespace)} declares no id and its name yields none \u2014 declare one in its project.yaml` });
+    return;
+  }
+  entry.id = planned;
+  entry.idToWrite = planned;
+  if (approved !== void 0 && member && approved !== node.mountAlias) {
+    ctx.findings.push({
+      kind: "id-locked",
+      project: node.namespace,
+      blocking: false,
+      detail: `${label2(node.namespace)} keeps "${approved}", the id its lock approved, rather than its mount's subsystem id "${node.mountAlias}" \u2014 moving it is the rename migration`
+    });
+  }
+}
+function absentProject(ctx, node) {
+  const finding = {
+    kind: "project-absent",
+    project: node.namespace,
+    blocking: false,
+    detail: `${label2(node.namespace)} (${node.directory}) has no readable project.yaml \u2014 \`wairon doctor --fix\` writes one for a chained child first`
+  };
+  ctx.findings.push(finding);
+  ctx.absent.set(node.namespace, finding);
+}
+function checkPlannedIds(ctx) {
+  const holders = /* @__PURE__ */ new Map();
+  for (const entry of ctx.projects.values()) {
+    if (entry.id !== void 0) holders.set(entry.id, [...holders.get(entry.id) ?? [], entry.project]);
+  }
+  for (const entry of ctx.projects.values()) {
+    if (entry.idToWrite === void 0) continue;
+    const others = (holders.get(entry.idToWrite) ?? []).filter((ns) => ns !== entry.project);
+    const why = !PROJECT_ID_RE.test(entry.idToWrite) ? "breaks the project-id grammar" : others.length > 0 ? `is also the id of ${others.map(label2).join(", ")}` : void 0;
+    if (why === void 0) continue;
+    ctx.findings.push({ kind: "id-ambiguous", project: entry.project, blocking: false, detail: `the id planned for ${label2(entry.project)}, "${entry.idToWrite}", ${why} \u2014 declare one by hand` });
+    delete entry.id;
+    delete entry.idToWrite;
+  }
+  reportOrphanedDeclarations(ctx);
+}
+function reportOrphanedDeclarations(ctx) {
+  for (const node of ctx.family.nodes) {
+    for (const external of node.externals) {
+      if (external.sourceKind !== "family" || external.producer === void 0) continue;
+      const next = ctx.projects.get(external.producer)?.idToWrite;
+      if (next === void 0 || next === external.project) continue;
+      ctx.findings.push({
+        kind: "declaration-orphaned",
+        project: node.namespace,
+        blocking: false,
+        detail: `the external "${external.alias}" finds ${label2(external.producer)} by "${external.project}", which it leaves for "${next}" \u2014 re-point the declaration after the migration`
+      });
+    }
+  }
+}
+function planCrossings(ctx) {
+  const pairs = /* @__PURE__ */ new Map();
+  for (const ref of ctx.family.references) pairs.set(`${ref.consumer}\0${ref.producer}`, { consumer: ref.consumer, producer: ref.producer });
+  for (const { consumer, producer } of pairs.values()) planPair(ctx, consumer, producer);
+}
+function planPair(ctx, consumer, producer) {
+  const consumerNode2 = familyNode(ctx.family, consumer);
+  const producerNode = familyNode(ctx.family, producer);
+  if (!consumerNode2 || !producerNode) return;
+  const usage = exportUsage(consumer, producer);
+  const table = resolveProjectExports(producer || void 0);
+  let entries = false;
+  for (const ref of usage.unexported) entries = planEntry(ctx, producerNode, ref, table) || entries;
+  const alias = declares(ctx.family, consumer, producer) ? declaredAlias(consumerNode2, producer) : planExternal(ctx, consumerNode2, producer, "reference");
+  if (alias !== void 0 && (entries || alias.planned)) addPin(ctx, consumerNode2, alias.alias);
+}
+function declaredAlias(consumer, producer) {
+  const external = consumer.externals.find((e) => e.sourceKind === "family" && e.producer === producer);
+  return external ? { alias: external.alias, planned: false } : void 0;
+}
+function addPin(ctx, consumer, alias) {
+  const entry = entryOf(ctx, consumer);
+  if (!entry.pins.includes(alias)) entry.pins.push(alias);
+}
+function planEntry(ctx, producer, ref, table) {
+  const target = targetOf(ref);
+  if (!target) return report(ctx, "target-unpublished", ref, `${ref.specId} names "${ref.target}", which ${label2(producer.namespace)} does not hold`);
+  if (target.kind === "subsystem") {
+    return report(ctx, "subsystem-reference", ref, `${ref.specId} re-exports ${label2(producer.namespace)}'s subsystem "${target.id}" wholesale \u2014 no L0 entry short of exporting it expresses that; stage 3 rewrites the reference`);
+  }
+  const published = resolveSubsystemExports(target.source);
+  return decideEntry(ctx, producer, ref, target, table, published);
+}
+function targetOf(ref) {
+  const component = loadSpec("component", ref.target);
+  if (component) return { kind: "component", id: component.id, source: component.subsystem };
+  const last = ref.target.split("::").pop();
+  for (const candidate of [ref.target, ref.producer ? `${ref.producer}::${last}` : last]) {
+    const type = loadSpec("type", candidate);
+    if (type) return type.subsystem ? { kind: "type", id: type.id, source: type.subsystem } : null;
+  }
+  const subsystem = loadSpec("subsystem", ref.target);
+  return subsystem ? { kind: "subsystem", id: subsystem.id, source: subsystem.id } : null;
+}
+function decideEntry(ctx, producer, ref, target, table, published) {
+  const key = targetKey(target);
+  const at = published.entries.filter((e) => exportTargetKey({ ...e, interface: void 0 }) === key);
+  if (at.length === 0) {
+    return report(ctx, "target-unpublished", ref, `"${target.id}" is not in its subsystem's L1 table, so no L0 re-export can follow it \u2014 publish it at L1 first, or the reference is wrong`);
+  }
+  if (table.entries.some((e) => exportTargetKey({ ...e, interface: void 0 }) === key) || !reachableThrough(at, ref)) {
+    return report(ctx, "narrowed", ref, `"${target.id}" is exported under a narrowing that does not declare "${ref.member ?? "what the reference reaches"}" \u2014 widen the narrowing or reach another member`);
+  }
+  const local = localIn(producer.namespace, target.id);
+  const publicName = local.split("::").pop();
+  const taken = table.entries.find((e) => e.publicName === publicName && exportTargetKey({ ...e, interface: void 0 }) !== key) ?? entryOf(ctx, producer).exports.find((e) => e.publicName === publicName && (e.component ?? e.typeDef) !== local);
+  if (taken) {
+    return report(ctx, "name-taken", ref, `"${publicName}" already names another item in ${label2(producer.namespace)} \u2014 export "${target.id}" under a name a person chooses`);
+  }
+  mergeEntry(entryOf(ctx, producer), target, localIn(producer.namespace, target.source), local, publicName, ref);
+  return true;
+}
+function reachableThrough(entries, ref) {
+  if (ref.member === void 0 || ref.member.startsWith("capability:")) return true;
+  return entries.some((e) => {
+    if (e.kind !== "component" || e.interface === void 0) return true;
+    const narrowing = loadSpec("interface", e.interface);
+    return narrowing?.methods.some((m) => m.name === ref.member) ?? false;
+  });
+}
+var targetKey = (t) => t.kind === "type" ? `type:${t.id}` : `component:${t.id}`;
+function localIn(namespace, id) {
+  return namespace && id.startsWith(`${namespace}::`) ? id.slice(namespace.length + 2) : id;
+}
+function mergeEntry(entry, target, from, item, publicName, ref) {
+  let planned = entry.exports.find((e) => e.from === from && (target.kind === "type" ? e.typeDef : e.component) === item);
+  if (!planned) {
+    planned = { from, ...target.kind === "type" ? { typeDef: item } : { component: item }, publicName, audience: "project", consumers: [], members: [] };
+    entry.exports.push(planned);
+  }
+  addSorted(planned.consumers, ref.consumer);
+  const member = target.kind === "type" ? "type" : ref.member;
+  if (member !== void 0) addSorted(planned.members, member);
+}
+function addSorted(list2, value) {
+  if (!list2.includes(value)) {
+    list2.push(value);
+    list2.sort();
+  }
+}
+function report(ctx, kind, ref, detail) {
+  ctx.findings.push({ kind, project: ref.producer, detail, reference: ref, blocking: false });
+  return false;
+}
+function planExternal(ctx, consumer, producer, reason) {
+  const alias = idOf(ctx, producer);
+  const refuse = (kind, detail) => {
+    ctx.findings.push({ kind, project: consumer.namespace, blocking: false, detail });
+    return void 0;
+  };
+  if (alias === void 0) return refuse("alias-invalid", `${label2(producer)} has no id to declare it under \u2014 declare its id first`);
+  if (!EXTERNAL_ALIAS_RE.test(alias)) return refuse("alias-invalid", `"${alias}" is not an alias ([a-z0-9-_]+) \u2014 declare ${label2(producer)} under an alias a person chooses`);
+  const existing = consumer.externals.find((e) => e.alias === alias);
+  if (existing && existing.project === alias) return { alias, planned: true };
+  const mounted = consumer.members.some((m) => familyNode(ctx.family, m)?.mountAlias === alias);
+  const entry = entryOf(ctx, consumer);
+  const planned = entry.externals.find((e) => e.alias === alias);
+  if (existing || mounted || planned && planned.producer !== producer) {
+    return refuse("alias-taken", `${label2(consumer.namespace)} already uses the alias "${alias}" for something else \u2014 declare ${label2(producer)} under another`);
+  }
+  if (!planned) entry.externals.push({ alias, project: alias, producer, reason });
+  return { alias, planned: true };
+}
+function convertLegacyPins(ctx) {
+  for (const node of ctx.family.nodes) {
+    if (node.parent === void 0) continue;
+    const vendored = runWithProjectRoot(node.directory, () => listExternalInterfaces2());
+    for (const surface of vendored) {
+      if (surface.sourceKind === "sibling") addSorted(entryOf(ctx, node).supersededPins, surface.projectName);
+      else if (surface.sourceKind === "parent") convertParentPin(ctx, node, node.parent);
+    }
+  }
+}
+function convertParentPin(ctx, member, parent) {
+  if (declares(ctx.family, member.namespace, parent)) return;
+  if (entryOf(ctx, member).externals.some((e) => e.producer === parent)) return;
+  const alias = planExternal(ctx, member, parent, "legacy-pin");
+  if (alias !== void 0) addPin(ctx, member, alias.alias);
+}
+function settle2(ctx, top, whole) {
+  const projects = [];
+  for (const node of ctx.family.nodes) {
+    const entry = ctx.projects.get(node.namespace);
+    if (!entry || !hasWrites(entry)) continue;
+    entry.exports.sort((a, b) => compare(a.from, b.from) || compare(a.component ?? a.typeDef ?? "", b.component ?? b.typeDef ?? ""));
+    entry.externals.sort((a, b) => compare(a.alias, b.alias));
+    entry.pins.sort();
+    projects.push(entry);
+  }
+  for (const [namespace, finding] of ctx.absent) finding.blocking = projects.some((p) => p.project === namespace);
+  return { familyRoot: top, whole, projects, findings: ctx.findings };
+}
+var compare = (a, b) => a < b ? -1 : a > b ? 1 : 0;
+var WriteLog = class {
+  constructor() {
+    this.written = [];
+    this.relock = [];
+  }
+  file(file) {
+    if (!this.written.includes(file)) this.written.push(file);
+  }
+  stale(directory) {
+    if (!this.relock.includes(directory)) this.relock.push(directory);
+  }
+};
+function apply(plan2) {
+  if (isEmpty(plan2)) return { plan: plan2, applied: false, written: [], relock: [] };
+  if (blocked(plan2)) {
+    throw new ChainingMigrationRefusedError(plan2.findings.filter((f) => f.blocking).map((f) => `${f.kind} (${label2(f.project)}): ${f.detail}`));
+  }
+  const projects = plan2.projects.filter(hasWrites);
+  for (const p of projects) runWithProjectRoot(p.directory, () => preflight(p));
+  const log = new WriteLog();
+  for (const p of projects.filter((q2) => q2.idToWrite !== void 0)) runWithProjectRoot(p.directory, () => declareId(p, log));
+  for (const p of projects.filter((q2) => q2.exports.length > 0)) runWithProjectRoot(p.directory, () => addEntries(p, log));
+  for (const p of projects.filter((q2) => q2.externals.length > 0)) runWithProjectRoot(p.directory, () => declareExternals(p, log));
+  for (const p of projects.filter((q2) => q2.pins.length > 0)) runWithProjectRoot(p.directory, () => pin(p, log));
+  return { plan: plan2, applied: true, written: log.written, relock: log.relock };
+}
+function preflight(p) {
+  if (!projectConfigExists()) {
+    throw new ChainingMigrationRefusedError([`project-absent (${label2(p.project)}): ${p.directory} has no project.yaml any more`]);
+  }
+  if (p.exports.length > 0) updateSpecGated("system", "system", exportDelta(p), true);
+}
+function exportDelta(p) {
+  return {
+    publicInterfaces: p.exports.map((e) => ({
+      from: e.from,
+      ...e.typeDef !== void 0 ? { typeDef: e.typeDef } : { component: e.component },
+      audience: e.audience
+    }))
+  };
+}
+function declareId(p, log) {
+  if (setProjectId(p.idToWrite)) log.file(AI_PATHS.projectConfig());
+}
+function addEntries(p, log) {
+  const change = updateSpecGated("system", "system", exportDelta(p));
+  if (!change.written) return;
+  log.file(AI_PATHS.specsSystem());
+  log.stale(p.directory);
+}
+function declareExternals(p, log) {
+  for (const external of p.externals) {
+    if (!declareExternal(external.alias, {})) continue;
+    log.file(AI_PATHS.projectConfig());
+    log.stale(p.directory);
+  }
+}
+function pin(p, log) {
+  for (const pinned of pinExternals2(p.pins)) {
+    if (pinned.outcome !== "pinned") continue;
+    if (pinned.snapshot) log.file(path42.resolve(p.directory, pinned.snapshot));
+    log.file(path42.join(p.directory, ".wai", "externals.lock.yaml"));
+    log.stale(p.directory);
+  }
+}
+
+// src/commands/doctor.ts
 function enabledTargets() {
   const config = loadProjectConfig();
   return config ? activeTargetTypes(config) : [];
@@ -36848,11 +37479,15 @@ function mcpEntryHealth(settingsPath) {
 }
 async function runDoctor(options = {}) {
   const tally = { warn: 0, error: 0 };
+  if (options.report !== void 0) {
+    reportOnly(options);
+    return;
+  }
   logger.blank();
   console.log(`${import_chalk12.default.bold("wairon doctor")} ${import_chalk12.default.gray(`\u2014 installed v${WAIRON_VERSION}`)}`);
   logger.blank();
   if (options.fix) {
-    await applyFixes();
+    await applyFixes(options, tally);
   }
   console.log(import_chalk12.default.bold("Project"));
   if (!projectConfigExists()) {
@@ -36891,7 +37526,7 @@ async function runDoctor(options = {}) {
   try {
     const missing = findChainingSubprojectsMissingConfig(getProjectRoot());
     if (missing.length > 0) {
-      line(tally, "warn", `${missing.length} chained subproject(s) have specs but no project.yaml (un-runnable standalone): ${missing.map((d) => path42.relative(getProjectRoot(), d) || ".").join(", ")}. Run \`wairon doctor --fix\` to initialize them.`);
+      line(tally, "warn", `${missing.length} chained subproject(s) have specs but no project.yaml (un-runnable standalone): ${missing.map((d) => path43.relative(getProjectRoot(), d) || ".").join(", ")}. Run \`wairon doctor --fix\` to initialize them.`);
     }
   } catch {
   }
@@ -36915,15 +37550,15 @@ async function runDoctor(options = {}) {
     }
     logger.blank();
     try {
-      const plan = retireSpecialists(false);
-      if (plan.retyped.length > 0) {
+      const plan2 = retireSpecialists(false);
+      if (plan2.retyped.length > 0) {
         console.log(import_chalk12.default.bold("Stereotypes"));
-        for (const retype of plan.retyped) {
+        for (const retype of plan2.retyped) {
           const cls = retype.dependencyClass ?? "workflow";
           line(tally, "warn", `${retype.component}: Specialist \u2192 Orchestrator (${cls}) \u2014 ${retype.reason}`);
         }
-        if (plan.rebasedVariants.length > 0) {
-          line(tally, "warn", `${plan.rebasedVariants.length} project variant(s) to rebase from Specialist to Orchestrator: ${plan.rebasedVariants.join(", ")}`);
+        if (plan2.rebasedVariants.length > 0) {
+          line(tally, "warn", `${plan2.rebasedVariants.length} project variant(s) to rebase from Specialist to Orchestrator: ${plan2.rebasedVariants.join(", ")}`);
         }
         line(tally, "warn", "Run `wairon doctor --fix` to retire the Specialist stereotype.");
         logger.blank();
@@ -36948,23 +37583,33 @@ async function runDoctor(options = {}) {
     } catch (e) {
       line(tally, "warn", `Could not plan the narrative-step repair: ${e instanceof Error ? e.message : String(e)}`);
     }
+    try {
+      const pending = plan();
+      if (!isEmpty(pending) || pending.findings.length > 0) {
+        console.log(import_chalk12.default.bold("Chaining"));
+        line(tally, "warn", `Chaining: ${pendingCount(pending)} pending (${chainingTotals(pending)}) \u2014 see \`wairon doctor --report chaining\`, apply with \`wairon doctor --fix\``);
+        logger.blank();
+      }
+    } catch (e) {
+      line(tally, "warn", `Could not plan the chaining migration: ${e instanceof Error ? e.message : String(e)}`);
+    }
   }
   console.log(import_chalk12.default.bold(`Generated files ${import_chalk12.default.gray("(stale = older than installed)")}`));
   for (const p of derivedDocPaths()) {
-    const label2 = path42.relative(getProjectRoot(), p).replace(/\\/g, "/");
+    const label3 = path43.relative(getProjectRoot(), p).replace(/\\/g, "/");
     if (!pathExists(p)) {
-      line(tally, "warn", `${label2} \u2014 not generated yet (run \`wairon generate\`)`);
+      line(tally, "warn", `${label3} \u2014 not generated yet (run \`wairon generate\`)`);
       continue;
     }
     const { mark, note } = stampVerdict(readFileOrNull(p));
-    line(tally, mark, `${label2} (${note})`);
+    line(tally, mark, `${label3} (${note})`);
   }
   const seenGuides = /* @__PURE__ */ new Set();
   for (const t of targets) {
     const gp = localGuideFilePath(process.cwd(), t);
     if (!gp || seenGuides.has(gp)) continue;
     seenGuides.add(gp);
-    const rel2 = path42.relative(process.cwd(), gp).replace(/\\/g, "/");
+    const rel2 = path43.relative(process.cwd(), gp).replace(/\\/g, "/");
     if (!pathExists(gp)) {
       line(tally, "warn", `${rel2} guide \u2014 not injected (run \`wairon generate\`)`);
       continue;
@@ -37013,7 +37658,7 @@ async function runDoctor(options = {}) {
     }
   }
   try {
-    const legacy = path42.join(os9.homedir(), ".wairon", "baselines");
+    const legacy = path43.join(os9.homedir(), ".wairon", "baselines");
     const leftovers = fs28.existsSync(legacy) ? fs28.readdirSync(legacy).filter((f) => f.endsWith(".json")) : [];
     if (leftovers.length) {
       console.log(import_chalk12.default.bold("Approvals"));
@@ -37063,7 +37708,7 @@ async function runDoctor(options = {}) {
     line(tally, h.mark, `Claude (project .mcp.json): ${h.note}${h.mark === "ok" ? "" : " \u2014 run `wairon mcp install --backend claude`"}`);
   }
   if (wantGemini) {
-    const globalCfg = path42.join(os9.homedir(), ".gemini", "antigravity-cli", "mcp_config.json");
+    const globalCfg = path43.join(os9.homedir(), ".gemini", "antigravity-cli", "mcp_config.json");
     const hg = mcpEntryHealth(globalCfg);
     line(tally, hg.mark, `Antigravity (global mcp_config.json): ${hg.note}${hg.mark === "ok" ? "" : " \u2014 run `wairon mcp install --backend gemini --global`"}`);
     const projPath = fromProjectRoot(".gemini", "settings.json");
@@ -37072,7 +37717,7 @@ async function runDoctor(options = {}) {
       line(tally, hp.mark === "error" ? "error" : "ok", `Gemini CLI (project): ${hp.note} ${import_chalk12.default.gray("(Antigravity ignores this file)")}`);
     }
   }
-  const pluginDir = path42.join(os9.homedir(), ".gemini", "config", "plugins", "wairon");
+  const pluginDir = path43.join(os9.homedir(), ".gemini", "config", "plugins", "wairon");
   if (fs28.existsSync(pluginDir)) {
     line(tally, "warn", `Legacy Antigravity plugin present (${pluginDir}) \u2014 it collides with the wairon MCP server. Remove it with \`wairon doctor --fix\`.`);
   }
@@ -37080,7 +37725,7 @@ async function runDoctor(options = {}) {
   printSummary(tally);
   if (tally.error > 0) process.exit(1);
 }
-async function applyFixes() {
+async function applyFixes(options, tally) {
   if (!projectConfigExists()) return;
   let targets;
   try {
@@ -37149,6 +37794,7 @@ async function applyFixes() {
   } catch (e) {
     console.log(`  ${icon("error")} Narrative-step repair failed: ${e instanceof Error ? e.message : String(e)}`);
   }
+  await migrateChaining(options, tally);
   const { runMcpInstall: runMcpInstall2 } = (init_mcp(), __toCommonJS(mcp_exports));
   if (targets.includes("claude")) {
     try {
@@ -37172,6 +37818,106 @@ async function applyFixes() {
   }
   logger.blank();
 }
+function reportOnly(options) {
+  if (options.fix) {
+    throw new DoctorOptionsError("--report prints a plan and writes nothing, so it never combines with --fix.");
+  }
+  if (options.report !== "chaining") {
+    throw new DoctorOptionsError(`--report knows one section, \`chaining\`; "${options.report}" is not one.`);
+  }
+  const migration = plan();
+  logger.blank();
+  console.log(`${import_chalk12.default.bold("wairon doctor --report chaining")} ${import_chalk12.default.gray(`\u2014 installed v${WAIRON_VERSION}`)}`);
+  logger.blank();
+  printChainingPlan(migration);
+  console.log(import_chalk12.default.gray("Nothing was written."));
+  logger.blank();
+}
+async function migrateChaining(options, tally) {
+  let migration;
+  try {
+    migration = plan();
+  } catch (e) {
+    console.log(`  ${icon("error")} Could not plan the chaining migration: ${e instanceof Error ? e.message : String(e)}`);
+    tally.error++;
+    return;
+  }
+  if (isEmpty(migration)) return;
+  printChainingPlan(migration);
+  if (!await confirmChaining(options)) return;
+  try {
+    const applied = apply(migration);
+    printApplied(applied.written, applied.relock);
+  } catch (e) {
+    if (!(e instanceof ChainingMigrationRefusedError)) throw e;
+    console.log(`  ${icon("error")} ${e.message}`);
+    tally.error++;
+  }
+}
+async function confirmChaining(options) {
+  if (options.yes) return true;
+  if (!process.stdin.isTTY || !process.stdout.isTTY) {
+    console.log(`  ${icon("warn")} Chaining migration skipped: no terminal to confirm it \u2014 re-run with \`--fix --yes\` to apply it. Nothing of it was written.`);
+    return false;
+  }
+  const { confirmed } = await import_inquirer4.default.prompt([
+    { type: "confirm", name: "confirmed", message: "Apply the chaining migration above?", default: false }
+  ]);
+  if (!confirmed) console.log(`  ${icon("warn")} Chaining migration skipped. Nothing of it was written.`);
+  return confirmed;
+}
+function printApplied(written, relock) {
+  console.log(`  ${icon("ok")} Applied the chaining migration: ${written.length} file(s) written.`);
+  for (const file of written) console.log(`      ${file}`);
+  if (relock.length === 0) return;
+  console.log(`  ${icon("warn")} The writes staled the approval of ${relock.length} project(s); nothing was locked here. Re-lock each with \`wairon lock\`:`);
+  for (const dir of relock) console.log(`      ${dir}`);
+}
+function pendingCount(migration) {
+  return migration.projects.reduce((n, p) => n + (p.idToWrite ? 1 : 0) + p.exports.length + p.externals.length + p.pins.length, 0);
+}
+function chainingTotals(migration) {
+  const sum = (f) => migration.projects.reduce((n, p) => n + f(p), 0);
+  const entries = sum((p) => p.exports.length);
+  return [
+    `${sum((p) => p.idToWrite ? 1 : 0)} id(s)`,
+    `${entries} L0 entr${entries === 1 ? "y" : "ies"}`,
+    `${sum((p) => p.externals.length)} external(s)`,
+    `${sum((p) => p.pins.length)} pin(s)`,
+    `${sum((p) => p.supersededPins.length)} superseded pin(s)`,
+    `${migration.findings.length} finding(s)`
+  ].join(", ");
+}
+function printChainingPlan(migration) {
+  console.log(import_chalk12.default.bold("Chaining migration"));
+  console.log(import_chalk12.default.gray(`  family root: ${migration.familyRoot}${migration.whole ? "" : " (partial: a hop above was out of reach)"}`));
+  if (isEmpty(migration)) console.log("  Nothing to migrate.");
+  for (const p of migration.projects) printProjectMigration(p);
+  for (const f of migration.findings) {
+    const where = f.project === "" ? "top root" : f.project;
+    console.log(`  ${icon(f.blocking ? "error" : "warn")} ${f.kind} [${where}]${f.blocking ? " (blocks apply)" : ""}: ${f.detail}`);
+  }
+  console.log(`  Totals: ${chainingTotals(migration)}.`);
+  logger.blank();
+}
+function printProjectMigration(p) {
+  console.log(`  ${import_chalk12.default.bold(p.project === "" ? "(top root)" : p.project)} ${import_chalk12.default.gray(p.directory)}`);
+  if (p.idToWrite) console.log(`    id: declare "${p.idToWrite}"`);
+  for (const e of p.exports) {
+    const item = e.component !== void 0 ? `component: ${e.component}` : `typeDef: ${e.typeDef}`;
+    const members = e.members.length > 0 ? `, reaching ${e.members.join(", ")}` : "";
+    const consumers = e.consumers.map((c) => c || "(top root)").join(", ");
+    console.log(`    L0 entry: { from: ${e.from}, ${item}, audience: ${e.audience} } as "${e.publicName}" \u2014 for ${consumers}${members}`);
+  }
+  for (const x of p.externals) {
+    const why = x.reason === "legacy-pin" ? "replaces the stage-1 family pin of" : "its references cross into";
+    console.log(`    external: ${x.alias}: {} \u2014 ${why} ${x.producer || "(top root)"}`);
+  }
+  if (p.pins.length > 0) console.log(`    pin: ${p.pins.join(", ")}`);
+  for (const key of p.supersededPins) {
+    console.log(`    superseded sibling pin: ${key} \u2014 left on disk until stage 3 (stage-1 resolution still reads it; nothing deletes it)`);
+  }
+}
 function printSummary(tally) {
   if (tally.error === 0 && tally.warn === 0) {
     logger.success("All checks passed \u2014 everything is current.");
@@ -37189,13 +37935,13 @@ function printSummary(tally) {
 
 // src/commands/diagram.ts
 var fs29 = __toESM(require("fs"));
-var path44 = __toESM(require("path"));
+var path45 = __toESM(require("path"));
 init_logger();
 init_paths();
 init_fs();
 
 // src/commands/subsystem.ts
-var path43 = __toESM(require("path"));
+var path44 = __toESM(require("path"));
 init_logger();
 init_errors();
 init_fs();
@@ -37230,10 +37976,10 @@ async function runSubsystemAdd(id, options = {}) {
   const stored = loadSubsystemSpec(id);
   const restatement = subsystemAddRestatement(id, options.projectPath, options.name, stored);
   const receipt = writeSpec(restatement);
-  const childDir = path43.resolve(getProjectRoot(), options.projectPath);
+  const childDir = path44.resolve(getProjectRoot(), options.projectPath);
   logger.success(`${receipt.replacedExisting ? "Re-authored" : "Added"} external subsystem "${id}" \u2192 ${options.projectPath}`);
   for (const notice of receipt.notices) logger.info(notice);
-  logger.info(`Scaffolded child project at ${path43.relative(process.cwd(), childDir) || "."}`);
+  logger.info(`Scaffolded child project at ${path44.relative(process.cwd(), childDir) || "."}`);
   logger.info(`Design its spec tree from this parent using namespaced ids (e.g. ${id}::<component>).`);
 }
 async function runSubsystemMove(id, options = {}) {
@@ -37256,9 +38002,9 @@ async function runSubsystemExternalize(id, options = {}) {
     throw new WaironError("--project-path (the subproject destination) is required.");
   }
   externalizeSubsystem(id, options.projectPath);
-  const childDir = path43.resolve(getProjectRoot(), options.projectPath);
+  const childDir = path44.resolve(getProjectRoot(), options.projectPath);
   logger.success(`Externalized subsystem "${id}" \u2192 ${options.projectPath}`);
-  logger.info(`Moved its specs into ${path43.relative(process.cwd(), childDir) || "."} (now a standalone subproject).`);
+  logger.info(`Moved its specs into ${path44.relative(process.cwd(), childDir) || "."} (now a standalone subproject).`);
   logger.info("Move the source code there yourself, then run `wairon validate` to confirm the tree.");
 }
 async function runSubsystemInternalize(id) {
@@ -37289,7 +38035,7 @@ function applyFormat(options) {
   };
 }
 function writeArtifact(dest, content) {
-  ensureDir(path44.dirname(path44.resolve(dest)));
+  ensureDir(path45.dirname(path45.resolve(dest)));
   fs29.writeFileSync(dest, content, "utf-8");
 }
 function parseSequenceRef(ref) {
@@ -37305,21 +38051,21 @@ async function runDiagram(rawOptions = {}) {
   assertProjectInitialized();
   const options = applyFormat(rawOptions);
   if (options.canvas && !options.all) {
-    const dest2 = options.out ?? path44.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
+    const dest2 = options.out ?? path45.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
     writeArtifact(dest2, renderDiagram("canvas"));
     logger.success(`Interactive canvas written to ${dest2}`);
     logger.info("Open it in a browser \u2014 fully self-contained (works offline).");
     return;
   }
   if (options.drawio && !options.all) {
-    const dest2 = options.out ?? path44.join(AI_PATHS.docsDir(), "diagrams", "architecture.drawio");
+    const dest2 = options.out ?? path45.join(AI_PATHS.docsDir(), "diagrams", "architecture.drawio");
     writeArtifact(dest2, renderDiagram("drawio"));
     logger.success(`draw.io diagram written to ${dest2}`);
     logger.info("Open with draw.io / diagrams.net (or import into tools that accept the format).");
     return;
   }
   if (options.excalidraw && !options.all) {
-    const dest2 = options.out ?? path44.join(AI_PATHS.docsDir(), "diagrams", "architecture.excalidraw");
+    const dest2 = options.out ?? path45.join(AI_PATHS.docsDir(), "diagrams", "architecture.excalidraw");
     writeArtifact(dest2, renderDiagram("excalidraw"));
     logger.success(`Excalidraw scene written to ${dest2}`);
     logger.info("Open with excalidraw.com or the VS Code extension.");
@@ -37327,27 +38073,27 @@ async function runDiagram(rawOptions = {}) {
   }
   const wantsMermaid = options.format?.toLowerCase().startsWith("mermaid") || !!options.subsystem || !!options.sequence;
   if (!options.all && !options.sequence && !wantsMermaid) {
-    const dest2 = options.out ?? path44.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
+    const dest2 = options.out ?? path45.join(AI_PATHS.docsDir(), "diagrams", "canvas.html");
     writeArtifact(dest2, renderDiagram("canvas"));
     logger.success(`Interactive canvas written to ${dest2}`);
     logger.info("Open it in a browser \u2014 fully self-contained (works offline). Other formats: --format mermaid|drawio|excalidraw.");
     return;
   }
   if (options.all) {
-    const outDir = options.out ?? path44.join(AI_PATHS.docsDir(), "diagrams");
+    const outDir = options.out ?? path45.join(AI_PATHS.docsDir(), "diagrams");
     const files = generateDiagramSet();
     if (files.length === 0) {
       logger.warn("No diagrams to generate \u2014 the spec tree has no components yet.");
       return;
     }
     for (const file of files) {
-      writeArtifact(path44.join(outDir, file.relPath), toMarkdown(file));
+      writeArtifact(path45.join(outDir, file.relPath), toMarkdown(file));
     }
-    writeArtifact(path44.join(outDir, "canvas.html"), renderDiagram("canvas"));
-    writeArtifact(path44.join(outDir, "architecture.drawio"), renderDiagram("drawio"));
-    writeArtifact(path44.join(outDir, "architecture.excalidraw"), renderDiagram("excalidraw"));
+    writeArtifact(path45.join(outDir, "canvas.html"), renderDiagram("canvas"));
+    writeArtifact(path45.join(outDir, "architecture.drawio"), renderDiagram("drawio"));
+    writeArtifact(path45.join(outDir, "architecture.excalidraw"), renderDiagram("excalidraw"));
     const graph2 = loadSpecGraph();
-    const indexPath = path44.join(outDir, "README.md");
+    const indexPath = path45.join(outDir, "README.md");
     writeArtifact(indexPath, diagramSetIndex(files, graph2.systemName));
     logger.success(`Generated ${files.length} diagram(s) + interactive canvas.html + index into ${outDir}`);
     for (const file of files.slice(0, 12)) {
@@ -37359,20 +38105,20 @@ async function runDiagram(rawOptions = {}) {
   let mermaid;
   let title;
   let defaultDest;
-  const diagramsDir = path44.join(AI_PATHS.docsDir(), "diagrams");
+  const diagramsDir = path45.join(AI_PATHS.docsDir(), "diagrams");
   if (options.sequence) {
     const { component, method: method2 } = parseSequenceRef(options.sequence);
     mermaid = generateSequenceDiagram(component, method2, { depth: options.depth });
     title = `${component}.${method2} \u2014 narrative sequence`;
-    defaultDest = path44.join(diagramsDir, "sequences", `${component.replace(/::/g, "--")}.${method2}.md`);
+    defaultDest = path45.join(diagramsDir, "sequences", `${component.replace(/::/g, "--")}.${method2}.md`);
   } else if (options.subsystem) {
     mermaid = generateComponentDiagram({ subsystem: options.subsystem });
     title = `${options.subsystem} \u2014 components`;
-    defaultDest = path44.join(diagramsDir, "subsystems", `${options.subsystem.replace(/::/g, "--")}.md`);
+    defaultDest = path45.join(diagramsDir, "subsystems", `${options.subsystem.replace(/::/g, "--")}.md`);
   } else {
     mermaid = renderDiagram("mermaid");
     title = "Component architecture";
-    defaultDest = path44.join(diagramsDir, "system.md");
+    defaultDest = path45.join(diagramsDir, "system.md");
   }
   const dest = options.out ?? defaultDest;
   const content = dest.endsWith(".mmd") ? `${mermaid}
@@ -37488,7 +38234,7 @@ Component variants (${variants.length})
 // src/commands/packs.ts
 var fs30 = __toESM(require("fs"));
 var os10 = __toESM(require("os"));
-var path45 = __toESM(require("path"));
+var path46 = __toESM(require("path"));
 var import_chalk16 = __toESM(require("chalk"));
 var import_sdk = __toESM(require_dist());
 init_logger();
@@ -37515,7 +38261,7 @@ function describe2(probe2) {
   return parts.join(", ");
 }
 function resolveSourceUnit(source) {
-  const abs = path45.resolve(source);
+  const abs = path46.resolve(source);
   if (!fs30.existsSync(abs)) {
     throw new Error(`Pack source "${source}" does not exist.`);
   }
@@ -37535,7 +38281,7 @@ async function addPack(source, options = {}) {
   }
   const { abs } = resolveSourceUnit(source);
   const scope = options.global ? "global" : "project";
-  const probe2 = probePack(abs, path45.dirname(abs), scope);
+  const probe2 = probePack(abs, path46.dirname(abs), scope);
   if (probe2.error) {
     logger.error(probe2.error);
     process.exitCode = 1;
@@ -37543,8 +38289,8 @@ async function addPack(source, options = {}) {
   }
   if (options.global) {
     const destDir = globalPacksDir();
-    const dest2 = path45.join(destDir, path45.basename(abs));
-    if (path45.resolve(dest2) !== abs) {
+    const dest2 = path46.join(destDir, path46.basename(abs));
+    if (path46.resolve(dest2) !== abs) {
       fs30.mkdirSync(destDir, { recursive: true });
       fs30.cpSync(abs, dest2, { recursive: true, force: true });
     }
@@ -37559,10 +38305,10 @@ async function addPack(source, options = {}) {
     return;
   }
   const root = getProjectRoot();
-  const relRef = `.wai/packs/${path45.basename(abs)}`;
-  const dest = path45.join(root, ".wai", "packs", path45.basename(abs));
-  if (path45.resolve(dest) !== abs) {
-    fs30.mkdirSync(path45.dirname(dest), { recursive: true });
+  const relRef = `.wai/packs/${path46.basename(abs)}`;
+  const dest = path46.join(root, ".wai", "packs", path46.basename(abs));
+  if (path46.resolve(dest) !== abs) {
+    fs30.mkdirSync(path46.dirname(dest), { recursive: true });
     fs30.cpSync(abs, dest, { recursive: true, force: true });
   }
   if (registerPackRef(relRef)) {
@@ -37574,7 +38320,7 @@ async function addPack(source, options = {}) {
   logger.info(`${describe2(probe2)} \u2014 commit .wai/ so CI and every clone enforce it.`);
 }
 async function addPackFromArchive(source, options) {
-  const abs = path45.resolve(source);
+  const abs = path46.resolve(source);
   if (!fs30.existsSync(abs) || !fs30.statSync(abs).isFile()) {
     logger.error(`Pack archive "${source}" does not exist.`);
     process.exitCode = 1;
@@ -37590,25 +38336,25 @@ async function addPackFromArchive(source, options) {
       process.exitCode = 1;
       return;
     }
-    baseDir = path45.join(getProjectRoot(), ".wai", "packs");
+    baseDir = path46.join(getProjectRoot(), ".wai", "packs");
   }
   const bytes = fs30.readFileSync(abs);
   fs30.mkdirSync(baseDir, { recursive: true });
-  const staging = fs30.mkdtempSync(path45.join(baseDir, ".wpack-staging-"));
+  const staging = fs30.mkdtempSync(path46.join(baseDir, ".wpack-staging-"));
   let result;
   try {
     result = (0, import_sdk.extractPack)(bytes, staging);
   } catch (err) {
     fs30.rmSync(staging, { recursive: true, force: true });
-    logger.error(`Failed to extract pack archive "${path45.basename(abs)}": ${err instanceof Error ? err.message : String(err)}`);
+    logger.error(`Failed to extract pack archive "${path46.basename(abs)}": ${err instanceof Error ? err.message : String(err)}`);
     process.exitCode = 1;
     return;
   }
   const name = result.name;
-  const destDir = path45.join(baseDir, name);
+  const destDir = path46.join(baseDir, name);
   if (fs30.existsSync(destDir)) fs30.rmSync(destDir, { recursive: true, force: true });
   fs30.renameSync(staging, destDir);
-  const probe2 = probePack(destDir, path45.dirname(destDir), scope);
+  const probe2 = probePack(destDir, path46.dirname(destDir), scope);
   if (probe2.error) {
     fs30.rmSync(destDir, { recursive: true, force: true });
     logger.error(probe2.error);
@@ -37624,7 +38370,7 @@ async function addPackFromArchive(source, options) {
   if (registerPackRef(relRef)) {
     logger.success(`Installed pack "${probe2.name ?? name}" into ${relRef} and registered it in .wai/project.yaml.`);
   } else {
-    logger.success(`Pack "${probe2.name ?? name}" already registered \u2014 refreshed ${relRef} from ${path45.basename(abs)}.`);
+    logger.success(`Pack "${probe2.name ?? name}" already registered \u2014 refreshed ${relRef} from ${path46.basename(abs)}.`);
   }
   logger.info(`${describe2(probe2)} \u2014 commit .wai/ so CI and every clone enforce it.`);
 }
@@ -37656,8 +38402,8 @@ function expandSource(source, version) {
   return source.replace(/\{version\}/g, version ?? "").replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g, (_, name) => process.env[name] ?? "");
 }
 async function fetchArchive(url) {
-  const dir = fs30.mkdtempSync(path45.join(os10.tmpdir(), "wairon-packdl-"));
-  const dest = path45.join(dir, "pack.wpack");
+  const dir = fs30.mkdtempSync(path46.join(os10.tmpdir(), "wairon-packdl-"));
+  const dest = path46.join(dir, "pack.wpack");
   await downloadFile(url, dest);
   return dest;
 }
@@ -37676,7 +38422,7 @@ async function installPack(source) {
     }
     const extracted = extractArchiveToTemp(archive);
     try {
-      fs30.rmSync(path45.dirname(archive), { recursive: true, force: true });
+      fs30.rmSync(path46.dirname(archive), { recursive: true, force: true });
     } catch {
     }
     if (!extracted) return;
@@ -37699,7 +38445,7 @@ async function installPack(source) {
     if (!extracted) return;
     sourceDir = extracted.dir;
     cleanup = extracted.dir;
-    origin = path45.resolve(source);
+    origin = path46.resolve(source);
   } else {
     let unit;
     try {
@@ -37742,13 +38488,13 @@ function reportInstalled(installed, origin) {
   }
 }
 function extractArchiveToTemp(source) {
-  const abs = path45.resolve(source);
+  const abs = path46.resolve(source);
   if (!fs30.existsSync(abs)) {
     logger.error(`Pack archive "${source}" does not exist.`);
     process.exitCode = 1;
     return null;
   }
-  const tempDir = fs30.mkdtempSync(path45.join(os10.tmpdir(), "wairon-packinstall-"));
+  const tempDir = fs30.mkdtempSync(path46.join(os10.tmpdir(), "wairon-packinstall-"));
   try {
     const result = (0, import_sdk.extractPack)(new Uint8Array(fs30.readFileSync(abs)), tempDir);
     void result;
@@ -37857,10 +38603,10 @@ async function syncPacks() {
   }
   let installed = 0;
   for (const selection of missing) {
-    const label2 = packEntryLabel(selection);
+    const label3 = packEntryLabel(selection);
     const blocker = syncBlocker(selection);
     if (blocker) {
-      logger.error(`"${label2}" ${blocker}`);
+      logger.error(`"${label3}" ${blocker}`);
       process.exitCode = 1;
       continue;
     }
@@ -37871,7 +38617,7 @@ async function syncPacks() {
       console.log(`  ${import_chalk16.default.green("+")} ${pack.name} v${pack.version} ${import_chalk16.default.dim(`\u2190 ${url}`)}`);
       installed++;
     } catch (e) {
-      logger.error(`Could not sync "${label2}" from ${url}: ${e instanceof Error ? e.message : String(e)}`);
+      logger.error(`Could not sync "${label3}" from ${url}: ${e instanceof Error ? e.message : String(e)}`);
       process.exitCode = 1;
     }
   }
@@ -37892,7 +38638,7 @@ async function fetchAndInstall(selection, url) {
   const archive = await fetchArchive(url);
   const extracted = extractArchiveToTemp(archive);
   try {
-    fs30.rmSync(path45.dirname(archive), { recursive: true, force: true });
+    fs30.rmSync(path46.dirname(archive), { recursive: true, force: true });
   } catch {
   }
   if (!extracted) return null;
@@ -37915,9 +38661,9 @@ function bundleTargets(selections, name, all) {
   return selections.filter((s) => s.bundle === true);
 }
 function writeBundle(root, resolved) {
-  const dest = path45.join(root, ".wai", "packs", resolved.name, resolved.version);
+  const dest = path46.join(root, ".wai", "packs", resolved.name, resolved.version);
   fs30.rmSync(dest, { recursive: true, force: true });
-  fs30.mkdirSync(path45.dirname(dest), { recursive: true });
+  fs30.mkdirSync(path46.dirname(dest), { recursive: true });
   fs30.cpSync(resolved.path, dest, { recursive: true });
   return dest;
 }
@@ -37949,7 +38695,7 @@ async function bundlePack(name, options = {}) {
     const dest = writeBundle(root, resolved);
     bundledSelections.push({ name: selection.name, version: resolved.version });
     bundled.push(`${resolved.name}@${resolved.version}`);
-    console.log(`  ${import_chalk16.default.green("+")} ${import_chalk16.default.dim(path45.relative(root, dest).replace(/\\/g, "/"))}`);
+    console.log(`  ${import_chalk16.default.green("+")} ${import_chalk16.default.dim(path46.relative(root, dest).replace(/\\/g, "/"))}`);
   }
   if (bundled.length === 0) return;
   markSelectionsBundled(bundledSelections);
@@ -37986,9 +38732,9 @@ async function listPacks() {
   console.log(import_chalk16.default.bold.cyan(`\u25A0 Global (${globalPacksDir()})${useGlobal ? "" : import_chalk16.default.yellow("  [disabled: extensions.useGlobalPacks: false]")}`));
   if (globalRefs.length === 0) console.log(import_chalk16.default.dim("  (none)"));
   for (const ref of globalRefs) {
-    const probe2 = probePack(ref, path45.dirname(ref), "global");
-    if (probe2.error) console.log(`  ${import_chalk16.default.red("\u2716")} ${path45.basename(ref)} \u2014 ${import_chalk16.default.red(probe2.error)}`);
-    else console.log(`  ${import_chalk16.default.green("\u25CF")} ${import_chalk16.default.bold(probe2.name ?? path45.basename(ref))}  ${import_chalk16.default.dim(describe2(probe2))}`);
+    const probe2 = probePack(ref, path46.dirname(ref), "global");
+    if (probe2.error) console.log(`  ${import_chalk16.default.red("\u2716")} ${path46.basename(ref)} \u2014 ${import_chalk16.default.red(probe2.error)}`);
+    else console.log(`  ${import_chalk16.default.green("\u25CF")} ${import_chalk16.default.bold(probe2.name ?? path46.basename(ref))}  ${import_chalk16.default.dim(describe2(probe2))}`);
   }
   console.log("");
   if (!inProject) {
@@ -37999,16 +38745,16 @@ async function listPacks() {
   const projectEntries = config?.extensions?.packs ?? [];
   if (projectEntries.length === 0) console.log(import_chalk16.default.dim("  (none)"));
   for (const entry of projectEntries) {
-    const label2 = packEntryLabel(entry);
+    const label3 = packEntryLabel(entry);
     const ref = packEntryRef(entry, root);
     if (!ref) {
-      console.log(`  ${import_chalk16.default.red("\u2716")} ${label2} \u2014 ${import_chalk16.default.red("declared but not installed or bundled")}`);
+      console.log(`  ${import_chalk16.default.red("\u2716")} ${label3} \u2014 ${import_chalk16.default.red("declared but not installed or bundled")}`);
       continue;
     }
     const probe2 = probePack(ref, root, "project");
     const origin = typeof entry === "string" ? ref : `selected \u2192 ${ref}`;
-    if (probe2.error) console.log(`  ${import_chalk16.default.red("\u2716")} ${label2} \u2014 ${import_chalk16.default.red(probe2.error)}`);
-    else console.log(`  ${import_chalk16.default.green("\u25CF")} ${import_chalk16.default.bold(probe2.name ?? label2)}  ${import_chalk16.default.dim(origin)}  ${import_chalk16.default.dim(describe2(probe2))}`);
+    if (probe2.error) console.log(`  ${import_chalk16.default.red("\u2716")} ${label3} \u2014 ${import_chalk16.default.red(probe2.error)}`);
+    else console.log(`  ${import_chalk16.default.green("\u25CF")} ${import_chalk16.default.bold(probe2.name ?? label3)}  ${import_chalk16.default.dim(origin)}  ${import_chalk16.default.dim(describe2(probe2))}`);
   }
   console.log("");
   logger.info("Rules from packs show up in `wairon rules list`; add packs with `wairon pack add <source> [--global]`.");
@@ -38016,8 +38762,8 @@ async function listPacks() {
 async function removePack(name, options = {}) {
   if (options.global) {
     for (const ref of discoverPacks(globalPacksDir())) {
-      const probe2 = probePack(ref, path45.dirname(ref), "global");
-      if (probe2.name === name || path45.basename(ref) === name) {
+      const probe2 = probePack(ref, path46.dirname(ref), "global");
+      if (probe2.name === name || path46.basename(ref) === name) {
         fs30.rmSync(ref, { recursive: true, force: true });
         logger.success(`Removed global pack "${probe2.name ?? name}" (${ref}).`);
         return;
@@ -38039,11 +38785,11 @@ async function removePack(name, options = {}) {
     if (typeof entry !== "string") continue;
     const ref = entry;
     const probe2 = probePack(ref, root, "project");
-    if (probe2.name === name || ref === name || path45.basename(ref) === name) {
+    if (probe2.name === name || ref === name || path46.basename(ref) === name) {
       deregisterPackRef(ref);
-      const resolved = path45.resolve(root, ref);
-      const vendorDir = path45.resolve(root, ".wai", "packs");
-      if (resolved.startsWith(vendorDir + path45.sep)) {
+      const resolved = path46.resolve(root, ref);
+      const vendorDir = path46.resolve(root, ".wai", "packs");
+      if (resolved.startsWith(vendorDir + path46.sep)) {
         fs30.rmSync(resolved, { recursive: true, force: true });
         logger.success(`Deregistered pack "${probe2.name ?? name}" and deleted ${ref}.`);
       } else {
@@ -38058,7 +38804,7 @@ async function removePack(name, options = {}) {
 
 // src/commands/host.ts
 var fs57 = __toESM(require("fs"));
-var path72 = __toESM(require("path"));
+var path73 = __toESM(require("path"));
 var os11 = __toESM(require("os"));
 var crypto24 = __toESM(require("crypto"));
 var import_child_process7 = require("child_process");
@@ -38087,14 +38833,14 @@ var WEB_SESSION_PREFIX = "ws_";
 
 // src/server/credentials.ts
 var fs31 = __toESM(require("fs"));
-var path46 = __toESM(require("path"));
+var path47 = __toESM(require("path"));
 var crypto7 = __toESM(require("crypto"));
 var HASH_NS = "wairon:token:v1";
 function hashToken(token) {
   return crypto7.createHash("sha256").update(`${HASH_NS}:${token}`).digest("hex");
 }
 function storePath(dataDir) {
-  return path46.join(dataDir, "auth", "credentials.json");
+  return path47.join(dataDir, "auth", "credentials.json");
 }
 function load3(dataDir) {
   try {
@@ -38105,7 +38851,7 @@ function load3(dataDir) {
 }
 function save(dataDir, records) {
   const p = storePath(dataDir);
-  fs31.mkdirSync(path46.dirname(p), { recursive: true });
+  fs31.mkdirSync(path47.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs31.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
   fs31.renameSync(tmp, p);
@@ -38154,10 +38900,10 @@ function listByOwner(dataDir, ownerUserId) {
 
 // src/server/websessions.ts
 var fs32 = __toESM(require("fs"));
-var path47 = __toESM(require("path"));
+var path48 = __toESM(require("path"));
 var crypto8 = __toESM(require("crypto"));
 function storePath2(dataDir) {
-  return path47.join(dataDir, "web-sessions.json");
+  return path48.join(dataDir, "web-sessions.json");
 }
 function readSessions(dataDir) {
   const p = storePath2(dataDir);
@@ -38178,7 +38924,7 @@ function readSessions(dataDir) {
 }
 function persistSessions(dataDir, sessions) {
   const p = storePath2(dataDir);
-  fs32.mkdirSync(path47.dirname(p), { recursive: true });
+  fs32.mkdirSync(path48.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs32.writeFileSync(tmp, JSON.stringify(sessions, null, 2) + "\n");
   fs32.renameSync(tmp, p);
@@ -38343,10 +39089,10 @@ function listWebSessionsBySubject(dataDir, userId) {
 
 // src/server/users.ts
 var fs33 = __toESM(require("fs"));
-var path48 = __toESM(require("path"));
+var path49 = __toESM(require("path"));
 var VALID_STATUSES = ["active", "inactive", "suspended", "deactivated", "disabled"];
 function storePath3(dataDir) {
-  return path48.join(dataDir, "users.json");
+  return path49.join(dataDir, "users.json");
 }
 function loadStore(dataDir) {
   const p = storePath3(dataDir);
@@ -38370,7 +39116,7 @@ function loadStore(dataDir) {
 }
 function replaceAll(dataDir, records) {
   const p = storePath3(dataDir);
-  fs33.mkdirSync(path48.dirname(p), { recursive: true });
+  fs33.mkdirSync(path49.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs33.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
   fs33.renameSync(tmp, p);
@@ -38476,10 +39222,10 @@ function remapUnitReferences(dataDir, remap, removedScopeIds) {
 
 // src/server/instance.ts
 var fs34 = __toESM(require("fs"));
-var path49 = __toESM(require("path"));
+var path50 = __toESM(require("path"));
 var import_crypto2 = require("crypto");
 function storePath4(dataDir) {
-  return path49.join(dataDir, "instance.json");
+  return path50.join(dataDir, "instance.json");
 }
 var InstanceIdentityStore = class {
   constructor(dataDir) {
@@ -38519,7 +39265,7 @@ var InstanceIdentityStore = class {
    *  never truncates the file. Only called by the registry's create-once seed. */
   replace(identity) {
     const p = storePath4(this.dataDir);
-    fs34.mkdirSync(path49.dirname(p), { recursive: true });
+    fs34.mkdirSync(path50.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
     fs34.writeFileSync(tmp, JSON.stringify(identity, null, 2) + "\n");
     fs34.renameSync(tmp, p);
@@ -38579,7 +39325,7 @@ function getInstanceIdentity(dataDir) {
 
 // src/utils/secrets.ts
 var fs35 = __toESM(require("fs"));
-var path50 = __toESM(require("path"));
+var path51 = __toESM(require("path"));
 var ENV_FALLBACK = {
   "git-token": ["WAIRON_GIT_TOKEN"],
   "notion-token": ["WAIRON_NOTION_TOKEN"],
@@ -38588,7 +39334,7 @@ var ENV_FALLBACK = {
 };
 function storePath5() {
   const dataDir = process.env["WAIRON_DATA_DIR"];
-  return dataDir ? path50.join(dataDir, "auth", "secrets.json") : null;
+  return dataDir ? path51.join(dataDir, "auth", "secrets.json") : null;
 }
 function readStore() {
   const p = storePath5();
@@ -38619,7 +39365,7 @@ function setSecret(key, value) {
   if (!p) throw new Error("WAIRON_DATA_DIR is not set \u2014 a running server needs it to store secrets.");
   const store = readStore();
   store[key] = value;
-  fs35.mkdirSync(path50.dirname(p), { recursive: true });
+  fs35.mkdirSync(path51.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs35.writeFileSync(tmp, JSON.stringify(store, null, 2) + "\n");
   fs35.renameSync(tmp, p);
@@ -38831,10 +39577,10 @@ function verifySsoState(state) {
 
 // src/server/organization.ts
 var fs36 = __toESM(require("fs"));
-var path51 = __toESM(require("path"));
+var path52 = __toESM(require("path"));
 var crypto10 = __toESM(require("crypto"));
 function storePath6(dataDir) {
-  return path51.join(dataDir, "organization.json");
+  return path52.join(dataDir, "organization.json");
 }
 function readState(dataDir) {
   const p = storePath6(dataDir);
@@ -38857,7 +39603,7 @@ function readState(dataDir) {
 }
 function persistState(dataDir, state) {
   const p = storePath6(dataDir);
-  fs36.mkdirSync(path51.dirname(p), { recursive: true });
+  fs36.mkdirSync(path52.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs36.writeFileSync(tmp, JSON.stringify(state, null, 2) + "\n");
   fs36.renameSync(tmp, p);
@@ -39237,10 +39983,10 @@ function getOrganizationUnit(dataDir, id) {
 
 // src/server/permissions.ts
 var fs37 = __toESM(require("fs"));
-var path52 = __toESM(require("path"));
+var path53 = __toESM(require("path"));
 var import_crypto3 = require("crypto");
 function storePath7(dataDir) {
-  return path52.join(dataDir, "permissions.json");
+  return path53.join(dataDir, "permissions.json");
 }
 function assignmentKey(a) {
   return [a.subjectKind, a.subjectId ?? "", a.scopeKind, a.scopeId ?? "", a.capability].join("|");
@@ -39267,7 +40013,7 @@ function load4(dataDir) {
 }
 function replaceAll2(dataDir, assignments) {
   const p = storePath7(dataDir);
-  fs37.mkdirSync(path52.dirname(p), { recursive: true });
+  fs37.mkdirSync(path53.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs37.writeFileSync(tmp, JSON.stringify(assignments, null, 2) + "\n");
   fs37.renameSync(tmp, p);
@@ -39357,7 +40103,7 @@ function getAssignment(dataDir, assignmentId) {
 
 // src/server/roles.ts
 var fs38 = __toESM(require("fs"));
-var path53 = __toESM(require("path"));
+var path54 = __toESM(require("path"));
 var BUILTIN_ROLES = [
   {
     id: SSO_ADMIN_ROLE_ID,
@@ -39375,7 +40121,7 @@ function isBuiltinRoleId(roleId) {
   return BUILTIN_ROLE_IDS.has(roleId);
 }
 function storePath8(dataDir) {
-  return path53.join(dataDir, "roles.json");
+  return path54.join(dataDir, "roles.json");
 }
 function load5(dataDir) {
   const p = storePath8(dataDir);
@@ -39399,7 +40145,7 @@ function load5(dataDir) {
 }
 function replaceAll3(dataDir, roles) {
   const p = storePath8(dataDir);
-  fs38.mkdirSync(path53.dirname(p), { recursive: true });
+  fs38.mkdirSync(path54.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs38.writeFileSync(tmp, JSON.stringify(roles, null, 2) + "\n");
   fs38.renameSync(tmp, p);
@@ -39637,7 +40383,7 @@ function actionableUnitIds(scopes) {
 
 // src/server/projects.ts
 var fs39 = __toESM(require("fs"));
-var path54 = __toESM(require("path"));
+var path55 = __toESM(require("path"));
 init_paths();
 init_yaml();
 init_fs();
@@ -39651,7 +40397,7 @@ function isValidProjectId(id) {
   return typeof id === "string" && ID_RE.test(id);
 }
 function registryPath(dataDir) {
-  return path54.join(dataDir, "projects.json");
+  return path55.join(dataDir, "projects.json");
 }
 function load6(dataDir) {
   try {
@@ -39662,13 +40408,13 @@ function load6(dataDir) {
 }
 function save2(dataDir, records) {
   const p = registryPath(dataDir);
-  fs39.mkdirSync(path54.dirname(p), { recursive: true });
+  fs39.mkdirSync(path55.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs39.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
   fs39.renameSync(tmp, p);
 }
 function projectRoot(dataDir, id) {
-  return path54.join(dataDir, "projects", id);
+  return path55.join(dataDir, "projects", id);
 }
 function existingProjectRoot(dataDir, id) {
   if (!isValidProjectId(id)) return null;
@@ -39821,7 +40567,7 @@ function resolveProjectRoot(dataDir, principal, selector) {
 
 // src/git/config.ts
 var fs40 = __toESM(require("fs"));
-var path55 = __toESM(require("path"));
+var path56 = __toESM(require("path"));
 init_fs();
 function configPath() {
   return aiDir("git.json");
@@ -39835,7 +40581,7 @@ function readGitConfig() {
 }
 function writeGitConfig(config) {
   const p = configPath();
-  fs40.mkdirSync(path55.dirname(p), { recursive: true });
+  fs40.mkdirSync(path56.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs40.writeFileSync(tmp, JSON.stringify(config, null, 2) + "\n");
   fs40.renameSync(tmp, p);
@@ -39850,7 +40596,7 @@ function clearGitConfig() {
 // src/git/adapter.ts
 var import_child_process5 = require("child_process");
 var fs41 = __toESM(require("fs"));
-var path56 = __toESM(require("path"));
+var path57 = __toESM(require("path"));
 init_fs();
 function git(args, cwd) {
   return (0, import_child_process5.execFileSync)("git", args, {
@@ -39901,9 +40647,9 @@ function compareUrl(remote, defaultBranch, workingBranch) {
   return `${web}/compare/${encodeURIComponent(defaultBranch)}...${encodeURIComponent(workingBranch)}`;
 }
 function excludeLocalFiles() {
-  const excludePath = path56.join(getProjectRoot(), ".git", "info", "exclude");
+  const excludePath = path57.join(getProjectRoot(), ".git", "info", "exclude");
   try {
-    fs41.mkdirSync(path56.dirname(excludePath), { recursive: true });
+    fs41.mkdirSync(path57.dirname(excludePath), { recursive: true });
     const existing = fs41.existsSync(excludePath) ? fs41.readFileSync(excludePath, "utf8") : "";
     const lines = existing.split(/\r?\n/).filter((line2) => line2.length > 0);
     const hadLegacyLockExclusion = lines.some((line2) => line2.trim() === ".wai/lock.json");
@@ -39982,7 +40728,7 @@ function configureSync(periodicSyncMinutes, skipIfClean) {
 
 // src/producers/config.ts
 var fs42 = __toESM(require("fs"));
-var path57 = __toESM(require("path"));
+var path58 = __toESM(require("path"));
 init_fs();
 function configPath2() {
   return aiDir("producers.json");
@@ -39996,7 +40742,7 @@ function load7() {
 }
 function save3(configs) {
   const p = configPath2();
-  fs42.mkdirSync(path57.dirname(p), { recursive: true });
+  fs42.mkdirSync(path58.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs42.writeFileSync(tmp, JSON.stringify(configs, null, 2) + "\n");
   fs42.renameSync(tmp, p);
@@ -40625,8 +41371,8 @@ async function produceProducer(cfg, credential, project2, target) {
   const configured = runWithProjectRoot(root, () => list()).some((p) => p.target === target);
   const token = configured ? resolveSecret(`${target}-token`) : null;
   if (configured && !token) {
-    const label2 = target.charAt(0).toUpperCase() + target.slice(1);
-    throw new Error(`No ${label2} token \u2014 set WAIRON_${target.toUpperCase()}_TOKEN or run \`wairon host secret set ${target}-token <secret>\`.`);
+    const label3 = target.charAt(0).toUpperCase() + target.slice(1);
+    throw new Error(`No ${label3} token \u2014 set WAIRON_${target.toUpperCase()}_TOKEN or run \`wairon host secret set ${target}-token <secret>\`.`);
   }
   await runWithProjectRoot(root, () => produce(target, diagramUrl, token ?? ""));
 }
@@ -40686,7 +41432,7 @@ function diagramViewLink(cfg, credential, project2) {
 
 // src/server/packs.ts
 var fs43 = __toESM(require("fs"));
-var path58 = __toESM(require("path"));
+var path59 = __toESM(require("path"));
 init_fs();
 init_yaml();
 
@@ -40742,7 +41488,7 @@ function assertNotCodeArchive(info) {
 function extractDeclarativeArchive(archive, destDir) {
   const result = extractArchive(archive, destDir, HOSTED_STRICT_LIMITS);
   try {
-    assertDeclarative(fs43.readFileSync(path58.join(result.directory, result.entryPath), "utf8"));
+    assertDeclarative(fs43.readFileSync(path59.join(result.directory, result.entryPath), "utf8"));
   } catch (e) {
     fs43.rmSync(destDir, { recursive: true, force: true });
     throw e;
@@ -40751,10 +41497,10 @@ function extractDeclarativeArchive(archive, destDir) {
 function probe(loadRef, baseRoot, scope, displayRef) {
   const loaded = loadExtensionPacks([{ ref: loadRef, scope }], baseRoot);
   if (loaded.errors.length) {
-    return { name: path58.basename(displayRef), scope, ref: displayRef, profiles: 0, languages: 0, rules: 0, error: loaded.errors[0] };
+    return { name: path59.basename(displayRef), scope, ref: displayRef, profiles: 0, languages: 0, rules: 0, error: loaded.errors[0] };
   }
   return {
-    name: loaded.packNames[0] ?? path58.basename(displayRef),
+    name: loaded.packNames[0] ?? path59.basename(displayRef),
     scope,
     ref: displayRef,
     profiles: Object.keys(loaded.profiles).length,
@@ -40768,20 +41514,20 @@ function probe(loadRef, baseRoot, scope, displayRef) {
   };
 }
 function writeFileAtomic(file, content) {
-  fs43.mkdirSync(path58.dirname(file), { recursive: true });
+  fs43.mkdirSync(path59.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
   fs43.writeFileSync(tmp, content);
   fs43.renameSync(tmp, file);
 }
 function stem(ref) {
-  return path58.basename(ref).replace(PACK_EXT_RE2, "");
+  return path59.basename(ref).replace(PACK_EXT_RE2, "");
 }
 function imagePacksDir() {
   return process.env.WAIRON_IMAGE_PACKS_DIR ?? "/opt/wairon/packs";
 }
 function probeTier(dir, tier) {
   return discoverPacks(dir).map((full) => {
-    const d = probe(full, path58.dirname(full), "global", path58.basename(full));
+    const d = probe(full, path59.dirname(full), "global", path59.basename(full));
     d.tier = tier;
     return d;
   });
@@ -40799,9 +41545,9 @@ function scanGlobalPackProfiles() {
   for (const dir of [globalPacksDir(), imagePacksDir()]) {
     for (const full of discoverPacks(dir)) {
       try {
-        const loaded = loadExtensionPacks([{ ref: full, scope: "global" }], path58.dirname(full));
+        const loaded = loadExtensionPacks([{ ref: full, scope: "global" }], path59.dirname(full));
         if (loaded.errors.length) continue;
-        const source = loaded.packNames[0] ?? path58.basename(full);
+        const source = loaded.packNames[0] ?? path59.basename(full);
         for (const [id, def] of Object.entries(loaded.profiles)) out.push({ id, source, family: def.family });
       } catch {
       }
@@ -40857,7 +41603,7 @@ function readPackContent(full) {
   if (st.isFile()) return fs43.readFileSync(full, "utf8");
   if (st.isDirectory()) {
     for (const entry of ["pack.yaml", "pack.yml"]) {
-      const p = path58.join(full, entry);
+      const p = path59.join(full, entry);
       if (fs43.existsSync(p) && fs43.statSync(p).isFile()) return fs43.readFileSync(p, "utf8");
     }
   }
@@ -40867,9 +41613,9 @@ function storeResolveGlobalPacks(names) {
   const index = /* @__PURE__ */ new Map();
   const indexTier = (dir, tier) => {
     for (const full of discoverPacks(dir)) {
-      const manifestName = probe(full, path58.dirname(full), "global", path58.basename(full)).name;
+      const manifestName = probe(full, path59.dirname(full), "global", path59.basename(full)).name;
       const candidate = { full, manifestName, tier };
-      for (const key of [manifestName, stem(full), path58.basename(full)]) {
+      for (const key of [manifestName, stem(full), path59.basename(full)]) {
         if (!index.has(key)) index.set(key, candidate);
       }
     }
@@ -40896,7 +41642,7 @@ function storeInstallGlobalPack(name, content) {
   assertName(name);
   assertDeclarative(content);
   const dir = globalPacksDir();
-  const file = path58.join(dir, `${name}.yaml`);
+  const file = path59.join(dir, `${name}.yaml`);
   writeFileAtomic(file, content);
   const descriptor = probe(file, dir, "global", `${name}.yaml`);
   descriptor.tier = "instance";
@@ -40907,7 +41653,7 @@ function storeInstallGlobalPackArchive(archive, name) {
   assertNotCodeArchive(info);
   const packName = name ?? info.name;
   assertName(packName);
-  const dir = path58.join(globalPacksDir(), packName);
+  const dir = path59.join(globalPacksDir(), packName);
   extractDeclarativeArchive(archive, dir);
   const descriptor = probe(dir, globalPacksDir(), "global", packName);
   descriptor.tier = "instance";
@@ -40918,7 +41664,7 @@ function declaredName2(loadRef, baseRoot, scope) {
   return d.error ? void 0 : d.name;
 }
 function pickByName(candidates, name, fileOf, manifestOf) {
-  const byFile = candidates.find((c) => stem(fileOf(c)) === name || path58.basename(fileOf(c)) === name);
+  const byFile = candidates.find((c) => stem(fileOf(c)) === name || path59.basename(fileOf(c)) === name);
   if (byFile !== void 0) return byFile;
   const byManifest = candidates.filter((c) => manifestOf(c) === name);
   if (byManifest.length > 1) {
@@ -40931,11 +41677,11 @@ function pickByName(candidates, name, fileOf, manifestOf) {
 function storeRemoveGlobalPack(name) {
   assertName(name);
   const dir = globalPacksDir();
-  const manifestOf = (ref) => declaredName2(ref, path58.dirname(ref), "global");
-  const match = pickByName(discoverPacks(dir), name, path58.basename, manifestOf);
+  const manifestOf = (ref) => declaredName2(ref, path59.dirname(ref), "global");
+  const match = pickByName(discoverPacks(dir), name, path59.basename, manifestOf);
   if (!match) {
     const inImage = discoverPacks(imagePacksDir()).some(
-      (ref) => stem(ref) === name || path58.basename(ref) === name || manifestOf(ref) === name
+      (ref) => stem(ref) === name || path59.basename(ref) === name || manifestOf(ref) === name
     );
     throw new Error(
       inImage ? `Pack "${name}" is an immutable image-layer pack (WAIRON_IMAGE_PACKS_DIR) and cannot be removed at runtime; rebuild the extension image without it.` : `No server-global instance pack named "${name}".`
@@ -40947,9 +41693,9 @@ function storeListProjectPacks(config) {
   const root = getProjectRoot();
   const entries = config?.extensions?.packs ?? [];
   return entries.map((entry) => {
-    const label2 = packEntryLabel(entry);
+    const label3 = packEntryLabel(entry);
     const ref = packEntryRef(entry, root);
-    return probe(ref ?? label2, root, "project", label2);
+    return probe(ref ?? label3, root, "project", label3);
   });
 }
 function storeInstallProjectPack(name, content) {
@@ -40957,7 +41703,7 @@ function storeInstallProjectPack(name, content) {
   assertDeclarative(content);
   const root = getProjectRoot();
   const relRef = `.wai/packs/${name}.yaml`;
-  writeFileAtomic(path58.join(root, ".wai", "packs", `${name}.yaml`), content);
+  writeFileAtomic(path59.join(root, ".wai", "packs", `${name}.yaml`), content);
   return probe(relRef, root, "project", relRef);
 }
 function storeInstallProjectPackArchive(archive, name) {
@@ -40967,15 +41713,15 @@ function storeInstallProjectPackArchive(archive, name) {
   assertName(packName);
   const root = getProjectRoot();
   const relRef = `.wai/packs/${packName}`;
-  extractDeclarativeArchive(archive, path58.join(root, ".wai", "packs", packName));
+  extractDeclarativeArchive(archive, path59.join(root, ".wai", "packs", packName));
   return probe(relRef, root, "project", relRef);
 }
 function storeRemoveProjectPack(name, ref) {
   assertName(name);
   const root = getProjectRoot();
-  const resolved = path58.resolve(root, ref ?? path58.join(".wai", "packs", name));
-  const vendorDir = path58.resolve(root, ".wai", "packs");
-  if (resolved.startsWith(vendorDir + path58.sep)) {
+  const resolved = path59.resolve(root, ref ?? path59.join(".wai", "packs", name));
+  const vendorDir = path59.resolve(root, ".wai", "packs");
+  if (resolved.startsWith(vendorDir + path59.sep)) {
     fs43.rmSync(resolved, { recursive: true, force: true });
   }
 }
@@ -40998,7 +41744,7 @@ function boundProject2(cfg, project2) {
 function findPackRegistration(config, name) {
   const relRef = `.wai/packs/${name}.yaml`;
   const entries = config?.extensions?.packs ?? [];
-  const direct = entries.find((entry) => typeof entry === "string" ? entry === relRef || stem(entry) === name || path58.basename(entry) === name : entry.name === name);
+  const direct = entries.find((entry) => typeof entry === "string" ? entry === relRef || stem(entry) === name || path59.basename(entry) === name : entry.name === name);
   if (direct !== void 0) return direct;
   const root = getProjectRoot();
   const refs = entries.filter((entry) => typeof entry === "string");
@@ -41113,7 +41859,7 @@ function installProjectPackArchive(cfg, credential, project2, archive, name) {
 
 // src/server/audit.ts
 var fs44 = __toESM(require("fs"));
-var path59 = __toESM(require("path"));
+var path60 = __toESM(require("path"));
 var crypto12 = __toESM(require("crypto"));
 var LEVEL_ORDER = {
   debug: 0,
@@ -41136,7 +41882,7 @@ var DEFAULT_AUDIT_POLICY = {
   metadataMode: "redacted"
 };
 function storePath9(dataDir) {
-  return path59.join(dataDir, "audit-events.json");
+  return path60.join(dataDir, "audit-events.json");
 }
 function readEvents(dataDir) {
   const p = storePath9(dataDir);
@@ -41157,7 +41903,7 @@ function readEvents(dataDir) {
 }
 function persistEvents(dataDir, events) {
   const p = storePath9(dataDir);
-  fs44.mkdirSync(path59.dirname(p), { recursive: true });
+  fs44.mkdirSync(path60.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs44.writeFileSync(tmp, JSON.stringify(events, null, 2) + "\n");
   fs44.renameSync(tmp, p);
@@ -41849,7 +42595,7 @@ function assertAllowedRedirectUri(provider, redirectUri) {
 
 // src/server/policy.ts
 var fs45 = __toESM(require("fs"));
-var path60 = __toESM(require("path"));
+var path61 = __toESM(require("path"));
 init_fs();
 
 // src/server/httpio.ts
@@ -41866,7 +42612,7 @@ function sendJson(res, status2, body) {
 
 // src/server/policy.ts
 function packPolicyPath(dataDir) {
-  return path60.join(dataDir, "pack-policy.json");
+  return path61.join(dataDir, "pack-policy.json");
 }
 function getPackPolicyRecord(dataDir) {
   const p = packPolicyPath(dataDir);
@@ -41886,14 +42632,14 @@ function getPackPolicyRecord(dataDir) {
 function setPackPolicyRecord(dataDir, policy) {
   const stored = { ...policy, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
   const p = packPolicyPath(dataDir);
-  fs45.mkdirSync(path60.dirname(p), { recursive: true });
+  fs45.mkdirSync(path61.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs45.writeFileSync(tmp, JSON.stringify(stored, null, 2) + "\n");
   fs45.renameSync(tmp, p);
   return stored;
 }
 function exposurePolicyPath(dataDir) {
-  return path60.join(dataDir, "exposure-policy.json");
+  return path61.join(dataDir, "exposure-policy.json");
 }
 var COMPATIBLE_DEFAULT_EXPOSURE = {
   adminApiMode: "local_only",
@@ -41923,7 +42669,7 @@ function getExposurePolicyRecord(dataDir) {
 }
 function setExposurePolicyRecord(dataDir, policy) {
   const p = exposurePolicyPath(dataDir);
-  fs45.mkdirSync(path60.dirname(p), { recursive: true });
+  fs45.mkdirSync(path61.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs45.writeFileSync(tmp, JSON.stringify(policy, null, 2) + "\n");
   fs45.renameSync(tmp, p);
@@ -41944,7 +42690,7 @@ function effectivePolicy(dataDir) {
   return getPackPolicyRecord(dataDir) ?? PERMISSIVE_DEFAULT_POLICY;
 }
 function identityProvidersPath(dataDir) {
-  return path60.join(dataDir, "identity-providers.json");
+  return path61.join(dataDir, "identity-providers.json");
 }
 function sanitizeIdentityProvider(config) {
   const clean = {
@@ -41968,7 +42714,7 @@ function sanitizeIdentityProvider(config) {
 }
 function writeIdentityProviderRecords(dataDir, records) {
   const p = identityProvidersPath(dataDir);
-  fs45.mkdirSync(path60.dirname(p), { recursive: true });
+  fs45.mkdirSync(path61.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs45.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
   fs45.renameSync(tmp, p);
@@ -42171,8 +42917,8 @@ function buildEvaluation(input) {
     missingPackNames = requiredDefaultNames(policy).filter((n) => !present.has(n));
     unresolvedPacks = [];
   }
-  const blocked = new Set(policy.blockedPackNames ?? []);
-  const blockedPackNames = presentPackNames.filter((n) => blocked.has(n));
+  const blocked2 = new Set(policy.blockedPackNames ?? []);
+  const blockedPackNames = presentPackNames.filter((n) => blocked2.has(n));
   const requiredProfileIds = policy.requiredProfileIds ?? [];
   const selected = new Set(selectedProfileIds);
   const missingProfileIds = requiredProfileIds.filter((id) => !selected.has(id));
@@ -43014,10 +43760,10 @@ init_fs();
 
 // src/server/relations.ts
 var fs46 = __toESM(require("fs"));
-var path61 = __toESM(require("path"));
+var path62 = __toESM(require("path"));
 var crypto15 = __toESM(require("crypto"));
 function storePath10(dataDir) {
-  return path61.join(dataDir, "relations.json");
+  return path62.join(dataDir, "relations.json");
 }
 function readRelations(dataDir) {
   const p = storePath10(dataDir);
@@ -43038,7 +43784,7 @@ function readRelations(dataDir) {
 }
 function persistRelations(dataDir, relations) {
   const p = storePath10(dataDir);
-  fs46.mkdirSync(path61.dirname(p), { recursive: true });
+  fs46.mkdirSync(path62.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs46.writeFileSync(tmp, JSON.stringify(relations, null, 2) + "\n");
   fs46.renameSync(tmp, p);
@@ -43152,9 +43898,9 @@ function listProjectRelations(dataDir, sourceProjectId, targetProjectId, status2
 
 // src/server/surfaces.ts
 var fs47 = __toESM(require("fs"));
-var path62 = __toESM(require("path"));
+var path63 = __toESM(require("path"));
 function storePath11(dataDir) {
-  return path62.join(dataDir, "public-surfaces.json");
+  return path63.join(dataDir, "public-surfaces.json");
 }
 function readSnapshots(dataDir) {
   const p = storePath11(dataDir);
@@ -43175,7 +43921,7 @@ function readSnapshots(dataDir) {
 }
 function persistSnapshots(dataDir, snapshots) {
   const p = storePath11(dataDir);
-  fs47.mkdirSync(path62.dirname(p), { recursive: true });
+  fs47.mkdirSync(path63.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs47.writeFileSync(tmp, JSON.stringify(snapshots, null, 2) + "\n");
   fs47.renameSync(tmp, p);
@@ -43321,12 +44067,12 @@ function resolveVisibility(observerProjectId, units, placements) {
   const best = /* @__PURE__ */ new Map();
   for (const placement of placements) {
     if (placement.projectId === observerProjectId) continue;
-    const path76 = chainOf(placement.unitId, unitById);
-    if (!path76.length) continue;
-    const closedOk = path76.every((u) => effectivePosture(u, unitById) !== "closed" || observerInside(u.id) || grantedTo(u));
+    const path77 = chainOf(placement.unitId, unitById);
+    if (!path77.length) continue;
+    const closedOk = path77.every((u) => effectivePosture(u, unitById) !== "closed" || observerInside(u.id) || grantedTo(u));
     if (!closedOk) continue;
-    const crossTenant = !tenantRoots.has(path76[path76.length - 1].id);
-    if (crossTenant && !path76.some(grantedTo)) continue;
+    const crossTenant = !tenantRoots.has(path77[path77.length - 1].id);
+    if (crossTenant && !path77.some(grantedTo)) continue;
     if (crossTenant && directUnits.length === 0) continue;
     const distance = crossTenant ? "partner" : sameBranch(placement.unitId) ? "department" : "instance";
     const existing = best.get(placement.projectId);
@@ -43946,7 +44692,7 @@ function handleLandscapeRequest(cfg, credential, req, res, body, url) {
 
 // src/server/migration.ts
 var fs48 = __toESM(require("fs"));
-var path63 = __toESM(require("path"));
+var path64 = __toESM(require("path"));
 var LEGACY_CAPABILITY_MAP = {
   "mcp:read": "project:read",
   "operations:read": "project:read",
@@ -43984,7 +44730,7 @@ function readRaw(file) {
   }
 }
 function writeRaw(file, value) {
-  fs48.mkdirSync(path63.dirname(file), { recursive: true });
+  fs48.mkdirSync(path64.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
   fs48.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n");
   fs48.renameSync(tmp, file);
@@ -44015,19 +44761,19 @@ function seedAssignment(dataDir, existing, subjectId, capability, scope) {
   existing.push({ subjectId, scopeKind: scope.scopeKind, scopeId: scope.scopeId, capability });
   return true;
 }
-function migratePermissionModel(dataDir, apply) {
+function migratePermissionModel(dataDir, apply2) {
   const findings = [];
   const found = (area, detail) => {
     findings.push({ area, detail });
   };
   const grid = readRaw(
-    path63.join(dataDir, "permissions.json")
+    path64.join(dataDir, "permissions.json")
   ) ?? [];
   if (!getInstanceIdentity(dataDir)) {
     found("instance", "instance identity is not seeded \u2014 the built-in admin/dev subjects have no persisted UUIDs");
-    if (apply) ensureInstanceIdentity(dataDir);
+    if (apply2) ensureInstanceIdentity(dataDir);
   }
-  const orgPath = path63.join(dataDir, "organization.json");
+  const orgPath = path64.join(dataDir, "organization.json");
   const org = readRaw(orgPath);
   if (org?.units?.length) {
     const units = org.units;
@@ -44055,14 +44801,14 @@ function migratePermissionModel(dataDir, apply) {
       newIds.set(unit.id, candidate);
       if (!unit.slug || unit.slug !== slug) {
         found("units", `unit "${unit.id}" gets slug "${slug}"`);
-        if (apply) unit.slug = slug;
+        if (apply2) unit.slug = slug;
       }
       if (candidate !== unit.id) {
         found("units", `unit id "${unit.id}" becomes the qualified path "${candidate}"`);
         remap.push({ oldId: unit.id, newId: candidate });
       }
     }
-    if (apply) {
+    if (apply2) {
       const lookup2 = new Map(remap.map((r) => [r.oldId, r.newId]));
       for (const unit of units) {
         unit.id = lookup2.get(unit.id) ?? unit.id;
@@ -44081,7 +44827,7 @@ function migratePermissionModel(dataDir, apply) {
       found("units", `${remap.length} unit id(s) would be remapped across placements, exposeTo, assignments, and users`);
     }
   }
-  const usersPath = path63.join(dataDir, "users.json");
+  const usersPath = path64.join(dataDir, "users.json");
   const users = readRaw(usersPath);
   if (users) {
     let changed = false;
@@ -44095,7 +44841,7 @@ function migratePermissionModel(dataDir, apply) {
       }
       const subjectId = user.subject?.userId ?? user.id;
       found("users", `user "${user.id}": ${user.grants.length} stored grant(s) become assignments for subject "${subjectId}"`);
-      if (apply) {
+      if (apply2) {
         for (const grant of user.grants) {
           const scope = scopeOf(grant);
           for (const capability of capabilitiesOf(grant.permissions)) {
@@ -44106,9 +44852,9 @@ function migratePermissionModel(dataDir, apply) {
         changed = true;
       }
     }
-    if (apply && changed) writeRaw(usersPath, users);
+    if (apply2 && changed) writeRaw(usersPath, users);
   }
-  const keysPath = path63.join(dataDir, "auth", "credentials.json");
+  const keysPath = path64.join(dataDir, "auth", "credentials.json");
   const keys = readRaw(keysPath);
   if (keys) {
     let changed = false;
@@ -44116,7 +44862,7 @@ function migratePermissionModel(dataDir, apply) {
       if (key.revokedAt) continue;
       if (isLegacyBuiltin(key.ownerSubject?.userId)) {
         found("keys", `key "${key.id}" is owned by the retired literal "${key.ownerSubject?.userId}" \u2014 revoked; re-mint for the seeded UUID subject`);
-        if (apply) {
+        if (apply2) {
           key.revokedAt = (/* @__PURE__ */ new Date()).toISOString();
           changed = true;
         }
@@ -44126,7 +44872,7 @@ function migratePermissionModel(dataDir, apply) {
       if (legacyGrants?.length) {
         const projects = [...new Set(legacyGrants.map((g) => g.orgUnitId || !g.projectId ? "*" : g.projectId))];
         found("keys", `key "${key.id}": stored grants become the projects narrowing [${projects.join(", ")}]`);
-        if (apply) {
+        if (apply2) {
           key.projects = projects.includes("*") ? ["*"] : projects;
           delete key.grants;
           changed = true;
@@ -44135,7 +44881,7 @@ function migratePermissionModel(dataDir, apply) {
       if (!key.ownerSubject) {
         const ownerId = `svc-key-${key.id}`;
         found("keys", `key "${key.id}" has no owner \u2014 bound to the synthesized service subject "${ownerId}" carrying its legacy authority`);
-        if (apply) {
+        if (apply2) {
           key.ownerSubject = { userId: ownerId, kind: "service", issuer: "local" };
           const caps = [];
           if (legacyGrants?.length) {
@@ -44156,9 +44902,9 @@ function migratePermissionModel(dataDir, apply) {
         }
       }
     }
-    if (apply && changed) writeRaw(keysPath, keys);
+    if (apply2 && changed) writeRaw(keysPath, keys);
   }
-  const sessionsPath = path63.join(dataDir, "web-sessions.json");
+  const sessionsPath = path64.join(dataDir, "web-sessions.json");
   const sessions = readRaw(sessionsPath);
   if (sessions) {
     let changed = false;
@@ -44166,7 +44912,7 @@ function migratePermissionModel(dataDir, apply) {
       if (isLegacyBuiltin(s.subject?.userId)) {
         found("sessions", `session "${s.id}" belongs to the retired literal "${s.subject?.userId}" \u2014 dropped (re-login mints the UUID subject)`);
         changed = true;
-        return !apply;
+        return !apply2;
       }
       return true;
     });
@@ -44174,19 +44920,19 @@ function migratePermissionModel(dataDir, apply) {
       if (!s.grants) continue;
       const projects = [...new Set(s.grants.map((g) => g.orgUnitId || !g.projectId ? "*" : g.projectId))];
       found("sessions", `session "${s.id}": stored grants become the projects narrowing [${projects.join(", ")}]`);
-      if (apply) {
+      if (apply2) {
         s.projects = projects.length === 0 || projects.includes("*") ? ["*"] : projects;
         delete s.grants;
         changed = true;
       }
     }
-    if (apply && changed) writeRaw(sessionsPath, kept);
+    if (apply2 && changed) writeRaw(sessionsPath, kept);
   }
   const placedIds = new Set(listProjectPlacements(dataDir).map((p) => p.projectId));
   const unplaced = listProjectRecords(dataDir).filter((r) => !placedIds.has(r.id));
   if (unplaced.length > 0) {
     found("projects", `${unplaced.length} project(s) are placed in no organization unit: ${unplaced.map((r) => r.id).join(", ")} \u2014 placed into the 'unassigned' root unit`);
-    if (apply) {
+    if (apply2) {
       const system = { userId: "migration", kind: "service", issuer: "local" };
       if (!getOrganizationUnit(dataDir, "unassigned")) {
         createUnit(dataDir, {
@@ -44228,17 +44974,17 @@ function migratePermissionModel(dataDir, apply) {
       "placements",
       `project "${projectId}" carries ${rows.length} owner placements \u2014 keeping the newest (${sorted[0].unitId}), removing ${stale.map((p) => p.unitId).join(", ")}`
     );
-    if (apply) {
+    if (apply2) {
       for (const p of stale) deletePlacement(dataDir, p.id);
     }
   }
-  return { findings, applied: apply };
+  return { findings, applied: apply2 };
 }
 
 // src/server/http.ts
 var http2 = __toESM(require("http"));
 var fs56 = __toESM(require("fs"));
-var path71 = __toESM(require("path"));
+var path72 = __toESM(require("path"));
 
 // src/server/request.ts
 var import_streamableHttp = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
@@ -44252,10 +44998,10 @@ function createScopedServer() {
 
 // src/server/approvals.ts
 var fs49 = __toESM(require("fs"));
-var path64 = __toESM(require("path"));
+var path65 = __toESM(require("path"));
 var crypto16 = __toESM(require("crypto"));
 function storePath12(dataDir) {
-  return path64.join(dataDir, "approvals.json");
+  return path65.join(dataDir, "approvals.json");
 }
 function readRequests(dataDir) {
   const p = storePath12(dataDir);
@@ -44276,7 +45022,7 @@ function readRequests(dataDir) {
 }
 function persistRequests(dataDir, requests) {
   const p = storePath12(dataDir);
-  fs49.mkdirSync(path64.dirname(p), { recursive: true });
+  fs49.mkdirSync(path65.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs49.writeFileSync(tmp, JSON.stringify(requests, null, 2) + "\n");
   fs49.renameSync(tmp, p);
@@ -44800,7 +45546,7 @@ async function awaitApproval(cfg, credential, requestId, timeoutSeconds) {
   let current2 = req;
   while (current2.status === "pending" && Date.now() < deadline) {
     const remaining = deadline - Date.now();
-    await new Promise((resolve36) => setTimeout(resolve36, Math.min(AWAIT_POLL_INTERVAL_MS, remaining)));
+    await new Promise((resolve37) => setTimeout(resolve37, Math.min(AWAIT_POLL_INTERVAL_MS, remaining)));
     expirePendingApprovals(cfg.dataDir, (/* @__PURE__ */ new Date()).toISOString());
     current2 = getApprovalRequestById(cfg.dataDir, requestId) ?? current2;
   }
@@ -44954,24 +45700,24 @@ function collectUsage(projects, scope) {
 }
 function buildHealthReport(checks, usage) {
   const status2 = checks.some((c) => c.status === "fail") ? "unhealthy" : checks.some((c) => c.status === "warn") ? "degraded" : "ok";
-  const report2 = { status: status2, generatedAt: (/* @__PURE__ */ new Date()).toISOString(), checks };
-  if (usage) report2.usage = usage;
-  return report2;
+  const report3 = { status: status2, generatedAt: (/* @__PURE__ */ new Date()).toISOString(), checks };
+  if (usage) report3.usage = usage;
+  return report3;
 }
 function evaluateUsage(snapshots, policy) {
   if (!policy.enabled) return snapshots;
   const advisory = policy.mode === "block" ? "observe" : policy.mode || "observe";
   return snapshots.map((snapshot) => {
     const messages = [];
-    const compare = (value, limit, label2) => {
+    const compare2 = (value, limit, label3) => {
       if (typeof value === "number" && typeof limit === "number" && value > limit) {
-        messages.push(`[${advisory}] ${label2} ${value} exceeds limit ${limit}`);
+        messages.push(`[${advisory}] ${label3} ${value} exceeds limit ${limit}`);
       }
     };
-    compare(snapshot.projectCount, policy.maxProjectsPerUser, "projectCount");
-    compare(snapshot.projectBytes, policy.maxProjectBytes, "projectBytes");
-    compare(snapshot.mcpRequestsLastMinute, policy.maxMcpRequestsPerMinute, "mcpRequestsPerMinute");
-    compare(snapshot.auditEventsToday, policy.maxAuditEventsPerDay, "auditEventsPerDay");
+    compare2(snapshot.projectCount, policy.maxProjectsPerUser, "projectCount");
+    compare2(snapshot.projectBytes, policy.maxProjectBytes, "projectBytes");
+    compare2(snapshot.mcpRequestsLastMinute, policy.maxMcpRequestsPerMinute, "mcpRequestsPerMinute");
+    compare2(snapshot.auditEventsToday, policy.maxAuditEventsPerDay, "auditEventsPerDay");
     if (messages.length === 0) return snapshot;
     return { ...snapshot, quotaMessages: [...snapshot.quotaMessages, ...messages] };
   });
@@ -45088,11 +45834,11 @@ function handleOperationsRequest(cfg, credential, req, res, url) {
 
 // src/server/gitbacking.ts
 var fs50 = __toESM(require("fs"));
-var path65 = __toESM(require("path"));
+var path66 = __toESM(require("path"));
 var crypto17 = __toESM(require("crypto"));
 var import_child_process6 = require("child_process");
 function storePath13(dataDir) {
-  return path65.join(dataDir, "git-backing.json");
+  return path66.join(dataDir, "git-backing.json");
 }
 var GitBackingStore = class {
   constructor(dataDir) {
@@ -45123,7 +45869,7 @@ var GitBackingStore = class {
   /** Swap the persisted collection wholesale via write-temp-then-rename. */
   replaceAll(bindings) {
     const p = storePath13(this.dataDir);
-    fs50.mkdirSync(path65.dirname(p), { recursive: true });
+    fs50.mkdirSync(path66.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
     fs50.writeFileSync(tmp, JSON.stringify(bindings, null, 2) + "\n");
     fs50.renameSync(tmp, p);
@@ -45231,7 +45977,7 @@ function checkoutBranch(workdir, branch) {
   }
 }
 function cloneOrOpen(remote, branch, workdir, credentialRef) {
-  if (!fs50.existsSync(path65.join(workdir, ".git"))) {
+  if (!fs50.existsSync(path66.join(workdir, ".git"))) {
     fs50.mkdirSync(workdir, { recursive: true });
     git2(["clone", authRemote2(remote, credentialRef), "."], workdir);
     git2(["config", "user.name", process.env["WAIRON_GIT_NAME"] || "wairon-bot"], workdir);
@@ -45247,7 +45993,7 @@ function mirrorTree(sourceDir, targetDir) {
   fs50.rmSync(targetDir, { recursive: true, force: true });
   const stat = fs50.statSync(sourceDir, { throwIfNoEntry: false });
   if (!stat) return;
-  fs50.mkdirSync(path65.dirname(targetDir), { recursive: true });
+  fs50.mkdirSync(path66.dirname(targetDir), { recursive: true });
   fs50.cpSync(sourceDir, targetDir, { recursive: true });
 }
 function commitAndPush(workdir, message) {
@@ -45370,7 +46116,7 @@ function unbindScope(cfg, credential, bindingId) {
   tryAppendAudit7(cfg, buildAuditEvent6(principal, "git.backing.unbind", "security", bindingId));
 }
 function runMirrorSync(cfg, binding) {
-  const workdir = path65.join(cfg.dataDir, "git-backing", binding.id);
+  const workdir = path66.join(cfg.dataDir, "git-backing", binding.id);
   cloneOrOpen(binding.remote, binding.branch, workdir, binding.credentialRef);
   if (binding.scopeKind === "unit") {
     const units = listOrganizationUnits(cfg.dataDir);
@@ -45378,23 +46124,23 @@ function runMirrorSync(cfg, binding) {
     const placedIds = new Set(
       listProjectPlacements(cfg.dataDir).filter((p) => subtree.has(p.unitId)).map((p) => p.projectId)
     );
-    const projectsDir = path65.join(workdir, "projects");
+    const projectsDir = path66.join(workdir, "projects");
     fs50.rmSync(projectsDir, { recursive: true, force: true });
     for (const rec of listProjectRecords(cfg.dataDir)) {
       if (!placedIds.has(rec.id)) continue;
-      mirrorTree(path65.join(rec.rootPath, ".wai"), path65.join(projectsDir, rec.id, ".wai"));
+      mirrorTree(path66.join(rec.rootPath, ".wai"), path66.join(projectsDir, rec.id, ".wai"));
     }
   } else {
-    const instanceDir = path65.join(workdir, "instance");
+    const instanceDir = path66.join(workdir, "instance");
     fs50.rmSync(instanceDir, { recursive: true, force: true });
     const files = binding.includeCredentials ? INSTANCE_STRUCTURE_FILES : INSTANCE_STRUCTURE_FILES.filter((rel2) => rel2 !== "auth/credentials.json");
     for (const rel2 of files) {
-      mirrorTree(path65.join(cfg.dataDir, rel2), path65.join(instanceDir, rel2));
+      mirrorTree(path66.join(cfg.dataDir, rel2), path66.join(instanceDir, rel2));
     }
-    const projectsDir = path65.join(workdir, "projects");
+    const projectsDir = path66.join(workdir, "projects");
     fs50.rmSync(projectsDir, { recursive: true, force: true });
     for (const rec of listProjectRecords(cfg.dataDir)) {
-      mirrorTree(path65.join(rec.rootPath, ".wai"), path65.join(projectsDir, rec.id, ".wai"));
+      mirrorTree(path66.join(rec.rootPath, ".wai"), path66.join(projectsDir, rec.id, ".wai"));
     }
   }
   const published = commitAndPush(
@@ -45712,7 +46458,7 @@ function encodeFrame(opcode, payload) {
 // src/server/web.ts
 var crypto23 = __toESM(require("crypto"));
 var fs55 = __toESM(require("fs"));
-var path70 = __toESM(require("path"));
+var path71 = __toESM(require("path"));
 
 // src/server/webadmin.ts
 function listUsers3(cfg, sessionId, project2) {
@@ -45967,14 +46713,14 @@ var crypto22 = __toESM(require("crypto"));
 
 // src/server/sharesnapshots.ts
 var fs51 = __toESM(require("fs"));
-var path66 = __toESM(require("path"));
+var path67 = __toESM(require("path"));
 var crypto19 = __toESM(require("crypto"));
 init_fs();
 function snapshotDir(dataDir) {
-  return path66.join(dataDir, "share-snapshots");
+  return path67.join(dataDir, "share-snapshots");
 }
 function snapshotPath2(dataDir, id) {
-  return path66.join(snapshotDir(dataDir), `${id}.json`);
+  return path67.join(snapshotDir(dataDir), `${id}.json`);
 }
 var ShareSnapshotStore = class {
   constructor(dataDir) {
@@ -45983,7 +46729,7 @@ var ShareSnapshotStore = class {
   write(snapshot) {
     const p = snapshotPath2(this.dataDir, snapshot.id);
     if (fs51.existsSync(p)) return;
-    fs51.mkdirSync(path66.dirname(p), { recursive: true });
+    fs51.mkdirSync(path67.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
     fs51.writeFileSync(tmp, JSON.stringify(snapshot, null, 2) + "\n");
     fs51.renameSync(tmp, p);
@@ -46085,10 +46831,10 @@ function captureSnapshot(dataDir, principal, projectId, view, artifacts) {
 
 // src/server/sharelinks.ts
 var fs52 = __toESM(require("fs"));
-var path67 = __toESM(require("path"));
+var path68 = __toESM(require("path"));
 var crypto20 = __toESM(require("crypto"));
 function storePath14(dataDir) {
-  return path67.join(dataDir, "share-links.json");
+  return path68.join(dataDir, "share-links.json");
 }
 var ShareLinkStore = class {
   constructor(dataDir) {
@@ -46116,7 +46862,7 @@ var ShareLinkStore = class {
   }
   replaceAll(links) {
     const p = storePath14(this.dataDir);
-    fs52.mkdirSync(path67.dirname(p), { recursive: true });
+    fs52.mkdirSync(path68.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
     fs52.writeFileSync(tmp, JSON.stringify(links, null, 2) + "\n");
     fs52.renameSync(tmp, p);
@@ -46188,10 +46934,10 @@ function listProjectLinks(dataDir, projectId) {
 
 // src/server/shareaccesslog.ts
 var fs53 = __toESM(require("fs"));
-var path68 = __toESM(require("path"));
+var path69 = __toESM(require("path"));
 var crypto21 = __toESM(require("crypto"));
 function storePath15(dataDir) {
-  return path68.join(dataDir, "share-access.json");
+  return path69.join(dataDir, "share-access.json");
 }
 var ShareAccessStore = class {
   constructor(dataDir) {
@@ -46219,7 +46965,7 @@ var ShareAccessStore = class {
   }
   append(entry) {
     const p = storePath15(this.dataDir);
-    fs53.mkdirSync(path68.dirname(p), { recursive: true });
+    fs53.mkdirSync(path69.dirname(p), { recursive: true });
     const next = [...this.load(), entry];
     const tmp = `${p}.tmp`;
     fs53.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n");
@@ -46375,15 +47121,15 @@ init_fs();
 
 // src/server/swagger.ts
 var fs54 = __toESM(require("fs"));
-var path69 = __toESM(require("path"));
+var path70 = __toESM(require("path"));
 var cache;
 function loadAssets() {
   if (cache !== void 0) return cache;
   try {
-    const dir = path69.dirname(require.resolve("swagger-ui-dist/package.json"));
+    const dir = path70.dirname(require.resolve("swagger-ui-dist/package.json"));
     cache = {
-      css: fs54.readFileSync(path69.join(dir, "swagger-ui.css"), "utf8"),
-      js: fs54.readFileSync(path69.join(dir, "swagger-ui-bundle.js"), "utf8")
+      css: fs54.readFileSync(path70.join(dir, "swagger-ui.css"), "utf8"),
+      js: fs54.readFileSync(path70.join(dir, "swagger-ui-bundle.js"), "utf8")
     };
   } catch {
     cache = null;
@@ -46795,11 +47541,11 @@ function nonceMatches(a, b) {
 }
 function loadReactBundle() {
   const candidates = [
-    path70.resolve(__dirname, "webapp.html"),
+    path71.resolve(__dirname, "webapp.html"),
     // dist/index.js -> dist/webapp.html
-    path70.resolve(__dirname, "..", "webapp.html"),
+    path71.resolve(__dirname, "..", "webapp.html"),
     // dist/cli/index.js -> dist/webapp.html
-    path70.resolve(__dirname, "..", "..", "web", "dist", "index.html")
+    path71.resolve(__dirname, "..", "..", "web", "dist", "index.html")
     // tsx dev: src/server -> web/dist
   ];
   for (const candidate of candidates) {
@@ -49383,8 +50129,8 @@ var RealtimeHub = class {
    *  complete the handshake, and register the connection. A bad path or session
    *  destroys the socket. */
   handleUpgrade(cfg, req, socket) {
-    const path76 = (req.url ?? "/").split("?")[0];
-    if (path76 !== REALTIME_PATH || !isWebSocketUpgrade(req)) {
+    const path77 = (req.url ?? "/").split("?")[0];
+    if (path77 !== REALTIME_PATH || !isWebSocketUpgrade(req)) {
       socket.destroy();
       return;
     }
@@ -50381,7 +51127,7 @@ function routeData(cfg, req, res) {
 }
 function readExposurePolicyFile(dataDir) {
   try {
-    const raw = fs56.readFileSync(path71.join(dataDir, "exposure-policy.json"), "utf8");
+    const raw = fs56.readFileSync(path72.join(dataDir, "exposure-policy.json"), "utf8");
     const parsed = JSON.parse(raw);
     return parsed && typeof parsed === "object" ? parsed : void 0;
   } catch {
@@ -50568,17 +51314,17 @@ async function routeAdmin(cfg, req, res) {
 }
 function warnIfDataDirUnmigrated(cfg) {
   try {
-    const report2 = migratePermissionModel(cfg.dataDir, false);
-    if (report2.findings.length === 0) return;
+    const report3 = migratePermissionModel(cfg.dataDir, false);
+    if (report3.findings.length === 0) return;
     console.error(
-      `[wairon migrate] ${report2.findings.length} legacy data shape(s) found in ${cfg.dataDir} \u2014 this instance has NOT been migrated to the permission model. Legacy users and tokens resolve to zero permissions until you run: wairon host doctor --fix (run it without --fix first for a dry run).`
+      `[wairon migrate] ${report3.findings.length} legacy data shape(s) found in ${cfg.dataDir} \u2014 this instance has NOT been migrated to the permission model. Legacy users and tokens resolve to zero permissions until you run: wairon host doctor --fix (run it without --fix first for a dry run).`
     );
-    const shown = report2.findings.slice(0, 10);
+    const shown = report3.findings.slice(0, 10);
     for (const finding of shown) {
       console.error(`[wairon migrate]   ${finding.area}: ${finding.detail}`);
     }
-    if (report2.findings.length > shown.length) {
-      console.error(`[wairon migrate]   \u2026 and ${report2.findings.length - shown.length} more (see \`wairon host doctor\`).`);
+    if (report3.findings.length > shown.length) {
+      console.error(`[wairon migrate]   \u2026 and ${report3.findings.length - shown.length} more (see \`wairon host doctor\`).`);
     }
   } catch (err) {
     console.error(`[wairon migrate] migration check skipped: ${err instanceof Error ? err.message : String(err)}`);
@@ -51073,9 +51819,9 @@ function seedDemoTree() {
 
 // src/commands/host.ts
 function resolveHostConfig(options) {
-  const dataDir = options.dataDir || process.env["WAIRON_DATA_DIR"] || path72.join(os11.homedir(), ".wairon", "data");
+  const dataDir = options.dataDir || process.env["WAIRON_DATA_DIR"] || path73.join(os11.homedir(), ".wairon", "data");
   if (!process.env["WAIRON_PACKS_DIR"]) {
-    process.env["WAIRON_PACKS_DIR"] = path72.join(dataDir, "packs");
+    process.env["WAIRON_PACKS_DIR"] = path73.join(dataDir, "packs");
   }
   const cfg = {
     host: options.host || "0.0.0.0",
@@ -51132,11 +51878,11 @@ async function runServe(options = {}) {
   logger.info(`  data dir:    ${import_chalk17.default.gray(cfg.dataDir)}`);
   logger.blank();
   logger.info("Press Ctrl+C to stop.");
-  await new Promise((resolve36) => {
+  await new Promise((resolve37) => {
     const shutdown = () => {
       logger.info("Shutting down\u2026");
       handle.close();
-      resolve36();
+      resolve37();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -51156,13 +51902,13 @@ function openBrowser(url) {
 }
 async function runDev(options = {}) {
   const cwd = process.cwd();
-  if (!fs57.existsSync(path72.join(cwd, ".wai"))) {
+  if (!fs57.existsSync(path73.join(cwd, ".wai"))) {
     throw new WaironError(
       "No .wai/ found in the current directory. Run `wairon dev` from a wairon project root (or run `wairon init` first)."
     );
   }
   const hash = crypto24.createHash("sha256").update(cwd).digest("hex").slice(0, 16);
-  const dataDir = path72.join(os11.tmpdir(), "wairon-dev", hash);
+  const dataDir = path73.join(os11.tmpdir(), "wairon-dev", hash);
   fs57.mkdirSync(dataDir, { recursive: true });
   const port = options.port ? Number(options.port) : 8080;
   const exposurePolicy = {
@@ -51201,11 +51947,11 @@ async function runDev(options = {}) {
   logger.blank();
   logger.info("An agent edits specs; refresh the page to see the live graph. Press Ctrl+C to stop.");
   if (options.open) openBrowser(url);
-  await new Promise((resolve36) => {
+  await new Promise((resolve37) => {
     const shutdown = () => {
       logger.info("Shutting down\u2026");
       handle.close();
-      resolve36();
+      resolve37();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -51329,16 +52075,16 @@ async function runHostUnit(action, options = {}) {
 }
 async function runHostDoctor(options = {}) {
   const cfg = resolveHostConfig(options);
-  const report2 = migratePermissionModel(cfg.dataDir, options.fix === true);
-  if (report2.findings.length === 0) {
+  const report3 = migratePermissionModel(cfg.dataDir, options.fix === true);
+  if (report3.findings.length === 0) {
     logger.success("Hosted data is on the permission model \u2014 nothing to migrate.");
     return;
   }
-  logger.info(`${report2.findings.length} finding(s)${report2.applied ? " \u2014 applied" : " (dry run; re-run with --fix to apply)"}:`);
-  for (const f of report2.findings) {
+  logger.info(`${report3.findings.length} finding(s)${report3.applied ? " \u2014 applied" : " (dry run; re-run with --fix to apply)"}:`);
+  for (const f of report3.findings) {
     logger.info(`  [${f.area.padEnd(8)}] ${f.detail}`);
   }
-  if (!report2.applied) {
+  if (!report3.applied) {
     logger.warn("NOT applied. Without --fix, pre-permission-model users and tokens resolve to ZERO permissions.");
   }
 }
@@ -51559,8 +52305,8 @@ async function runHostPacks(action, options = {}) {
       }
       case "install": {
         if (!options.file) throw new WaironError("`--file <path>` (a declarative pack YAML) is required for install.");
-        const name = options.name ?? path72.basename(options.file).replace(/\.(ya?ml)$/i, "");
-        const content = fs57.readFileSync(path72.resolve(options.file), "utf8");
+        const name = options.name ?? path73.basename(options.file).replace(/\.(ya?ml)$/i, "");
+        const content = fs57.readFileSync(path73.resolve(options.file), "utf8");
         const desc = project2 ? installProjectPack(cfg, cred, project2, name, content) : installGlobalPack(cfg, cred, name, content);
         logger.success(`Installed ${scope} pack "${desc.name}" (${desc.profiles} profile(s), ${desc.languages} language(s)).`);
         if (project2) logger.info("Committed with the project \u2014 every clone and CI will enforce it.");
@@ -51647,7 +52393,7 @@ async function runHostGit(action, options = {}) {
 }
 
 // src/commands/produce.ts
-var import_inquirer4 = __toESM(require("inquirer"));
+var import_inquirer5 = __toESM(require("inquirer"));
 var import_chalk18 = __toESM(require("chalk"));
 init_logger();
 init_errors();
@@ -51664,7 +52410,7 @@ async function runProduce(target, options = {}) {
   let token = options.token || process.env[t.envKey] || null;
   if (!token) {
     if (!process.stdin.isTTY) throw new WaironError(`No ${t.label} token \u2014 pass --token or set ${t.envKey}.`);
-    const ans = await import_inquirer4.default.prompt([
+    const ans = await import_inquirer5.default.prompt([
       { type: "password", name: "token", message: `${t.label} token:`, mask: "*" }
     ]);
     token = ans.token;
@@ -51685,11 +52431,6 @@ var import_chalk19 = __toESM(require("chalk"));
 init_logger();
 init_errors();
 init_paths();
-
-// src/commands/adapters/surfaces.ts
-init_surface_portal();
-
-// src/commands/surface.ts
 init_models();
 async function runSurface(action, options = {}) {
   assertProjectInitialized();
@@ -51815,10 +52556,10 @@ function printPins(pins) {
     return;
   }
   const outcome = (o) => o === "pinned" ? import_chalk20.default.green(o) : o === "unchanged" ? import_chalk20.default.gray(o) : import_chalk20.default.yellow(o);
-  for (const pin of pins) {
-    const what = pin.digest ? ` ${pin.usedNames} used name(s), ${pin.digest.slice(0, 19)}\u2026` : "";
-    logger.info(`${import_chalk20.default.cyan(pin.alias)} \u2192 ${pin.project ?? "?"}: ${outcome(pin.outcome)}${what}${pin.detail ? ` \u2014 ${pin.detail}` : ""}`);
-    for (const ref of pin.unexported) {
+  for (const pin2 of pins) {
+    const what = pin2.digest ? ` ${pin2.usedNames} used name(s), ${pin2.digest.slice(0, 19)}\u2026` : "";
+    logger.info(`${import_chalk20.default.cyan(pin2.alias)} \u2192 ${pin2.project ?? "?"}: ${outcome(pin2.outcome)}${what}${pin2.detail ? ` \u2014 ${pin2.detail}` : ""}`);
+    for (const ref of pin2.unexported) {
       logger.info(`    unexported: "${ref.specId}" reaches "${ref.target}"${ref.member ? ` (${ref.member})` : ""} \u2014 export it from the producer's L0 to pin it`);
     }
   }
@@ -51882,7 +52623,7 @@ async function runExternals(action, aliases, options = {}) {
 
 // src/commands/remote.ts
 var fs59 = __toESM(require("fs"));
-var path74 = __toESM(require("path"));
+var path75 = __toESM(require("path"));
 var import_chalk21 = __toESM(require("chalk"));
 init_logger();
 init_errors();
@@ -51893,15 +52634,15 @@ init_mcp();
 // src/commands/remotebinding.ts
 var fs58 = __toESM(require("fs"));
 var os12 = __toESM(require("os"));
-var path73 = __toESM(require("path"));
+var path74 = __toESM(require("path"));
 init_paths();
 var BINDING_FILE = "remote.json";
 var CREDENTIALS_FILE = "credentials.json";
 function bindingPath(root) {
-  return path73.join(aiPathsAt(root).root(), BINDING_FILE);
+  return path74.join(aiPathsAt(root).root(), BINDING_FILE);
 }
 function credentialsPath() {
-  return path73.join(os12.homedir(), ".wairon", CREDENTIALS_FILE);
+  return path74.join(os12.homedir(), ".wairon", CREDENTIALS_FILE);
 }
 function normalizeInstanceUrl(url) {
   return url.trim().replace(/\/+$/, "").toLowerCase();
@@ -51915,7 +52656,7 @@ function readJson(file) {
   }
 }
 function writeJsonAtomic(file, value, mode) {
-  fs58.mkdirSync(path73.dirname(file), { recursive: true });
+  fs58.mkdirSync(path74.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
   fs58.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", mode !== void 0 ? { mode } : void 0);
   fs58.renameSync(tmp, file);
@@ -52248,7 +52989,7 @@ async function runRemote(action, options = {}) {
       };
       if (options.unit) transfer.createUnitId = options.unit;
       if (options.archive) transfer.archivePath = options.archive;
-      report(await pushTree(target, transfer));
+      report2(await pushTree(target, transfer));
       return;
     }
     case "pull": {
@@ -52257,8 +52998,8 @@ async function runRemote(action, options = {}) {
         allowPartial: options.allowPartial === true
       };
       if (options.archive) transfer.archivePath = options.archive;
-      if (options.dir) transfer.destDir = path74.resolve(options.dir);
-      report(await pullTree(target, transfer));
+      if (options.dir) transfer.destDir = path75.resolve(options.dir);
+      report2(await pullTree(target, transfer));
       return;
     }
     default:
@@ -52341,13 +53082,13 @@ function topProjectId2(selector) {
 }
 function writeArchiveIfAsked(archive, archivePath, suggestedFileName) {
   if (!archivePath) return void 0;
-  const resolved = path74.resolve(archivePath);
-  const target = fs59.existsSync(resolved) && fs59.statSync(resolved).isDirectory() ? path74.join(resolved, suggestedFileName) : resolved;
-  fs59.mkdirSync(path74.dirname(target), { recursive: true });
+  const resolved = path75.resolve(archivePath);
+  const target = fs59.existsSync(resolved) && fs59.statSync(resolved).isDirectory() ? path75.join(resolved, suggestedFileName) : resolved;
+  fs59.mkdirSync(path75.dirname(target), { recursive: true });
   fs59.writeFileSync(target, Buffer.from(archive));
   return target;
 }
-function report(outcome) {
+function report2(outcome) {
   const where = outcome.direction === "push" ? `${outcome.url} \u2192 ${outcome.projectId}` : `${outcome.projectId} \u2192 ${outcome.destDir ?? getProjectRoot()}`;
   logger.success(
     `${outcome.direction === "push" ? "Pushed" : "Pulled"} "${outcome.projectName}": ${outcome.fileCount} file(s) across ${outcome.roots.length} root(s) \u2014 ${where}`
@@ -52564,10 +53305,10 @@ async function lockCommand(opts) {
 async function validateCommand(opts) {
   const target = resolveTarget(getProjectRoot(), {});
   if (target) {
-    const report2 = await validateAttached(target, opts.subsystem);
-    const errors = report2.errors ?? [];
-    const warnings = report2.warnings ?? [];
-    const notices = report2.notices ?? [];
+    const report3 = await validateAttached(target, opts.subsystem);
+    const errors = report3.errors ?? [];
+    const warnings = report3.warnings ?? [];
+    const notices = report3.notices ?? [];
     logger.info(`Validated "${target.projectId}" on ${target.url} \u2014 ${errors.length} error(s), ${warnings.length} warning(s), ${notices.length} notice(s).`);
     for (const e of errors) logger.error(`  [${e.code}] ${e.specId ? `${e.specId}: ` : ""}${e.message}`);
     for (const w of warnings) logger.warn(`  [${w.code}] ${w.specId ? `${w.specId}: ` : ""}${w.message}`);
@@ -52607,8 +53348,8 @@ program.command("validate").description("Validate the project configuration and
 program.command("status").description("Show a hierarchical completeness graph of the SDD Spec Tree").option("--subsystem <id>", "only show status for the specified subsystem").option("--no-recursive", "do not recursively show status for subprojects").action(async (opts) => {
   await statusCommand(opts);
 });
-program.command("doctor").description("Health check: flags stale generated guides/skills, an unregistered MCP server, and spec-tree issues").option("--fix", "regenerate stale in-project guides/context/skills and register the MCP server").action(async (opts) => {
-  await runDoctor({ fix: opts.fix });
+program.command("doctor").description("Health check: flags stale generated guides/skills, an unregistered MCP server, spec-tree issues and the chaining migration still pending").option("--fix", "regenerate stale in-project guides/context/skills, register the MCP server, then apply the chaining migration once confirmed").option("--report <section>", "print one section's plan and nothing else, writing nothing (the one section: chaining); never combines with --fix").option("-y, --yes", "answer the chaining migration's confirmation (for a non-interactive --fix)").action(async (opts) => {
+  await runDoctor({ fix: opts.fix, report: opts.report, yes: opts.yes });
 });
 async function runRules() {
   await listRules3();
@@ -52761,7 +53502,7 @@ async function runAgent(action, id) {
     }
     case "customize": {
       const brief = composeAgentBrief(id);
-      const guidancePath = path75.join(AI_PATHS.root(), "agents", `${id}.md`);
+      const guidancePath = path76.join(AI_PATHS.root(), "agents", `${id}.md`);
       const relPath = `.wai/agents/${id}.md`;
       if (pathExists(guidancePath)) {
         throw new GuidanceFileExistsError(relPath);