@wairon/cli 5.1.1-dev.85 → 5.1.1-dev.86

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.85";
+    WAIRON_VERSION = "5.1.1-dev.86";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     SUPPORTED_ALIASES = ["wai"];
     SCAN_EXCLUDE_DIRS = /* @__PURE__ */ new Set([
@@ -569,6 +569,13 @@ var init_agent = __esm({
       dependencies: import_zod2.z.array(import_zod2.z.string()).default([]),
       /** Rendered implementation guidance for this agent's variant-tagged components (deep variant integration); empty when none. */
       variantGuidance: import_zod2.z.string().optional(),
+      /**
+       * A member project's delegating owner only: the ids of the member's own
+       * agents, each qualified `<alias>::<agentId>`, resolved from the member's
+       * topology at the member's own root. REFERENCES, never copies: nothing of the
+       * member's agents is rendered into this layer (one level deep, ids only).
+       */
+      delegatesTo: import_zod2.z.array(import_zod2.z.string()).optional(),
       /** Why this agent was created — the architectural reason for its existence */
       creationReason: import_zod2.z.string(),
       status: AgentStatusSchema.default("active"),
@@ -600,6 +607,13 @@ var init_agent = __esm({
       instructions: import_zod2.z.string(),
       /** Rendered variant guidance, also folded into instructions */
       variantGuidance: import_zod2.z.string().optional(),
+      /**
+       * Set only on a brief for a member's agent (an id qualified `<alias>::`): the
+       * member's directory relative to the root the brief was asked from. The
+       * brief was composed at that root, and its ownedPaths and readPaths are
+       * re-expressed under this prefix so the fence is correct from the asking root.
+       */
+      root: import_zod2.z.string().optional(),
       /**
        * The resource shape of this agent's work, and the allowance it earns.
        *
@@ -1210,7 +1224,13 @@ var init_project = __esm({
       profile: import_zod3.z.string().optional()
     });
     CompositionConfigSchema = import_zod3.z.object({
-      requirePolicies: import_zod3.z.array(PackRequirementSchema).optional()
+      requirePolicies: import_zod3.z.array(PackRequirementSchema).optional(),
+      /**
+       * Opt-in, off by default (stage 5). When true, this project's lock refuses
+       * while any DIRECT member is drifted or never approved, naming each, and
+       * writes nothing. Off: the lock proceeds and records each member's state.
+       */
+      requireApprovedMembers: import_zod3.z.boolean().optional()
     });
     ProjectConfigSchema = import_zod3.z.object({
       /**
@@ -1473,21 +1493,21 @@ function childrenOf(tokens, index) {
   }
   return out;
 }
-function locateScalar(tokens, path83) {
+function locateScalar(tokens, path82) {
   let region = tokens;
-  for (let k = 0; k < path83.length; k += 1) {
-    const segment = path83[k];
-    if (region.length === 0) return `nothing is nested at ${path83.slice(0, k).join(".")}`;
+  for (let k = 0; k < path82.length; k += 1) {
+    const segment = path82[k];
+    if (region.length === 0) return `nothing is nested at ${path82.slice(0, k).join(".")}`;
     const base = Math.min(...region.map((t) => t.col));
-    const last = k === path83.length - 1;
+    const last = k === path82.length - 1;
     let at;
     if (typeof segment === "string") {
       at = region.findIndex((t) => t.kind === "key" && t.col === base && t.name === segment);
-      if (at < 0) return `no block key "${segment}" at ${path83.slice(0, k).join(".") || "the document root"}`;
+      if (at < 0) return `no block key "${segment}" at ${path82.slice(0, k).join(".") || "the document root"}`;
       if (last) return region[at].valueStart !== void 0 ? region[at] : `"${segment}" holds no inline scalar`;
     } else {
       const items = region.map((t, i) => ({ t, i })).filter(({ t }) => t.kind === "item" && t.col === base);
-      if (segment >= items.length) return `no block sequence item ${segment} at ${path83.slice(0, k).join(".")}`;
+      if (segment >= items.length) return `no block sequence item ${segment} at ${path82.slice(0, k).join(".")}`;
       at = items[segment].i;
       if (last) {
         const value = region[at + 1];
@@ -1535,10 +1555,10 @@ function writeScalar(value, style) {
   if (style === "plain" && /^[A-Za-z0-9_][A-Za-z0-9_./-]*$/.test(value)) return value;
   return `'${value.replace(/'/g, "''")}'`;
 }
-function setAt(document, path83, value) {
+function setAt(document, path82, value) {
   let node = document;
-  for (const segment of path83.slice(0, -1)) node = node[segment];
-  node[path83[path83.length - 1]] = value;
+  for (const segment of path82.slice(0, -1)) node = node[segment];
+  node[path82[path82.length - 1]] = value;
 }
 function rewriteScalarsInText(text3, edits, root) {
   const refuse = (why) => {
@@ -1812,9 +1832,9 @@ function registryOver(store, root) {
           const next = rekeyAnchor(rename, { spec: entry.spec, at, covers });
           const base = ["rules", "conformance", "carried", g, "findings", f];
           const named2 = { code: String(entry.code), spec: entry.spec, at: at ?? "" };
-          const change = (path83, field, from, to) => {
+          const change = (path82, field, from, to) => {
             if (from === to) return;
-            edits.push({ path: [...base, ...path83], from, to });
+            edits.push({ path: [...base, ...path82], from, to });
             rekeys.push({ ...named2, field, from, to });
           };
           change(["spec"], "spec", entry.spec, next.spec);
@@ -2365,18 +2385,26 @@ var init_canonical_json = __esm({
 function inIdentityOrder(specs) {
   return specs.map((spec) => ({ spec, content: canonicalize(spec) })).sort((a, b) => compareOrdinal(a.spec.id, b.spec.id) || compareOrdinal(a.content, b.content)).map((entry) => entry.spec);
 }
-function computeStateId() {
+function digestTree(keep) {
+  const kind = (specs) => inIdentityOrder(specs.filter((s) => keep(s.id)));
   const tree = {
     system: loadSystemSpec(),
-    subsystems: inIdentityOrder(loadSubsystemSpecs()),
-    components: inIdentityOrder(loadComponentSpecs()),
-    interfaces: inIdentityOrder(loadInterfaceSpecs()),
-    implementations: inIdentityOrder(loadImplementationSpecs()),
-    types: inIdentityOrder(loadTypeSpecs())
+    subsystems: kind(loadSubsystemSpecs()),
+    components: kind(loadComponentSpecs()),
+    interfaces: kind(loadInterfaceSpecs()),
+    implementations: kind(loadImplementationSpecs()),
+    types: kind(loadTypeSpecs())
   };
   const digest2 = crypto.createHash("sha256").update(canonicalize(tree)).digest("hex");
   return { algorithm: CONTENT_ALGORITHM, digest: digest2 };
 }
+function computeStateId() {
+  return digestTree(() => true);
+}
+function computeOwnStateId() {
+  const owners = graph().owners;
+  return digestTree((id) => (owners.get(id) ?? "") === "");
+}
 function stateIdEquals(a, b) {
   return !!a && !!b && a.algorithm === b.algorithm && a.digest === b.digest;
 }
@@ -2435,12 +2463,13 @@ function withSortedMaps(record2) {
     for (const k of Object.keys(m).sort()) out[k] = m[k];
     return out;
   };
-  const specs = sorted(record2.specs);
-  const children = sorted(record2.children);
+  const { children: _legacy, ...rest } = record2;
+  const specs = sorted(rest.specs);
+  const members = sorted(rest.members);
   return {
-    ...record2,
+    ...rest,
     ...specs ? { specs } : {},
-    ...children ? { children } : {}
+    ...members ? { members } : {}
   };
 }
 var fs6, path8;
@@ -4313,12 +4342,12 @@ var init_exports = __esm({
 });
 
 // src/models/project-family.ts
-function walkMemberPath(byKey, start2, segments) {
+function walkMemberPath(byKey2, start2, segments) {
   let node = start2;
   for (const segment of segments.slice(0, -1)) {
     const next = node.aliases.get(segment);
     if (next !== void 0) {
-      const found = byKey.get(next);
+      const found = byKey2.get(next);
       if (!found) return null;
       node = found;
       continue;
@@ -4330,13 +4359,13 @@ function walkMemberPath(byKey, start2, segments) {
   return { project: node, name: segments[segments.length - 1] };
 }
 function landReference(projects, reference, from) {
-  const byKey = new Map(projects.map((p) => [p.namespace, p]));
-  const origin = byKey.get(from);
-  const root = byKey.get("");
+  const byKey2 = new Map(projects.map((p) => [p.namespace, p]));
+  const origin = byKey2.get(from);
+  const root = byKey2.get("");
   if (!reference.includes("::")) return { kind: "project", project: from, name: reference };
   const land = (form, start2, segments2) => {
     if (!start2) return { kind: "unresolved", form };
-    const walked = walkMemberPath(byKey, start2, segments2);
+    const walked = walkMemberPath(byKey2, start2, segments2);
     if (walked === "outside") return { kind: "outside", form };
     if (walked) return { kind: "project", form, project: walked.project.namespace, name: walked.name };
     return { kind: "unresolved", form };
@@ -4348,7 +4377,7 @@ function landReference(projects, reference, from) {
     while (segments[0] === "super") {
       segments.shift();
       if (!node || node.parent === void 0) return { kind: "outside", form: "super" };
-      node = byKey.get(node.parent);
+      node = byKey2.get(node.parent);
     }
     if (segments.length === 0 || !node) return { kind: "unresolved", form: "super" };
     return land("super", node, segments);
@@ -4360,11 +4389,11 @@ function landReference(projects, reference, from) {
     return land(segments.length === 2 ? "alias" : "path", origin, segments);
   }
   if (origin.subsystems.has(first)) return { kind: "project", project: from, name: segments[segments.length - 1] };
-  const fromRoot = root ? walkMemberPath(byKey, root, segments) : null;
+  const fromRoot = root ? walkMemberPath(byKey2, root, segments) : null;
   if (fromRoot && fromRoot !== "outside") return { kind: "project", form: "path", project: fromRoot.project.namespace, name: fromRoot.name };
   const byId = projects.filter((p) => p.id === first || p.namespace !== "" && p.namespace === first);
   if (byId.length === 1) {
-    const walked = walkMemberPath(byKey, byId[0], segments.slice(1));
+    const walked = walkMemberPath(byKey2, byId[0], segments.slice(1));
     if (walked === "outside") return { kind: "outside", form: "path" };
     if (walked) return { kind: "project", form: "path", project: walked.project.namespace, name: walked.name };
   }
@@ -4474,9 +4503,9 @@ function shortestPath(from, to, members, edges, rank) {
     const v = queue.shift();
     for (const w of [...edges.get(v) ?? []].filter((x) => members.has(x)).sort((a, b) => rank(a) - rank(b))) {
       if (w === to) {
-        const path83 = [w];
-        for (let at = v; at !== from; at = prev.get(at)) path83.unshift(at);
-        return path83;
+        const path82 = [w];
+        for (let at = v; at !== from; at = prev.get(at)) path82.unshift(at);
+        return path82;
       }
       if (seen.has(w)) continue;
       seen.add(w);
@@ -10863,38 +10892,102 @@ function cycleFindings(family, config) {
   }
   return out;
 }
-function approvalFinding(node, config) {
-  return runWithProjectRoot(node.directory, () => {
-    const current2 = computeGateStateId();
-    const record2 = readLockRecord();
-    if (!record2) {
-      return finding(
-        config,
-        "MEMBER_UNAPPROVED",
-        `The member ${named(node.namespace)} has never been locked: nobody has approved its design. Lock it at its own root (\`wairon lock\`).`,
-        node.namespace
-      );
-    }
-    if (record2.stateId.algorithm !== current2.algorithm || record2.stateId.digest !== current2.digest) {
-      return finding(
-        config,
-        "MEMBER_DRIFTED",
-        `The member ${named(node.namespace)} changed since it was approved on ${record2.lockedAt}: its lock no longer matches its own gate identity. Re-lock it at its own root (\`wairon lock\`).`,
-        node.namespace
-      );
-    }
-    return null;
-  });
+function approvalFinding(entry, config) {
+  if (entry.state === "never") {
+    return finding(
+      config,
+      "MEMBER_UNAPPROVED",
+      `The member ${named(entry.key)} has never been locked: nobody has approved its design. Lock it at its own root (\`wairon lock\`).`,
+      entry.key
+    );
+  }
+  if (entry.state === "drifted" && entry.upgraded) {
+    return finding(
+      config,
+      "MEMBER_DRIFTED",
+      `The member ${named(entry.key)} was approved under an earlier gate identity \u2014 the gate identity gained inputs in stage 5 (members' composition subjects, \`composition\`; code conformance moved beside the claim), which says nothing about its design. Re-lock it once at its own root (\`wairon lock\`).`,
+      entry.key
+    );
+  }
+  if (entry.state === "drifted") {
+    return finding(
+      config,
+      "MEMBER_DRIFTED",
+      `The member ${named(entry.key)} changed since it was approved: its lock no longer matches its own gate identity. Re-lock it at its own root (\`wairon lock\`).`,
+      entry.key
+    );
+  }
+  return null;
 }
 function checkMembers(family) {
   const config = configOrNull();
   const out = [...problemFindings(family, config), ...cycleFindings(family, config)];
-  for (const node of family.nodes) {
-    if (node.namespace === "") continue;
-    out.push(approvalFinding(node, config));
+  const present = new Set(family.nodes.filter((n) => n.namespace !== "").map((n) => n.namespace));
+  for (const entry of projectApprovals()) {
+    if (present.has(entry.key)) out.push(approvalFinding(entry, config));
   }
   return out.filter((f) => f !== null);
 }
+function subjectOf(record2) {
+  return `${record2.stateId.algorithm}:${record2.stateId.digest}`;
+}
+function ownApproval(node, root) {
+  return within(node.directory, { topRoot: root, narrowed: true }, () => {
+    const current2 = computeGateStateId();
+    const record2 = readLockRecord();
+    const base = {
+      key: node.namespace,
+      ...node.mountAlias !== void 0 ? { alias: node.mountAlias } : {},
+      ...node.parent !== void 0 ? { parent: node.parent } : {},
+      ...node.id !== void 0 ? { projectId: node.id } : {},
+      state: "never"
+    };
+    if (!record2) return base;
+    const matches = record2.stateId.algorithm === current2.algorithm && record2.stateId.digest === current2.digest;
+    return {
+      ...base,
+      state: matches ? "approved" : "drifted",
+      subject: subjectOf(record2),
+      ...!matches && record2.stateId.algorithm !== current2.algorithm ? { upgraded: true } : {}
+    };
+  });
+}
+function pinOf(parent, alias, subject) {
+  if (!parent) return "unpinned";
+  const recorded = parent.members ? alias in parent.members ? parent.members[alias].subject ?? "never" : void 0 : parent.children?.[alias];
+  if (recorded === void 0) return "unpinned";
+  return recorded === (subject ?? "never") ? "matches" : "moved";
+}
+function projectApprovals(depth) {
+  const family = graph();
+  const root = path14.resolve(getProjectRoot());
+  const limit = depth ?? Infinity;
+  const selected = family.nodes.filter((n) => depthOf(family, n) <= limit);
+  const directoryOf = new Map(family.nodes.map((n) => [n.namespace, n.directory]));
+  const parentRecord = (key) => {
+    const dir = directoryOf.get(key);
+    return dir === void 0 ? null : approvalRecord(dir);
+  };
+  const entries = selected.map((node) => {
+    const own = ownApproval(node, root);
+    if (node.parent === void 0 || node.mountAlias === void 0) return own;
+    return { ...own, pinned: pinOf(parentRecord(node.parent), node.mountAlias, own.subject) };
+  });
+  for (const problem of family.problems) {
+    if (problem.kind !== "member-absent" || !problem.id) continue;
+    const parentKey = problem.projects[0] ?? "";
+    const parentNode = family.nodes.find((n) => n.namespace === parentKey);
+    if (!parentNode || depthOf(family, parentNode) + 1 > limit) continue;
+    entries.push({
+      key: parentKey === "" ? problem.id : `${parentKey}::${problem.id}`,
+      alias: problem.id,
+      parent: parentKey,
+      state: "never",
+      pinned: pinOf(parentRecord(parentKey), problem.id, void 0)
+    });
+  }
+  return entries;
+}
 function requiredBy(key) {
   return key === "" ? "the family root" : `"${key}"`;
 }
@@ -11783,6 +11876,9 @@ var init_extensions = __esm({
 });
 
 // src/core/rules/types.ts
+function judgesCode(rule) {
+  return rule.judges === "code";
+}
 var BUILTIN_PROFILES, PROJECT_KINDS;
 var init_types = __esm({
   "src/core/rules/types.ts"() {
@@ -11823,21 +11919,21 @@ function buildCodeIndex(model) {
   const declarations = /* @__PURE__ */ new Map();
   const anchors = /* @__PURE__ */ new Map();
   const findingAnchors = /* @__PURE__ */ new Map();
-  const namesAt = (cache2, path83, make) => {
-    const cached = cache2.get(path83);
+  const namesAt = (cache2, path82, make) => {
+    const cached = cache2.get(path82);
     if (cached) return cached;
-    const f = facts.get(path83);
+    const f = facts.get(path82);
     if (!f) return NO_NAMES;
     const built = make(f);
-    cache2.set(path83, built);
+    cache2.set(path82, built);
     return built;
   };
   const republished = /* @__PURE__ */ new Map();
-  const republishedFrom = (path83) => {
-    const cached = republished.get(path83);
+  const republishedFrom = (path82) => {
+    const cached = republished.get(path82);
     if (cached) return cached;
-    const out = /* @__PURE__ */ new Set([path83]);
-    const queue = [path83];
+    const out = /* @__PURE__ */ new Set([path82]);
+    const queue = [path82];
     while (queue.length) {
       const from = queue.pop();
       const f = facts.get(from);
@@ -11850,7 +11946,7 @@ function buildCodeIndex(model) {
         }
       }
     }
-    republished.set(path83, out);
+    republished.set(path82, out);
     return out;
   };
   const NO_ORIGIN = /* @__PURE__ */ new Set();
@@ -11859,9 +11955,9 @@ function buildCodeIndex(model) {
     return to ? republishedFrom(to) : NO_ORIGIN;
   };
   const scopeOf2 = (site, from) => {
-    const path83 = pathKey(site.from ?? from);
-    const f = facts.get(path83);
-    return f?.status === "analyzed" && f.analysisGrade === "exact" ? { path: path83, facts: f } : void 0;
+    const path82 = pathKey(site.from ?? from);
+    const f = facts.get(path82);
+    return f?.status === "analyzed" && f.analysisGrade === "exact" ? { path: path82, facts: f } : void 0;
   };
   const originOf2 = (site, from) => {
     const resolved = scopeOf2(site, from);
@@ -11900,7 +11996,7 @@ function buildCodeIndex(model) {
     if (site.via) for (const typeName of localTypesOf(f, site.via)) widenThroughType(typeName);
     return out;
   };
-  const declarationsAt = (path83) => namesAt(declarations, pathKey(path83), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames]));
+  const declarationsAt = (path82) => namesAt(declarations, pathKey(path82), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames]));
   const forwardsOf = (start2, name) => {
     const out = [];
     const seen = /* @__PURE__ */ new Set();
@@ -11926,10 +12022,10 @@ function buildCodeIndex(model) {
   return {
     paths,
     exactPaths,
-    factsAt: (path83) => facts.get(pathKey(path83)),
+    factsAt: (path82) => facts.get(pathKey(path82)),
     declarationsAt,
-    anchorsAt: (path83) => namesAt(anchors, pathKey(path83), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames, ...f.anchoredNames])),
-    findingAnchorsAt: (path83) => namesAt(findingAnchors, pathKey(path83), (f) => new Set(f.anchoredNames)),
+    anchorsAt: (path82) => namesAt(anchors, pathKey(path82), (f) => /* @__PURE__ */ new Set([...f.declaredNames, ...f.exportedNames, ...f.anchoredNames])),
+    findingAnchorsAt: (path82) => namesAt(findingAnchors, pathKey(path82), (f) => new Set(f.anchoredNames)),
     originOf: originOf2,
     possibleOriginsOf,
     forwardsOf
@@ -11968,10 +12064,10 @@ function buildRealizationIndex(ctx) {
   return {
     paths,
     implementationsOf: (compId) => implsByComponent.get(compId) ?? NONE_IMPL,
-    implementationsAt: (path83) => implsByPath.get(pathKey(path83)) ?? NONE_IMPL,
+    implementationsAt: (path82) => implsByPath.get(pathKey(path82)) ?? NONE_IMPL,
     filesOf: (compId) => filesByComponent.get(compId) ?? NONE_PATH,
     filesIn: (subsystemId) => filesBySubsystem.get(subsystemId) ?? NONE_PATH,
-    componentsAt: (path83) => componentsByPath.get(pathKey(path83)) ?? NONE_COMP
+    componentsAt: (path82) => componentsByPath.get(pathKey(path82)) ?? NONE_COMP
   };
 }
 function buildImportGraph(index, universe) {
@@ -11983,22 +12079,22 @@ function buildImportGraph(index, universe) {
       if (to && to !== from) into.add(to);
     }
   };
-  const importsOf = (path83) => {
-    const cached = imports.get(path83);
+  const importsOf = (path82) => {
+    const cached = imports.get(path82);
     if (cached) return cached;
-    const facts = index.factsAt(path83);
+    const facts = index.factsAt(path82);
     const out = /* @__PURE__ */ new Set();
-    if (facts?.status === "analyzed") resolveAll(path83, facts.imports, out);
-    imports.set(path83, out);
+    if (facts?.status === "analyzed") resolveAll(path82, facts.imports, out);
+    imports.set(path82, out);
     return out;
   };
-  const tracesOf = (path83) => {
-    const cached = traces.get(path83);
+  const tracesOf = (path82) => {
+    const cached = traces.get(path82);
     if (cached) return cached;
-    const facts = index.factsAt(path83);
-    const out = new Set(importsOf(path83));
-    if (facts?.status === "analyzed") resolveAll(path83, facts.reexports, out);
-    traces.set(path83, out);
+    const facts = index.factsAt(path82);
+    const out = new Set(importsOf(path82));
+    if (facts?.status === "analyzed") resolveAll(path82, facts.reexports, out);
+    traces.set(path82, out);
     return out;
   };
   return {
@@ -12134,6 +12230,7 @@ var init_hierarchy_integrity = __esm({
     init_models();
     hierarchyRule = {
       name: "hierarchy-integrity",
+      judges: "design",
       description: "Every subsystem references the system, every component an existing subsystem, every interface an existing component, and every implementation an existing interface contract. Draft/design specs are reported informationally.",
       codes: [
         { code: "DRAFT_SUBSYSTEM_WARNING", defaultSeverity: "warning", summary: "Subsystem is in draft/design status" },
@@ -12213,6 +12310,7 @@ var init_reserved_id_segments = __esm({
     "use strict";
     reservedIdSegmentsRule = {
       name: "reserved-id-segments",
+      judges: "design",
       description: 'No segment of a spec id may be the reserved namespace keyword "super" \u2014 the :: grammar consumes it as a namespace hop, so a stored reference to such an id resolves to a different spec.',
       codes: [
         { code: "RESERVED_ID_SEGMENT", defaultSeverity: "error", summary: 'Id uses the reserved namespace keyword "super"' }
@@ -12253,6 +12351,7 @@ var init_local_ids = __esm({
     init_models();
     localIdsRule = {
       name: "local-ids",
+      judges: "design",
       description: "Inside one project an id names one spec, and an id without `::` is always local. Two spec files of one project declaring one key are DUPLICATE_SPEC_ID: whichever the loader kept, every reference to that key \u2014 local, or `alias::name` from another project \u2014 could mean either, so the tree has no single reading. A local id equal to one of the project's aliases (a `members` or `externals` key) is LOCAL_ID_SHADOWS_PROJECT: the grammar keeps them apart (a bare id is local, `alias::name` crosses), but a reader seeing `billing` beside `billing::invoice_portal` cannot tell a local subsystem from a member, so the shadow is made visible. It reads the project graph's owners, alias tables and duplicate-spec problems.",
       codes: [
         { code: "DUPLICATE_SPEC_ID", defaultSeverity: "error", summary: "Two spec files of one project declare the same id" },
@@ -12329,6 +12428,7 @@ var init_project_identity = __esm({
     "use strict";
     projectIdentityRule = {
       name: "project-identity",
+      judges: "design",
       description: "The bound project is keyed on its id, so the id must be declared, well-formed, stable and its own: a project that declares none answers to its display name slugified until it writes one (PROJECT_ID_DEFAULTED), a project whose name yields no id or whose declared id breaks the grammar has nothing reliable to key on (PROJECT_ID_AMBIGUOUS), and an id that differs from the one the lock approved has moved under everything that keyed on it (PROJECT_ID_CHANGED). It judges the bound project's own identity only. The family half \u2014 a member with a defaulted id (named with its alias as the id to declare), a member with no id, and two members resolving to one id \u2014 is a family check since stage 4 (family_validator.checkMembers), which reads the family root's graph.",
       codes: [
         { code: "PROJECT_ID_AMBIGUOUS", defaultSeverity: "warning", summary: "Project has no usable id: its name yields no slug, or its declared id breaks the grammar" },
@@ -12350,6 +12450,7 @@ var init_roundtrip_serialization = __esm({
     "use strict";
     roundtripRule = {
       name: "roundtrip-serialization",
+      judges: "design",
       description: "Every loaded spec must re-serialize through the exact writer pipeline (same relativization, same schema, no I/O) \u2014 validate must predict every refusal that lock's status promotion or any later save would otherwise raise mid-write.",
       codes: [
         { code: "ROUNDTRIP_SERIALIZATION", defaultSeverity: "error", summary: "Spec cannot be re-serialized through the writer schema (any save or lock would refuse it)" }
@@ -12370,6 +12471,7 @@ var init_type_declarations = __esm({
     "use strict";
     typeDeclarationsRule = {
       name: "type-declarations",
+      judges: "design",
       description: "A type owned by a subsystem must reference an existing one, and a type declaring neither fields nor methods is a placeholder that can inform neither implementers nor the ERD.",
       codes: [
         { code: "INVALID_SUBSYSTEM_REFERENCE", defaultSeverity: "error", summary: "Type references a non-existent owning subsystem" },
@@ -12411,6 +12513,7 @@ var init_field_type_references = __esm({
     init_models();
     fieldTypeReferencesRule = {
       name: "field-type-references",
+      judges: "design",
       description: "Every type identifier a type field's declared type names must resolve to a builtin or a defined entity/value-object type \u2014 the type's own generic parameters are not field references.",
       codes: [
         { code: "UNDEFINED_TYPE_REFERENCE", defaultSeverity: "error", summary: "Reference to a type that is not defined anywhere" }
@@ -12449,6 +12552,7 @@ var init_signature_type_references = __esm({
     init_models();
     signatureTypeReferencesRule = {
       name: "signature-type-references",
+      judges: "design",
       description: "Every type identifier an interface method signature names must resolve to a builtin, a generic parameter in scope on the interface or the method, or a defined entity/value-object type.",
       codes: [
         { code: "UNDEFINED_TYPE_REFERENCE", defaultSeverity: "error", summary: "Reference to a type that is not defined anywhere" }
@@ -12492,6 +12596,7 @@ var init_public_surface_binding = __esm({
     init_models();
     publicSurfaceBindingRule = {
       name: "public-surface-binding",
+      judges: "design",
       description: "Every declared publicInterface names a backing component, that component exists, and the subsystem owns it \u2014 a subsystem may only publish its own components.",
       codes: [
         { code: "PUBLIC_INTERFACE_UNBOUND", defaultSeverity: "error", summary: "Public interface with no backing component" },
@@ -12530,6 +12635,7 @@ var init_public_surface_consumers = __esm({
     init_models();
     publicSurfaceConsumersRule = {
       name: "public-surface-consumers",
+      judges: "design",
       description: "Every subsystem a published surface names as its consumer must exist in the tree. A consumers list restricts who may depend on the surface, so an id that names nothing locks the surface against a caller nobody can be \u2014 and a typo there silently locks out the caller that was meant, which the boundary rule would then report against the wrong party.",
       codes: [
         { code: "PUBLIC_INTERFACE_UNKNOWN_CONSUMER", defaultSeverity: "error", summary: "A published surface names as its consumer a subsystem the tree does not have" }
@@ -12594,6 +12700,7 @@ var init_public_surface_declared_type = __esm({
     };
     publicSurfaceDeclaredTypeRule = {
       name: "public-surface-declared-type",
+      judges: "design",
       description: "A publicInterface entry's declared type must be realizable by the stereotype of its backing component; Custom entries whose prose implies eventing must be backed by an event-capable component.",
       codes: [
         { code: "PUBLIC_INTERFACE_TYPE_MISMATCH", defaultSeverity: "error", summary: "Backing component cannot realize the declared interface type" },
@@ -12631,6 +12738,7 @@ var init_public_surface_bound_contract = __esm({
     init_models();
     publicSurfaceBoundContractRule = {
       name: "public-surface-bound-contract",
+      judges: "design",
       description: "A publicInterface entry that binds an L3 interface must bind one that exists and that belongs to the component the entry publishes.",
       codes: [
         { code: "PUBLIC_INTERFACE_INVALID_INTERFACE", defaultSeverity: "error", summary: "Bound L3 interface missing or belonging to another component" }
@@ -12662,6 +12770,7 @@ var init_export_tables = __esm({
     init_models();
     exportTablesRule = {
       name: "export-tables",
+      judges: "design",
       description: "Every level's export table must resolve the way a module resolver resolves `export \u2026 from`: one public name binds one target (EXPORT_ID_DUPLICATE when two wildcards \u2014 or two explicit entries \u2014 bind a name to different targets, or two public names share one nameKey, since a bare import could not tell them apart; the name is left out), no chain leads back to itself (EXPORT_CYCLE \u2014 an error for a named chain that never reaches a component or type, a warning for a wildcard cycle, which resolves to its union), every entry names a source and an item that exist, that the source exports and, for an own type, that the level owns \u2014 a subsystem-owned type at L1, a project-level type (no subsystem) for an L0 `{ typeDef }` without `from` \u2014 under a public name of [a-z0-9-_]+ (EXPORT_INVALID), every re-exported component can serve a boundary caller \u2014 a Portal, a gateway being a Portal variant, or an Observer for events (EXPORT_UNCONSUMABLE, at L0 and for L1 re-exports; an error since stage 4), and an L0 entry that re-exports a member's or an external's export never declares a wider audience than that export has (EXPORT_WIDENS_AUDIENCE): a re-export can narrow reach, never widen it. The rule judges the facts the export resolver recorded in the scan \u2014 for the bound root's table and every contained member's \u2014 and resolves nothing itself.",
       codes: [
         { code: "EXPORT_ID_DUPLICATE", defaultSeverity: "error", summary: "One public name bound to different targets by two wildcard re-exports or two explicit entries" },
@@ -12735,6 +12844,7 @@ var init_external_declarations = __esm({
     init_models();
     externalDeclarationsRule = {
       name: "external-declarations",
+      judges: "design",
       description: "Every external a project declares in project.yaml must be usable: its alias fits [a-z0-9-_]+ (a dotted producer id needs an explicit alias) and is not also a `members` key (one alias names one project), its producer id fits the project-id grammar, and it has something to be judged against \u2014 a project of the scan answers to the id, source.path names a directory (whose project, when it is in the scan, answers to the declared id), or the project holds a pin for the alias. A declaration that fails is reported (EXTERNAL_UNRESOLVED) with its reason, so a misspelled declaration never passes as declared. A member validated from its own root that declares its parent or a sibling is not reported when it has pinned it: the pin is what its gate judges against, and nothing is climbed to find the producer. Every name an external's or a member's `use` lists by name must be a public name the producer exports to this project \u2014 a contained member's live L0 table, an external's pin \u2014 compared by nameKey (IMPORT_UNRESOLVED, naming the closest public names; a `use` on an unpinned external is left to the pin's own EXTERNAL_CHECK_UNAVAILABLE), and must not share its nameKey with a spec of the project itself (IMPORT_SHADOWED_BY_LOCAL: the local spec wins every bare reference, so the named import can never take effect and says something false \u2014 rename one or drop the import). A `*` import shadowed by locals is silent, as a glob import is in Rust. One code, one meaning: IMPORT_UNRESOLVED is only a name the producer does not export, IMPORT_SHADOWED_BY_LOCAL only a named import a local spec hides. A malformed `use` entry is the declaration's problem (EXTERNAL_UNRESOLVED for an external, the member's for a member). The findings name no spec: externals and members live in configuration. It reads the bound root's node of the project graph, its alias-conflict problems, the members' export tables, the project's own spec ids and ctx.pinnedExternals.",
       codes: [
         { code: "EXTERNAL_UNRESOLVED", defaultSeverity: "notice", summary: "A declared external whose alias is malformed or taken by a member, whose producer id is malformed, or whose producer the family and its source.path do not provide" },
@@ -12836,6 +12946,7 @@ var init_reference_forms = __esm({
     init_models();
     referenceFormsRule = {
       name: "reference-forms",
+      judges: "design",
       description: "A cross-project reference is `alias::name` (or a bare name a `use` imports): the alias is one of the referring project's members or externals, the name a public name of that project's L0 table. The older forms still bind for one release and are reported (DEPRECATED_REFERENCE_FORM), each naming the spec, where in it, the form as written and the text to write instead (the scan's rewrite: a bare local id, or `alias::publicName`): a leading `::`, which escapes to the root of whatever checkout loads it; `super::`, which climbs the containing projects \u2014 a place in one family, not a name; a member path (`desktop::shell` written inside desktop, `waffler_core::transpiler::x` written inside transpiler), a first segment the referring project does not declare, read from the bound root; and a self-prefix \u2014 the referring project's own id as the first segment, with `::` or `.` (`registry.advisory-channel` inside registry), which stage 3's migration did not rewrite and stage 4's positional step does. Wairon's own writer emits none of them. A form with no rewrite (its target is out of reach) is reported with the reason. It reads the project graph's authored references, which the scan records before binding erases the form.",
       codes: [
         { code: "DEPRECATED_REFERENCE_FORM", defaultSeverity: "notice", summary: "A reference written with a leading ::, super:: or a member path where a local id or alias::name belongs" }
@@ -12872,6 +12983,7 @@ var init_member_declarations = __esm({
     DECLARATION_FIELDS = /* @__PURE__ */ new Set(["id", "name", "description", "parentSystem", "projectPath", "status", "createdAt", "updatedAt"]);
     memberDeclarationsRule = {
       name: "member-declarations",
+      judges: "design",
       description: "A project declares its members in project.yaml `members`; a member is not a subsystem and carries no content in its parent. The L1 form \u2014 a subsystem carrying projectPath \u2014 still loads for one release and is reported (DEPRECATED_MOUNT_FORM), naming the mount, its path, the `members` entry that replaces it, and every field it carries that `doctor --fix` will move into the member (or stop on); a mount whose alias `members` also declares is reported as ignored. It reads the project graph's nodes and their legacy mounts.",
       codes: [
         { code: "DEPRECATED_MOUNT_FORM", defaultSeverity: "notice", summary: "A member declared as an L1 subsystem carrying projectPath instead of a project.yaml `members` entry" }
@@ -12935,6 +13047,7 @@ var init_project_boundaries = __esm({
     init_models();
     projectBoundariesRule = {
       name: "project-boundaries",
+      judges: "design",
       description: "The one judge of every cross-project reference the bound project writes (decision 9 \u2014 every project is a crate of its own, reached only through its L0 exports and only as a dependency it declared). It reads each of the project's own references from the project graph \u2014 `::` forms and bare names bound through `use` imports alike \u2014 takes its resolution from resolveCrossProject, decided before any severity from the project's own files alone, and reports every outcome but resolved once, carrying the resolution: forbidden is EXTERNAL_UNDECLARED (the reference reaches a project the referrer declares neither as a member nor as an external, or names a first segment that is none of its subsystems, aliases or foreign providers); missing is EXTERNAL_NOT_EXPORTED (the producer's table \u2014 a contained member's live one, or the external's pin \u2014 has no public name covering the referrer, or not the used method, or exports the type only inside a signature's closure); an ambiguous import is IMPORT_AMBIGUOUS (two imports supply one bare name: two explicit `use` names, or two `*` with no explicit one \u2014 name it `alias::name` or narrow a `use`); unavailable is EXTERNAL_CHECK_UNAVAILABLE (no pin, an unreadable pin, a member absent on disk, or a deprecated form naming no alias \u2014 never a pass). A bare name no import supplies is not this rule's: it is the unresolved-reference finding it always was, with rule_context.importHint appended. A trustedLinks entry naming a subsystem of another project (`alias::sub`) is TRUSTED_LINK_CROSSES_PROJECT: a sanctioned fast lane stays inside one project. Stage 4 makes the three stage-2 notices errors now that the owner's gate judges them exactly; a reference is never left to a parent's verdict.",
       codes: [
         { code: "EXTERNAL_UNDECLARED", defaultSeverity: "error", summary: "A reference reaches another project the referring project declares neither as a member nor as an external, or names a first segment that is none of its subsystems, aliases or foreign providers" },
@@ -13032,6 +13145,7 @@ var init_lint_allows = __esm({
     "use strict";
     lintAllowsRule = {
       name: "lint-allows",
+      judges: "design",
       description: "Per-spec lint suppressions (lint.allow) must name real issue codes and actually suppress a finding \u2014 unknown codes and stale allows are flagged. An allow covers exactly the occurrence it names: a finding that reports a site is silenced only by an allow whose `at` is that site, a finding that reports none only by an allow that names none, and an aggregating finding only by an allow whose `covers` lists every unit it reports \u2014 a unit nobody listed is named back as new instead of inheriting a decision taken about its neighbours. So a coarse allow left on a rule that names sites, and an allow whose site the run no longer reports, are both UNUSED_LINT_ALLOW, and the finding names the sites that did fire. Allows silence warnings and notices; errors always surface.",
       codes: [
         { code: "UNKNOWN_LINT_ALLOW_CODE", defaultSeverity: "warning", summary: "lint.allow names an issue code no registered rule emits" },
@@ -13079,6 +13193,7 @@ var init_contract_symmetry = __esm({
     "use strict";
     contractSymmetryRule = {
       name: "contract-symmetry",
+      judges: "design",
       description: "Implementations mirror their contract method-for-method: every method an implementation declares is defined on the contract it realizes, and every contract method has an implementation.",
       codes: [
         { code: "UNEXPECTED_IMPLEMENTATION_METHOD", defaultSeverity: "error", summary: "Implementation method not present on the contract" },
@@ -13145,6 +13260,7 @@ var init_narrative_target_references = __esm({
     };
     narrativeTargetReferencesRule = {
       name: "narrative-target-references",
+      judges: "design",
       description: `A narrative call, dispatch or register step must name a target component, and a target method unless it dispatches; a method's declared calls name the same pair as one "<component>.<method>" reference, the spelling the conformance debt register and a lint allow name a unit with. A target this tree contains must be a collaborator the calling component declares, must carry the named method on one of its interfaces, and that method must declare every semantic guarantee the entry asserts.`,
       codes: [
         { code: "MISSING_TARGET_COMPONENT", defaultSeverity: "error", summary: "Call/register step missing targetComponent" },
@@ -13253,6 +13369,7 @@ var init_cross_tree_references = __esm({
     init_models();
     crossTreeReferencesRule = {
       name: "cross-tree-references",
+      judges: "design",
       description: `A narrative call, dispatch or register target that is not a component of this tree either leaves the project \u2014 and then its resolution (resolveCrossProject) decides: resolved is surface-reference-backing's, foreign snapshots that disagree are SURFACE_REF_AMBIGUOUS here, and every other outcome is project-boundaries' single finding \u2014 or it is a local id that names nothing, the INVALID_TARGET_COMPONENT_REFERENCE typo it always was. The CROSS_TREE_REF_UNRESOLVED warning ("only the parent project can verify it") is retired: no reference is left for a parent to judge.`,
       codes: [
         { code: "INVALID_TARGET_COMPONENT_REFERENCE", defaultSeverity: "error", summary: "Call/register step targets a non-existent component" },
@@ -13315,6 +13432,7 @@ var init_surface_reference_backing = __esm({
     "use strict";
     surfaceReferenceBackingRule = {
       name: "surface-reference-backing",
+      judges: "design",
       description: "The contract entry a narrative target in another project resolves to \u2014 a contained member's live export table, a declared external's pinned snapshot, or a foreign surface snapshot \u2014 must back what the step asks of it: the calling component declares the collaborator, the entry exposes the called method (or serves the dispatched capability), and it declares every semantic guarantee the step asserts. These are contract verdicts on a resolved reference, and each carries that resolution.",
       codes: [
         { code: "SURFACE_REF_NOT_EXPOSED", defaultSeverity: "error", summary: "Cross-tree reference resolves to a surface snapshot that does not expose the called method/capability" },
@@ -13404,6 +13522,7 @@ var init_guarantee_tokens = __esm({
     init_models();
     guaranteeTokensRule = {
       name: "guarantee-tokens",
+      judges: "design",
       description: "Every semantic-guarantee token an L3 method declares or a narrative step asserts must be a builtin guarantee or one a loaded extension pack declares in its `guarantees` list. The vocabulary is open for packs, not for typos \u2014 an undeclared token is matched by nothing and silently escapes the narrative\u2194contract consistency checks.",
       codes: [
         { code: "UNKNOWN_GUARANTEE", defaultSeverity: "warning", summary: "Guarantee token is neither builtin nor pack-declared" }
@@ -13458,6 +13577,7 @@ var init_narrative_step_config = __esm({
     init_models();
     narrativeStepConfigRule = {
       name: "narrative-step-config",
+      judges: "design",
       description: 'The step configuration of L5 narratives: every flow step (branch, switch, loop, try, parallel, jump) carries the config its type requires and no simple step carries flow config, "detach" (fire-and-forget) is legal on call/dispatch steps only, no step carries a field foreign to its type, a parallel body is covered by contiguous, ordered arms (>= 2), no two steps share a step number or a label, and every jump field targets an existing step number in the same narrative.',
       codes: [
         { code: "MALFORMED_FLOW_STEP", defaultSeverity: "error", summary: "Flow step missing required config (or flow config on a local/call step)" },
@@ -13499,6 +13619,7 @@ var init_narrative_reachability = __esm({
     init_models();
     narrativeReachabilityRule = {
       name: "narrative-reachability",
+      judges: "design",
       description: "Every step of an L5 narrative must be reachable from the first step following fall-through and jumps, and the loop/try/parallel regions it declares must nest or stay disjoint \u2014 interleaved regions map onto no structured code. Judged over the step graph, and only for a narrative whose step configuration is sound (narrative-step-config reports the rest).",
       codes: [
         { code: "UNREACHABLE_STEP", defaultSeverity: "warning", summary: "Step not reachable from the first step following fall-through and jumps" },
@@ -13588,6 +13709,7 @@ var init_narrative_jump_edges = __esm({
     init_models();
     narrativeJumpEdgesRule = {
       name: "narrative-jump-edges",
+      judges: "design",
       description: "Where an L5 narrative's jump edges land: a loop/try/parallel region is entered through its header, never into the middle of its body; a backward jump is only idiomatic as a continue to an enclosing loop header, and otherwise models repetition that belongs in a loop step; and a try body must not fall through into its own catch/finally region on the success path. Judged only for a narrative whose step configuration is sound (narrative-step-config reports the rest).",
       codes: [
         { code: "JUMP_INTO_REGION", defaultSeverity: "warning", summary: "Jump lands in the middle of a loop/try body from outside \u2014 regions are entered through their header" },
@@ -13776,6 +13898,7 @@ var init_meaningless_branches = __esm({
     init_completed_step_graph();
     meaninglessBranchesRule = {
       name: "meaningless-branches",
+      judges: "design",
       description: "A branch or switch whose arms all target the same step decides nothing: the condition is evaluated and flow continues at one place whatever it answers. A decision's targets are its explicit ones plus, where it leaves its fall-through field unset, the steps the step graph continues it at \u2014 so the classic authoring slip of pointing both arms at the next step is caught. Structure-only \u2014 a warning, lint.allow-suppressible.",
       codes: [
         { code: "MEANINGLESS_BRANCH", defaultSeverity: "warning", summary: "Branch/switch whose arms all target the same step \u2014 the decision changes nothing" }
@@ -13835,6 +13958,7 @@ var init_inescapable_cycles = __esm({
     init_completed_step_graph();
     inescapableCyclesRule = {
       name: "inescapable-cycles",
+      judges: "design",
       description: "A cycle in a narrative's step graph with no exit edge and no return or throw member never terminates, by construction: every path that enters it stays inside it forever. Read over the step graph closed by a completion step, so falling off the end of the narrative counts as leaving. Structure-only \u2014 prose conditions are never judged \u2014 and reported as a warning, lint.allow-suppressible.",
       codes: [
         { code: "INESCAPABLE_CYCLE", defaultSeverity: "warning", summary: "Step cycle with no exit edge and no return/throw member \u2014 never terminates by construction" }
@@ -13883,6 +14007,7 @@ var init_unconditional_call_cycles = __esm({
     byCodeUnit = (a, b) => a < b ? -1 : a > b ? 1 : 0;
     unconditionalCallCyclesRule = {
       name: "unconditional-call-cycles",
+      judges: "design",
       description: "A method-level call cycle across components in which every call edge is unavoidable on every entry-to-exit path of its narrative is unbounded recursion, by construction. Dispatch steps are resolved through their portal's table; register steps are never edges (a handoff defers the invocation to the runtime, so it cannot recurse). A cycle with even one guarded edge is NOT flagged, since prose conditions are never judged. Structure-only \u2014 a warning, lint.allow-suppressible, anchored on the member edge that sorts first so one allow covers the cycle.",
       codes: [
         { code: "UNCONDITIONAL_CALL_CYCLE", defaultSeverity: "warning", summary: "Cross-component call cycle in which every call edge is unavoidable \u2014 unbounded recursion by construction" }
@@ -13942,11 +14067,11 @@ var init_unconditional_call_cycles = __esm({
           const memberEdges = keys.flatMap((k) => (adjacency.get(k) ?? []).filter((e) => inScc.has(e.toKey)));
           if (memberEdges.length === 0) continue;
           const anchor = [...memberEdges].sort((a, b) => byCodeUnit(a.fromKey, b.fromKey) || byCodeUnit(a.impl.id, b.impl.id) || a.stepNumber - b.stepNumber)[0];
-          const path83 = [...keys].sort(byCodeUnit).join(" \u2192 ");
+          const path82 = [...keys].sort(byCodeUnit).join(" \u2192 ");
           ctx.addIssue(
             "warning",
             "UNCONDITIONAL_CALL_CYCLE",
-            `Call cycle with no guard: ${path83} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
+            `Call cycle with no guard: ${path82} \u2014 every call edge in this cycle is unavoidable on all paths of its narrative (e.g. step ${anchor.stepNumber} of "${anchor.methodName}" in "${anchor.impl.id}" always calls ${anchor.toLabel}). This recurses without a base case, by construction. Guard at least one edge with a branch/return before the call, or lint.allow with the termination argument.`,
             anchor.impl.id,
             memberEdges.some((e) => ctx.isImplementationDraft(e.impl))
           );
@@ -13964,6 +14089,7 @@ var init_narrative_detail = __esm({
     init_models();
     narrativeDetailRule = {
       name: "narrative-detail",
+      judges: "design",
       description: "The narrative detail dial: each method resolves to full | calls-only | intent (method override \u2192 spec default \u2192 stereotype default). full requires a narrative; intent-level methods without a narrative must specify behavior as non-trivial prose (L4 intent or L3 description) \u2014 dialing detail down never means leaving behavior unspecified. Explicit declarations are held to their promise as errors; stereotype-defaulted gaps surface as warnings. An honest lint over declarations \u2014 it never claims the narrative or the prose is CORRECT.",
       codes: [
         { code: "MISSING_NARRATIVE", defaultSeverity: "warning", summary: "Method resolved to detail: full but has no narrative (error when the level was declared explicitly)" },
@@ -14016,6 +14142,7 @@ var init_detail_sufficiency = __esm({
     DEFAULT_MAX_UNNARRATED_COMPLEXITY = 8;
     detailSufficiencyRule = {
       name: "detail-sufficiency",
+      judges: "code",
       description: "A method dialed below detail: full with no narrative may not be hiding behavior it owes a reader. A method whose realized function \u2014 in the method's own source file, else the implementation's \u2014 measures real branching (cyclomatic complexity above rules.complexity.maxUnnarratedComplexity, exact AST grade only) is reported (UNNARRATED_COMPLEXITY), and an explicit dial below a full-floor logic stereotype without a narrative is a visible, lint.allow-justifiable choice (DETAIL_BELOW_STEREOTYPE) \u2014 reported only where the measured finding did not already fire, since evidence outranks expectation. Both are honest lints over declarations: they never claim a narrative would be correct, only that the dial hides something.",
       codes: [
         { code: "UNNARRATED_COMPLEXITY", defaultSeverity: "warning", summary: "Method below detail: full with no narrative whose realized function, in the method's source file, has real branching (cyclomatic complexity over the configured threshold, exact-grade analysis only)" },
@@ -14079,6 +14206,7 @@ var init_portal_fields = __esm({
     "use strict";
     portalFieldsRule = {
       name: "portal-fields",
+      judges: "design",
       scope: "spec",
       description: "A Portal declares its portalType. Non-Portal components carry no portalType, basePath, or auth (auth is inbound transport auth \u2014 it belongs on the Portal that exposes the surface). Intrinsic to one component: no tree required.",
       codes: [
@@ -14132,6 +14260,7 @@ var init_durability_declaration = __esm({
     "use strict";
     durabilityDeclarationRule = {
       name: "durability-declaration",
+      judges: "design",
       scope: "spec",
       description: "Every Store declares its durability (MISSING_DURABILITY) and nothing but a Store may declare one (DURABILITY_ON_NON_STORE). Intrinsic to one component: no tree required. The round-trip consequences of the declaration are enforced by durability-round-trip.",
       codes: [
@@ -14176,6 +14305,7 @@ var init_logic_declaration = __esm({
     init_models();
     logicDeclarationRule = {
       name: "logic-declaration",
+      judges: "design",
       scope: "spec",
       description: "Only an Orchestrator may declare a dependencyClass (DEPENDENCY_CLASS_ON_NON_ORCHESTRATOR); what the class allows is judged by logic-dependency-class. Intrinsic to one component: no tree required.",
       codes: [
@@ -14207,6 +14337,7 @@ var init_retired_stereotypes = __esm({
     init_models();
     retiredStereotypesRule = {
       name: "retired-stereotypes",
+      judges: "design",
       scope: "spec",
       description: "A component typed with a retired stereotype is an error until it is migrated (STEREOTYPE_RETIRED). A Specialist becomes an Orchestrator with the dependencyClass its dependencies give it, which `wairon doctor --fix` applies. A Gateway becomes the Portal it owns, with the gateway variant: its other members are depended on rather than owned, its consumers depend on that Portal, and the Gateway spec is deleted, steps the finding lists for the author. Intrinsic to one component: no tree required.",
       codes: [
@@ -14256,6 +14387,7 @@ var init_portal_endpoints = __esm({
     };
     portalsRule = {
       name: "portal-endpoints",
+      judges: "design",
       description: "A Portal binds every interface method to a concrete endpoint of the transport its portalType expects.",
       codes: [
         { code: "MISSING_ENDPOINT", defaultSeverity: "error", summary: "Portal method without a wire endpoint binding" },
@@ -14302,6 +14434,7 @@ var init_non_portal_endpoints = __esm({
     "use strict";
     nonPortalEndpointsRule = {
       name: "non-portal-endpoints",
+      judges: "design",
       description: "Only a Portal may carry endpoints: a method on a non-Portal component's interface that declares one is publishing a block that is not the system's boundary as if it were.",
       codes: [
         { code: "ARCHITECTURE_VIOLATION_NON_PORTAL_ENDPOINT", defaultSeverity: "error", summary: "Non-Portal component method declaring an endpoint" }
@@ -14337,6 +14470,7 @@ var init_portal_call_auth = __esm({
     "use strict";
     portalCallAuthRule = {
       name: "portal-call-auth",
+      judges: "design",
       description: "Hardens authenticated cross-service calls. An OUTBOUND narrative `call` into ANOTHER component's Portal whose auth is not `none` must (a) be made by an Adapter \u2014 the only block that does external I/O \u2014 and (b) declare the credential source it presents via the step's `auth.from`. Absence of a source warns PORTAL_AUTH_UNMET; a non-Adapter presenter warns AUTH_PRESENTER_NOT_ADAPTER. The actual secret is never stored in the spec. Dispatch steps (a portal's OWN inbound routing) and self-calls are not cross-service calls and are excluded.",
       codes: [
         { code: "PORTAL_AUTH_UNMET", defaultSeverity: "warning", summary: "A narrative call into another component's authed Portal does not declare where its credential loads from" },
@@ -14388,6 +14522,7 @@ var init_auth_source_wiring = __esm({
     COMPONENT_REF_PREFIX = "component:";
     authSourceWiringRule = {
       name: "auth-source-wiring",
+      judges: "design",
       description: "Resolves the credential source a narrative call presents to an authenticated Portal. When the step's `auth.from` is a modeled reference (`component:<id>`) it must name a component that exists (UNKNOWN_AUTH_SOURCE), that can hold or load a secret \u2014 an Adapter or a Store (AUTH_SOURCE_NOT_PROVIDER) \u2014 and that the presenting component depends on or owns (AUTH_SOURCE_UNWIRED). Opaque sources (env:/config:/vault:/free note) are design notes and are never resolved; a missing source is portal-call-auth's finding.",
       codes: [
         { code: "UNKNOWN_AUTH_SOURCE", defaultSeverity: "warning", summary: "auth.from references a component: source that does not exist" },
@@ -14460,6 +14595,7 @@ var init_subsystem_boundary_dependencies = __esm({
     init_models();
     subsystemBoundaryDepsRule = {
       name: "subsystem-boundary-dependencies",
+      judges: "design",
       description: "Judges every dependsOn edge that leaves its own subsystem, and every one that resolves nowhere. Across subsystems the shape is client Adapter \u2192 published remote Portal, OR a direct in-process edge licensed by a trustedLink declared on the SOURCE subsystem (the published-Portal target requirement applies either way). A published surface may also name the subsystems it serves (a publicInterfaces entry's consumers): a component every one of whose entries names consumers may be depended on only from those subsystems. An edge into another project is judged on the contract entry it resolves to (resolveSurfaceRef \u2014 a contained member's live table, a declared external's pin, or a foreign snapshot): the same Adapter requirement applies to it, and foreign snapshots of several providers that disagree make it SURFACE_REF_AMBIGUOUS. An edge into another project that does not resolve is reported once, by project-boundaries, with its resolution \u2014 never here, and never as the retired CROSS_TREE_REF_UNRESOLVED warning. A bare id that names nothing is INVALID_DEPENDENCY_REFERENCE. Boundary rules are never relaxed by a pack profile.",
       codes: [
         { code: "INVALID_DEPENDENCY_REFERENCE", defaultSeverity: "error", summary: "dependsOn names a non-existent component" },
@@ -14588,6 +14724,7 @@ var init_logic_dependency_class = __esm({
     init_stereotype_terms();
     logicDependencyClassRule = {
       name: "logic-dependency-class",
+      judges: "design",
       description: "Bounds an Orchestrator's dependencies by the dependencyClass it declares: pure logic depends only on pure Orchestrators; read logic also on read Orchestrators, Repositories, Indexes and Adapters; an Orchestrator that declares no class is a workflow and may depend on anything the rest of the matrix allows. Whether read logic calls a WRITE method on one of those is judged only once facade methods carry effect tags.",
       codes: [
         { code: "DEPENDENCY_CLASS_VIOLATION", defaultSeverity: "error", summary: "Orchestrator depending on a component its dependencyClass does not allow: pure logic depends only on pure Orchestrators; read logic also on read Orchestrators, Repositories, Indexes and Adapters" }
@@ -14652,6 +14789,7 @@ var init_data_block_dependencies = __esm({
     init_stereotype_terms();
     dataBlockDepsRule = {
       name: "data-block-dependencies",
+      judges: "design",
       description: "Keeps the data layer facing down. A Store may depend only on another Store, a backend Adapter or pure logic \u2014 Registries and Indexes depend on the Store, never the reverse. A Registry is the write path to its Store and may depend on that Store, a backend Adapter, or the pure logic that validates the write. An Index is a read projection and a Query a computed read, each over its Store through a backend Adapter where one serves it; as an exceptional case an Index may project another Index of the same Repository, never in a cycle. An Adapter is a sink toward the system: it may use pure logic, but never a Store or any other Orchestrator.",
       codes: [
         { code: "ARCHITECTURE_VIOLATION_STORE_DEP", defaultSeverity: "error", summary: "Store depending on anything but another Store, a backend Adapter or pure logic" },
@@ -14728,6 +14866,7 @@ var init_entrypoint_dependencies = __esm({
     init_stereotype_terms();
     entrypointDepsRule = {
       name: "entrypoint-dependencies",
+      judges: "design",
       description: "Judges the edges at the system's entry points and its process layer. Portals and Observers are top-level entry points and subscribers, so nothing may depend on them \u2014 and that is the edge's one finding, which is why no other matrix rule judges it. Downward, a Portal dispatches to Orchestrators and may READ through Indexes and Repository facades but never reaches Store/Registry/Query or an Adapter, while an Observer forwards to one Orchestrator or Supervisor over a message-bus Adapter. A View stays a passive presenter. A Supervisor reaches data only through workflows, and a component depending on a live Actor must also depend on a Supervisor that supervises it.",
       codes: [
         { code: "ARCHITECTURE_VIOLATION_PORTAL_DEP", defaultSeverity: "error", summary: "Component depending on a Portal/Observer" },
@@ -14811,6 +14950,7 @@ var init_portal_write_shortcut = __esm({
     "use strict";
     portalWriteShortcutRule = {
       name: "portal-write-shortcut",
+      judges: "design",
       description: "A Portal narrative call step or dispatch-table binding that reaches a write-effect method on a Repository or Index directly is the write shortcut: the Portal\u2192data-facade edge is licensed for reads only, and a write routes through an Orchestrator that owns the workflow. A dispatch step reaches its server only through a table binding, so judging every binding judges each dispatch step that takes it, once, where the route is declared. Methods that carry no effect tag are not judged.",
       codes: [
         { code: "PORTAL_WRITE_SHORTCUT", defaultSeverity: "error", summary: "Portal narrative call or dispatch-table binding reaches a write-effect method on a Repository/Index directly \u2014 reads may shortcut, writes route through an Orchestrator (judged on effect-tagged facade methods; untagged methods are not yet judged)" }
@@ -14868,6 +15008,7 @@ var init_pattern_membership = __esm({
     init_models();
     patternMembershipRule = {
       name: "pattern-membership",
+      judges: "design",
       description: "Only patterns (Repository/FeatureComponent/RouterComponent) own member blocks, and every pattern owns at least one. Each claim must name a component that exists and is itself a building block \u2014 patterns compose at the subsystem (L1) level, never by owning one another \u2014 and a block has exactly one owner, the first pattern to claim it.",
       codes: [
         { code: "EMPTY_PATTERN", defaultSeverity: "error", summary: "Pattern with no owned member blocks" },
@@ -14924,6 +15065,7 @@ var init_pattern_containment = __esm({
     REPOSITORY_MEMBERS = /* @__PURE__ */ new Set(["Store", "Registry", "Index", "Query", "Adapter"]);
     patternContainmentRule = {
       name: "pattern-containment",
+      judges: "design",
       description: "Holds each pattern to the containment its definition prescribes. A Repository may own only Store, Registry, Index, Query and (optionally) Adapter, judged member by member. A FeatureComponent owns exactly one Orchestrator (the logic side) and one or more Views (its faces \u2014 list, detail, form \u2014 sharing the one logic component), and nothing else. A RouterComponent owns exactly one Portal as its facade and at least one other child to route to. A counting pattern that still owns a retired member is not judged until that member is migrated: its counts change with the migration, and STEREOTYPE_RETIRED is the one finding.",
       codes: [
         { code: "REPOSITORY_CONTAINMENT", defaultSeverity: "error", summary: "Repository owning a non Store/Registry/Index/Query/Adapter member" },
@@ -14990,6 +15132,7 @@ var init_unowned_blocks = __esm({
     "use strict";
     unownedBlocksRule = {
       name: "unowned-blocks",
+      judges: "design",
       description: `Judges the data blocks no pattern owns. A Store may stand alone deliberately \u2014 the sanctioned lightweight form for genuinely simple state, acknowledged with a lint.allow \u2014 while the recommended shape stays a Repository; what must never happen is folding the state into a consuming component, where no spec, diagram or conformance check can see it again. A Registry standing alone with no Store to write to is either mistyped (the "file-backed Registry" idiom, a fused persistent store that belongs typed Store) or orphaned. A Query has no standalone form at all: it computes reads over its own Repository's Store.`,
       codes: [
         { code: "UNOWNED_STORE", defaultSeverity: "warning", summary: "Store not owned by any pattern \u2014 recommended shape is a Repository; a deliberate standalone Store needs a lint.allow" },
@@ -15042,6 +15185,7 @@ var init_member_visibility = __esm({
     init_models();
     memberVisibilityRule = {
       name: "member-visibility",
+      judges: "design",
       description: "A component may depend on a block within its own group (it is the owning pattern, or a sibling member of the same pattern), on any pattern facade, or on a standalone block \u2014 never on a block privately owned by ANOTHER pattern, which must be reached through that pattern's facade. A retired depending component is skipped, as everywhere in this family.",
       codes: [
         { code: "VISIBILITY_VIOLATION", defaultSeverity: "error", summary: "Dependency on a block privately owned by another pattern" }
@@ -15070,6 +15214,7 @@ var init_facade_forwarding = __esm({
     "use strict";
     facadeForwardingRule = {
       name: "facade-forwarding",
+      judges: "design",
       description: "A Repository facade method with an authored narrative must be pure 1:1 forwarding: exactly one call step, targeting one of the pattern's owned members. Anything else is logic living on the facade \u2014 move it into a member block, or acknowledge a deliberate exception via lint.allow.",
       codes: [
         { code: "FACADE_FORWARDING", defaultSeverity: "warning", summary: "Pattern facade narrative is not a single call to an owned member" }
@@ -15118,6 +15263,7 @@ var init_profile_registration = __esm({
     PROJECT_KINDS2 = new Set(PROJECT_KINDS);
     profileRegistrationRule = {
       name: "profile-registration",
+      judges: "design",
       description: "Every profile name in play \u2014 the project's own projectType and each subsystem's declared profile \u2014 must be a built-in profile, a composite project kind, or one a loaded extension pack registers. An unregistered name is flagged rather than guessed at: no doctrine is governing it.",
       codes: [
         { code: "UNKNOWN_PROFILE", defaultSeverity: "warning", summary: "Profile name is neither built-in nor registered by an extension pack" }
@@ -15155,6 +15301,7 @@ var init_profile_stereotype_fencing = __esm({
     FRONTEND_LIKE = /* @__PURE__ */ new Set(["frontend-reactive", "frontend-controller"]);
     profileStereotypeFencingRule = {
       name: "profile-stereotype-fencing",
+      judges: "design",
       description: "The built-in profile families fence which stereotypes may run under them: View/FeatureComponent/RouterComponent only in a frontend-like profile; Actor/Supervisor forbidden in plc-cyclic, whose logic runs single-threaded inside one execution scan cycle; Actor/Supervisor in a frontend-like profile warned. A pack profile opts in by declaring its family; an unregistered profile is neutral, with no doctrine to guess.",
       codes: [
         { code: "FRONTEND_STEREOTYPE_IN_BACKEND", defaultSeverity: "error", summary: "Frontend stereotype in a backend-oriented subsystem" },
@@ -15214,6 +15361,7 @@ var init_pack_profile_stereotypes = __esm({
     "use strict";
     packProfileStereotypesRule = {
       name: "pack-profile-stereotypes",
+      judges: "design",
       description: "A pack-registered profile carries its own stereotype doctrine on top of the built-in family fencing: the stereotypes it lists as forbidden are errors and the ones it discourages are warnings, each reported with the reason the pack states for it.",
       codes: [
         { code: "PROFILE_FORBIDDEN_STEREOTYPE", defaultSeverity: "error", summary: "Stereotype forbidden by the governing pack-defined profile" },
@@ -15260,6 +15408,7 @@ var init_pattern_references = __esm({
     "use strict";
     patternReferencesRule = {
       name: "pattern-references",
+      judges: "design",
       description: "Every component pattern reference resolves to a reusable pattern declared by a loaded extension pack (UNKNOWN_PATTERN_REF); a pinned version with no matching pack pattern is warned (PATTERN_VERSION_MISMATCH). Pattern constraint enforcement itself is delegated to the declaring pack's rules.",
       codes: [
         { code: "UNKNOWN_PATTERN_REF", defaultSeverity: "warning", summary: "Component references a pattern no loaded pack declares" },
@@ -15310,6 +15459,7 @@ var init_component_variants = __esm({
     "use strict";
     variantReferencesRule = {
       name: "component-variants",
+      judges: "design",
       description: "A component's variant resolves to a declared registry variant (UNKNOWN_VARIANT), and the component's stereotype equals the variant's declared base (VARIANT_BASE_MISMATCH). A variant is a base-anchored specialization (a kind of the base stereotype), not a cross-cutting attribute \u2014 those stay method guarantees.",
       codes: [
         { code: "UNKNOWN_VARIANT", defaultSeverity: "warning", summary: "Component references a variant no registry declares" },
@@ -15381,6 +15531,7 @@ var init_assertion_forbidden_edges = __esm({
     init_declared_assertion();
     assertionForbiddenEdgesRule = {
       name: "assertion-forbidden-edges",
+      judges: "design",
       description: "Evaluates the `forbid-edge` assertions loaded packs declare: for every component matching the assertion's from-selector, every dependsOn/owns id whose target matches the to-selector is reported. Findings carry the pack's namespaced code (<PACK>_<CODE>) and its stated reason; severity is the pack's declaration (project sddRuleSeverity still wins, and error downgrades to warning in draft context). The codes are the packs' own, so no fixed code list applies.",
       // Static codes are unknown here — packs bring their own. The validator
       // gathers every loaded assertion's fullCode into knownIssueCodes.
@@ -15452,6 +15603,7 @@ var init_assertion_required_fields = __esm({
     init_declared_assertion();
     assertionRequiredFieldsRule = {
       name: "assertion-required-fields",
+      judges: "design",
       description: "Evaluates the `require-field` assertions loaded packs declare: at the assertion's level (component / interface / implementation), every spec whose owning component matches the on-selector must declare the named field \u2014 a top-level spec field or an `ext.*` path \u2014 and, when the assertion states a closed value set, hold one of those values. Findings carry the pack's namespaced code (<PACK>_<CODE>) and its stated reason; severity is the pack's declaration (project sddRuleSeverity still wins, and error downgrades to warning in draft context). The codes are the packs' own, so no fixed code list applies.",
       // Static codes are unknown here — packs bring their own. The validator
       // gathers every loaded assertion's fullCode into knownIssueCodes.
@@ -15516,6 +15668,7 @@ var init_assertion_endpoint_shapes = __esm({
     init_declared_assertion();
     assertionEndpointShapesRule = {
       name: "assertion-endpoint-shapes",
+      judges: "design",
       description: "Evaluates the `endpoint-shape` assertions loaded packs declare: every endpoint bound on a contract whose component matches the on-selector must use an allowed transport and bind an address (path / topic / command / pipe / channel) matching the assertion's anchored pattern. Findings carry the pack's namespaced code (<PACK>_<CODE>) and its stated reason; severity is the pack's declaration (project sddRuleSeverity still wins, and error downgrades to warning in draft context). The codes are the packs' own, so no fixed code list applies.",
       // Static codes are unknown here — packs bring their own. The validator
       // gathers every loaded assertion's fullCode into knownIssueCodes.
@@ -15547,6 +15700,7 @@ var init_pack_resolution = __esm({
     "use strict";
     packResolutionRule = {
       name: "pack-resolution",
+      judges: "design",
       description: "Every pack a project declares must resolve \u2014 from a committed bundle under .wai/packs/, or from this wairon install's pack store \u2014 and must be the content it claims. An unresolvable selection is an error reported under the code that names the remedy: PACK_NOT_INSTALLED (absent entirely), PACK_VERSION_UNSATISFIED (installed, but no version satisfies the pin), or PACK_INTEGRITY_MISMATCH (resolved content does not match the pinned integrity digest, recomputed from the files rather than read from metadata, on whichever path won). Those never downgrade to warnings: a project whose declared doctrine is missing or altered is misconfigured, and a gate running without it must not look clean. PACK_STORE_DRIFT is the one warning \u2014 a committed bundle and the store hold different content for the same name@version; the bundle applies, so the store copy is silently ignored and that deserves saying.",
       codes: [
         { code: "PACK_NOT_INSTALLED", defaultSeverity: "error", summary: "A declared pack is neither bundled nor installed in the pack store" },
@@ -15570,6 +15724,7 @@ var init_pack_reproducibility = __esm({
     "use strict";
     reproducibilityRule = {
       name: "pack-reproducibility",
+      judges: "design",
       description: "Under rules.enforceReproducibility (default true), every by-name pack selection must be reproducible elsewhere: pinned to an exact version (ideally with an integrity digest) or bundled into the repository. A floating selection resolves against whatever the local machine happens to have installed, so a clone or CI can validate the same tree against a different rule set (UNPINNED_PACK_SELECTION). A selection that records no fetchable source cannot be obtained by CI at all (PACK_SOURCE_UNFETCHABLE).",
       codes: [
         { code: "UNPINNED_PACK_SELECTION", defaultSeverity: "warning", summary: "Pack selection floats to the latest installed version instead of pinning one" },
@@ -15607,6 +15762,7 @@ var init_pack_requirements = __esm({
     init_project();
     packRequirementsRule = {
       name: "pack-requirements",
+      judges: "design",
       description: "Every requirement in the bound project's own composition.requirePolicies must be readable: a pack name and a semver range that parses (pack_requirement.rangeProblem). One that does not is POLICY_REQUIREMENT_INVALID, quoting the range and the unreadable token \u2014 an error on the requiring project's own gate, because the requirement is its own configuration and the family run cannot judge a member against it. It judges only the syntax: whether members adopt the requirement is the family run's question (family_validator.adoption), and nothing here reads a parent's requirements.",
       codes: [
         { code: "POLICY_REQUIREMENT_INVALID", defaultSeverity: "error", summary: "A project's composition.requirePolicies names a pack range that does not parse" }
@@ -15634,6 +15790,7 @@ var init_dependency_cycles = __esm({
     "use strict";
     cyclesRule = {
       name: "dependency-cycles",
+      judges: "design",
       description: "The component dependsOn graph must be a DAG; the first cycle through a component in the run's scope is reported with its full path.",
       codes: [
         { code: "CIRCULAR_DEPENDENCY", defaultSeverity: "error", summary: "Circular dependency between components" }
@@ -15684,6 +15841,7 @@ var init_dispatch_table_bindings = __esm({
     "use strict";
     dispatchTableBindingsRule = {
       name: "dispatch-table-bindings",
+      judges: "design",
       description: "A dispatch table belongs to a Portal, binds each capability once, and binds it to an existing component.method inside the portal's own subsystem (the portal dispatches inward) that the portal declares under dependsOn or owns \u2014 the table is a real runtime invocation path.",
       codes: [
         { code: "DISPATCH_ON_NON_PORTAL", defaultSeverity: "error", summary: "Dispatch table declared on a component that is not a Portal" },
@@ -15769,6 +15927,7 @@ var init_dispatch_step_routing = __esm({
     "use strict";
     dispatchStepRoutingRule = {
       name: "dispatch-step-routing",
+      judges: "design",
       description: "A dispatch narrative step must name the capability it routes and route it through a Portal whose dispatch table actually serves that capability; a guarantee the step asserts must be declared by the contract method the capability resolves to.",
       codes: [
         { code: "MALFORMED_DISPATCH_STEP", defaultSeverity: "error", summary: "Dispatch step missing its capability (targetComponent presence is narrative-target-references' finding)" },
@@ -15846,6 +16005,7 @@ var init_lifecycle_entrypoints = __esm({
     init_models();
     lifecycleRule = {
       name: "lifecycle-entrypoints",
+      judges: "design",
       description: "Declared subsystem lifecycle entrypoints (init/shutdown flows) must name an existing component and a method on one of its interfaces \u2014 they are reachability roots, so a dangling entrypoint would silently detach every flow rooted in it.",
       codes: [
         { code: "INVALID_LIFECYCLE_ENTRYPOINT", defaultSeverity: "error", summary: "Lifecycle entrypoint names a missing component or method" },
@@ -15892,8 +16052,8 @@ var init_lifecycle_entrypoints = __esm({
 });
 
 // src/core/rules/wiring/portal-mounts.ts
-function liesUnder(path83, prefix) {
-  return path83 === prefix || path83.startsWith(prefix + "/");
+function liesUnder(path82, prefix) {
+  return path82 === prefix || path82.startsWith(prefix + "/");
 }
 var portalMountsRule;
 var init_portal_mounts = __esm({
@@ -15901,6 +16061,7 @@ var init_portal_mounts = __esm({
     "use strict";
     portalMountsRule = {
       name: "portal-mounts",
+      judges: "design",
       description: "Which listener serves which portal: a portal's routes are its methods' endpoint bindings, but nothing said which listener hands it its requests, so a portal no listener serves was unreachable without anyone noticing, and the call that mounts one crossed a boundary no contract described. A listener Portal declares its mounts \u2014 each a portal, the path prefixes routed to it, and optionally the router entry it calls \u2014 and this rule checks them against the tree: a mount must name a Portal, every HTTP endpoint of a mounted portal must lie under one of its prefixes, and every portal with HTTP endpoints must be mounted by some listener unless it is one. A path lies under a prefix when it equals it or continues it past a slash, so `/` covers only the root. Whether the named entry is really exported is the code's question, and export-conformance asks it.",
       codes: [
         {
@@ -16087,6 +16248,7 @@ var init_unused_detection = __esm({
     init_narrative_graph_projector();
     reachabilityRule = {
       name: "unused-detection",
+      judges: "design",
       description: "Walks the narrative execution graph (call steps, register handoffs, dispatch-table routing, lifecycle flows) from every entrypoint (Portal/Observer/published component/lifecycle entrypoint/invokedBy-declared method) and flags components and methods no execution chain reaches. An interface method declaring invokedBy (a real caller outside the modeled graph) seeds the walk, so its narrative propagates reachability; a declaration the INTERNAL walk (without those seeds) already reaches is stale and is reported.",
       codes: [
         { code: "UNUSED_COMPONENT", defaultSeverity: "warning", summary: "Component never reached by any narrative call chain" },
@@ -16178,6 +16340,7 @@ var init_invoked_by_description = __esm({
     init_models();
     invokedByDescriptionRule = {
       name: "invoked-by-description",
+      judges: "design",
       description: 'An invokedBy declaration names a caller outside the modeled graph and silences unused-detection for its method, so the claim must stay reviewable: its "caller" prose is held to the intent floor (missing or placeholder-thin prose is reported), stating WHO invokes the method and when.',
       codes: [
         { code: "INVOKED_BY_UNDESCRIBED", defaultSeverity: "warning", summary: "invokedBy declaration whose caller prose is missing or placeholder-thin" }
@@ -16212,6 +16375,7 @@ var init_unused_types = __esm({
     init_models();
     unusedTypesRule = {
       name: "unused-types",
+      judges: "design",
       description: "Flags types no field of any type, no interface method signature and no other type's method signature references. References are matched through the type-reference grammar (generic arguments, collections, qualified ids), and the declaring type's own generic parameters are left out \u2014 a type parameter is not a reference to a type. A type named only by its OWN methods stays unused, the way a function that only calls itself is.",
       codes: [
         { code: "UNUSED_TYPE", defaultSeverity: "warning", summary: "Type never referenced by fields, signatures or type methods" }
@@ -16278,6 +16442,7 @@ var init_durability_round_trip = __esm({
     init_narrative_graph_projector();
     durabilityRule = {
       name: "durability-round-trip",
+      judges: "design",
       description: "A durable Store (persisted RAM projection) must carry effect-tagged contract methods, and its writes require a hydration read-back reachable from a lifecycle init entrypoint. read-through is exempt (every read IS the read-back), as are ram-projection (rebuilt not restored) and cache (evictable, loss-safe). The flagship semantic check is opt-out by declaration, never silently absent \u2014 the declaration itself is enforced by durability-declaration.",
       codes: [
         { code: "MISSING_EFFECT_TAG", defaultSeverity: "warning", summary: "Durable Store contract method lacks an effect: read | write tag" },
@@ -16340,6 +16505,7 @@ var init_untyped_seams = __esm({
     BARE_SEAM_TYPES = /* @__PURE__ */ new Set(["json", "any", "unknown", "object"]);
     untypedSeamRule = {
       name: "untyped-seams",
+      judges: "design",
       description: "Methods on a subsystem's published components (its public surface) should not take or return bare Json/any/unknown/object, judged through each method's type references so a prose signature is judged like structured params: cross-subsystem contracts are the swap seam and must be typed. Generic-dispatch portals carry per-capability types via their dispatch table instead.",
       codes: [
         { code: "UNTYPED_SEAM", defaultSeverity: "warning", summary: "Bare Json/any/unknown/object parameter or return crossing a subsystem public surface" }
@@ -16403,6 +16569,7 @@ var init_prose_claims = __esm({
     QUOTED_SPAN = /"[^"]*"|“[^”]*”|`[^`]*`|(?<![\p{L}\p{N}])['‘](?:[^'‘’]|(?<=[\p{L}\p{N}])['’](?=[\p{L}\p{N}]))*['’](?![\p{L}\p{N}])/gu;
     proseClaimRule = {
       name: "prose-claims",
+      judges: "design",
       description: 'Flags durability/side-effect claims that exist only in prose: a local step description or an intent paragraph claiming persistence ("persisted", "persistence", "survives restart", "registered into") on a logic component whose narrative has no call, register or dispatch edge to any data-layer component (Store/Registry/Index/Adapter/Repository). Text inside quotes or backticks names a value or quotes a message and claims nothing. Data-layer components are exempt \u2014 they ARE the persistence.',
       codes: [
         { code: "UNREALIZED_CLAIM", defaultSeverity: "warning", summary: "Durability/side-effect claim in prose with no matching structural edge" }
@@ -16467,6 +16634,7 @@ var init_unique_invariant_ids = __esm({
     init_models();
     uniqueInvariantIdsRule = {
       name: "unique-invariant-ids",
+      judges: "design",
       description: `An entity's declared invariant ids must be unique within the entity: a narrative step asserts an invariant by "<type-id>.<invariant-id>", so a repeated id makes one assertion stand for two properties and satisfying either silences both.`,
       codes: [
         { code: "DUPLICATE_INVARIANT_ID", defaultSeverity: "error", summary: "An entity declares two invariants with the same id" }
@@ -16571,6 +16739,7 @@ var init_invariant_backing = __esm({
     init_invariant_ref();
     invariantBackingRule = {
       name: "invariant-backing",
+      judges: "design",
       description: 'The invariant registry: entities may declare domain invariants (type.invariants), anchored through their componentClass. Every write-effect contract method of the owning component must carry a narrative step asserting each invariant (step.assertsInvariants: "<type-id>.<invariant-id>") \u2014 the same declared-and-backed shape as semantic guarantees. This is an HONEST lint over declarations: a green run means every write path visibly claims the invariant, never that the narrative or code actually enforces it. An invariant with no resolvable owner or no declared write path is unanchored, and nothing further is claimed about it.',
       codes: [
         { code: "INVARIANT_UNANCHORED", defaultSeverity: "warning", summary: "An entity declares invariants but has no componentClass, its componentClass does not resolve, or the owning component declares no write-effect contract methods" },
@@ -16636,6 +16805,7 @@ var init_invariant_references = __esm({
     init_invariant_ref();
     invariantReferencesRule = {
       name: "invariant-references",
+      judges: "design",
       description: "Every invariant a narrative step asserts (step.assertsInvariants) must resolve to a declared entity invariant: the reference splits at its last dot into a type reference and an invariant id, and some entity matching that type reference must declare that id. A reference nothing declares is an error \u2014 the step claims a property that exists nowhere.",
       codes: [
         { code: "UNKNOWN_INVARIANT_REF", defaultSeverity: "error", summary: "A narrative step asserts an invariant that no entity declares" }
@@ -16702,6 +16872,7 @@ var init_event_topology = __esm({
     "use strict";
     eventTopologyRule = {
       name: "event-topology",
+      judges: "design",
       description: "Bipartite completeness of the declared pub/sub graph: every topic a component emits (emits declarations, MessageBus publish endpoints) must have at least one subscriber (subscribesTo declarations, MessageBus subscribe endpoints), and every subscription must have at least one source. Pairing is by exact topic name, and a topic is reported once per component however many declarations bind it there. Trees that declare no event edges see nothing \u2014 the rule costs request/response systems zero noise. Warnings + lint.allow: a topic produced for (or consumed from) an EXTERNAL system is a legitimate, declarable exception.",
       codes: [
         { code: "UNCONSUMED_TOPIC", defaultSeverity: "warning", summary: "Topic is emitted but nothing in the tree subscribes to it" },
@@ -16746,6 +16917,7 @@ var init_source_file_linkage = __esm({
     quoteList = (names) => names.map((n) => `"${n}"`).join(", ");
     sourceFileLinkageRule = {
       name: "source-file-linkage",
+      judges: "code",
       description: "Code\u2194spec Level 1: every source file an implementation names \u2014 its own sourcePath and each method's \u2014 must resolve to a real, readable file inside the project root, and an implementation that names no file at all, or leaves a contract method without one, is linked to no code. A file that escapes the root, is missing or cannot be analyzed is reported once and blocks only the methods realized in it. A run in which TypeScript/JavaScript files were analyzed below exact grade reports that once (CONFORMANCE_DEGRADED), since dependency conformance then skips them. Implementations under chained subsystems (projectPath) validate standalone in their own project run and are skipped here.",
       codes: [
         { code: "MISSING_SOURCE_PATH", defaultSeverity: "warning", summary: "An implementation names no source file at all, or a contract method is left without one \u2014 structural conformance cannot link it to code" },
@@ -16863,6 +17035,7 @@ var init_method_realization = __esm({
     init_models();
     methodRealizationRule = {
       name: "method-realization",
+      judges: "code",
       description: "Code\u2194spec Level 1: every L3 contract method must be realized in its own source file (the method's sourcePath, else the implementation's) at its conformance tier \u2014 declared | anchored | off; Portals default to anchored, everything else to declared, and a per-method `symbol` maps an intent-language name onto the code name. A method realized by a DECLARATION owes a function BODY as well: at exact grade one must be reachable under the symbol, here or through the imports and republications this file forwards it by, so a signature, an ambient or interface declaration or a plain value binding stops reading as an implementation (METHOD_BODY_NOT_FOUND). Findings carry the analysis grade (exact AST | pattern table | generic scan) so weaker analysis is visible. Methods whose file escapes the root, is missing or could not be analyzed are left to source-file-linkage, and implementations under chained subsystems (projectPath) validate standalone in their own project run.",
       codes: [
         { code: "UNREALIZED_METHOD", defaultSeverity: "warning", summary: "An L3 contract method has no anchor in its own source file (the method's sourcePath, else the implementation's) at the required conformance tier" },
@@ -16930,6 +17103,7 @@ var init_finding_realization = __esm({
     init_models();
     findingRealizationRule = {
       name: "finding-realization",
+      judges: "code",
       description: "Code\u2194spec Level 1: every finding code an L3 contract method declares must be anchored in the method's own source file (the method's sourcePath, else the implementation's) \u2014 as a string literal or, at exact grade, a property-access name, so a code reported through a constants object counts. Below exact grade any identifier or word counts, and the grade rides on the finding. Respects the conformance dial (off skips), leaves unresolvable files to source-file-linkage, and skips implementations under chained subsystems (projectPath), which validate standalone in their own project run.",
       codes: [
         { code: "UNREALIZED_FINDING", defaultSeverity: "warning", summary: "A finding code a contract method declares appears in the method's source file neither as a string literal nor as a property-access name (below exact grade, any identifier counts)" }
@@ -17062,6 +17236,7 @@ var init_call_conformance = __esm({
     claimNoun = (implMethod) => implMethod.narrative.length ? "narrative call step(s)" : "declared call(s)";
     callConformanceRule = {
       name: "call-conformance",
+      judges: "code",
       description: "Code\u2194spec Level 3: the CLAIMED call \u2194 realized call relation, judged both ways against the method's own source file (its sourcePath, else the implementation's), at exact analysis grade only. A method claims a call two ways and they face one check: a narrative `call` step, and an entry of the declared `calls` a narrative-less method reaches its collaborators through. They assert the same thing, and the step number is no part of the claim \u2014 this check never reads order, so it is only how a finding points at one. Forward: every claim must be realized by a call whose callee RESOLVES TO one of the target method's own source files \u2014 the target's contract name or a per-method `symbol` override, closed transitively over the named helpers the realized function calls, and resolved against every file the call CAN have reached: a `this.<field>.<method>()` receiver followed through the field's DECLARED TYPE, a `new Class(...).<method>()` receiver through the module its CLASS NAME came from, and a plain `<name>.<method>()` receiver through the type the file ANNOTATES that name with \u2014 a parameter's, or an annotated variable's, which is how a module that wires its collaborators as closures writes every one of its calls. A matching call whose origin a pure model cannot resolve is reported apart as CALL_ORIGIN_UNRESOLVED, which NAMES the shape it could not follow and asks for nothing \u2014 a coverage hole in the reader, reported for the reason CONFORMANCE_DEGRADED is: a silently degraded gate is worse than a degraded one. A finding names a landing only from the PROVEN tier so that widening what a call reached can accept a claim but never accuse one, and a target that names no file of its own falls back to name membership. Converse: a call that resolves to a modelled method of ANOTHER component in the SAME file crosses a component boundary while looking local, so the method must claim it \u2014 in a step or in `calls` (UNDECLARED_COLOCATED_CALL) \u2014 judged on the proven tier alone, and a same-file private helper is no modelled method and is never reported. A method that claims nothing at all is judged in neither direction: what it leaves unsaid is UNUSED_*'s subject. Order, arguments and conditions stay unverified, dispatch steps (runtime-table routed) are no claim about a call site, a malformed declared reference is MALFORMED_DECLARED_CALL's finding and names no target here, the conformance dial (off) skips, and weaker analysis grades never guess.",
       codes: [
         { code: "CALL_STEP_UNREALIZED", defaultSeverity: "warning", summary: "Narrative call step or declared call realized by no call that resolves to the target method's own source file \u2014 the call is absent, or it lands in another module", carryable: true },
@@ -17194,6 +17369,7 @@ var init_hidden_state = __esm({
     isStatelessLogic = (component) => isLogic(component) && !holdsState(component);
     hiddenStateRule = {
       name: "hidden-state",
+      judges: "code",
       description: "The fields-vs-Store criterion, statically approximated: module-scope mutable bindings (let/var) in a source file mapped EXCLUSIVELY to logic that holds no state (a component whose type isLogic() and not holdsState(): an Orchestrator, or a Specialist until it is retired) are flagged as hidden held state. A component maps every file its implementations and their methods name. State a logic component keeps for itself is invisible to the spec, the canvas, and every persistence rule: promote it to a Store (durability: cache for loss-safe memo state), or lint.allow with the reason it is genuinely wiring or ephemeral. Supervisor and Actor files may hold runtime state. Exact analysis grade only; files also mapped to data or boundary components are exempt (N:1 collapse); const-bound container mutation is beyond this check and the finding says so.",
       codes: [
         { code: "HIDDEN_STATE", defaultSeverity: "warning", summary: "Module-scope mutable binding in a file mapped only to stateless logic (Orchestrators) \u2014 held state hiding outside a Store, Supervisor or Actor" }
@@ -17221,11 +17397,11 @@ var init_hidden_state = __esm({
             byPath.set(key, list2);
           }
         }
-        for (const path83 of code.exactPaths) {
-          const facts = code.factsAt(path83);
+        for (const path82 of code.exactPaths) {
+          const facts = code.factsAt(path82);
           const bindings = facts.topLevelMutableBindings ?? [];
           if (bindings.length === 0) continue;
-          const mapped = byPath.get(path83) ?? [];
+          const mapped = byPath.get(path82) ?? [];
           if (mapped.length === 0) continue;
           if (!mapped.every((m) => isStatelessLogic(m.component))) continue;
           const anchor = [...mapped].sort((a, b) => a.impl.id.localeCompare(b.impl.id))[0];
@@ -17251,6 +17427,7 @@ var init_dependency_conformance = __esm({
     init_models();
     dependencyConformanceRule = {
       name: "dependency-conformance",
+      judges: "code",
       description: "Code\u2194spec Level 2: runtime import edges between component-mapped source files (a component maps to every file its implementations and their methods name) must be justified by declared relations \u2014 a direct dependsOn/owns pair, a shared component, membership in a depended-on pattern, or (across subsystems) a declared edge to the target subsystem's published surface (UNDECLARED_DEPENDENCY). Conversely, a declared dependsOn/owns edge between components realized in different files should be visible as an import between any file of the source and any file of the target (UNREALIZED_DEPENDENCY \u2014 DI indirection can defeat this, hence warning). Only exact-grade analyzed files participate; type-only imports are exempt; chained subprojects validate standalone.",
       codes: [
         { code: "UNDECLARED_DEPENDENCY", defaultSeverity: "warning", summary: "A runtime import between component-mapped files has no declared dependsOn/owns (or published-surface) justification" },
@@ -17298,7 +17475,7 @@ var init_dependency_conformance = __esm({
           }
           return false;
         };
-        const draftAt = (path83) => realization.implementationsAt(path83).some((impl) => ctx.isImplementationDraft(impl));
+        const draftAt = (path82) => realization.implementationsAt(path82).some((impl) => ctx.isImplementationDraft(impl));
         for (const fromPath of mappedPaths) {
           const fromComponents = realization.componentsAt(fromPath);
           for (const toPath of graph2.importsOf(fromPath)) {
@@ -17363,6 +17540,7 @@ var init_portal_imports = __esm({
     "use strict";
     portalImportsRule = {
       name: "portal-imports",
+      judges: "code",
       description: "A runtime import that crosses a subsystem boundary must land on a file that realizes one of the target subsystem's PUBLISHED components \u2014 its portal file. dependency-conformance asks whether the hop is declared; this asks where it lands. An import that reaches past the portal into a concrete module can use anything that module exports, published or not, so the portal stops being the boundary and names no contract ever promised leak across it \u2014 which is how a surface grows that nobody designed. In-process it is cosmetic at runtime; it is not cosmetic for the contract. Only exact-grade component-mapped files participate; type-only imports are exempt; chained subprojects validate standalone.",
       codes: [
         {
@@ -17389,7 +17567,7 @@ var init_portal_imports = __esm({
           }
           return files;
         };
-        const draftAt = (path83) => realization.implementationsAt(path83).some((impl) => ctx.isImplementationDraft(impl));
+        const draftAt = (path82) => realization.implementationsAt(path82).some((impl) => ctx.isImplementationDraft(impl));
         for (const fromPath of mappedPaths) {
           const fromSubsystems = new Set(realization.componentsAt(fromPath).map((c) => c.subsystem));
           for (const toPath of graph2.importsOf(fromPath)) {
@@ -17423,6 +17601,7 @@ var init_integration_sim_declaration = __esm({
     "use strict";
     integrationSimDeclarationRule = {
       name: "integration-sim-declaration",
+      judges: "code",
       description: "Once a subsystem has adopted integration sims (its first declared L4 simPath), every OTHER complete, non-leaf implementation of that subsystem must declare one too: its unit suite proves contract shape against mocks, not that the wired components run together. A leaf component's unit suite IS its sim, and a subsystem that has adopted nothing is never flooded.",
       codes: [
         { code: "MISSING_INTEGRATION_SIM", defaultSeverity: "warning", summary: "Complete non-leaf implementation in a sim-adopting subsystem declares no simPath" }
@@ -17466,6 +17645,7 @@ var init_integration_sim_file = __esm({
     init_models();
     integrationSimFileRule = {
       name: "integration-sim-file",
+      judges: "code",
       description: "A declared L4 simPath must resolve to a readable, committed file inside the project root \u2014 the integration harness is a re-runnable file, not a claim. Execution stays CI's job.",
       codes: [
         { code: "SIM_FILE_MISSING", defaultSeverity: "warning", summary: "Declared simPath resolves to no file inside the project root" }
@@ -17502,6 +17682,7 @@ var init_integration_sim_wiring = __esm({
     init_models();
     integrationSimWiringRule = {
       name: "integration-sim-wiring",
+      judges: "code",
       description: "A committed integration harness's import graph \u2014 closed transitively over the analyzed module set, exact grade only \u2014 must reach at least one of the component's own source modules (its implementation's or a method's) and at least one source module of each direct dependsOn/owns component (technology-boundary dependencies exempt: their contract-faithful fakes are sanctioned). Execution is CI's job \u2014 this proves wiring, never that the sim passes.",
       codes: [
         { code: "UNWIRED_INTEGRATION_SIM", defaultSeverity: "warning", summary: "Sim file does not import the real modules it claims to wire" }
@@ -17566,6 +17747,7 @@ var init_integration_sim_coverage = __esm({
     init_models();
     integrationSimCoverageRule = {
       name: "integration-sim-coverage",
+      judges: "code",
       description: "Once a committed integration harness carries sim:<component-id>. anchors, that component claims path coverage: every narrated method's happy path and every labeled throw step needs its exact sim:<component>.<method>[:<label>] string-literal anchor. Anchors prove the path is NAMED \u2014 assertion quality and execution stay CI's job.",
       codes: [
         { code: "SIM_PATH_UNCOVERED", defaultSeverity: "warning", summary: "A narrative path has no sim:<component>.<method>[:<label>] anchor in the component's coverage-opted harness" }
@@ -17646,6 +17828,7 @@ var init_type_realization = __esm({
     };
     typeRealizationRule = {
       name: "type-realization",
+      judges: "code",
       description: "Code\u2194spec Level 1 for the data model: a type that names a sourcePath is claiming code, so every file it names \u2014 its own and each method's \u2014 must resolve to a real, readable file inside the project root, its file must PUBLISH its declaration (an exported name at exact grade, the declaration tier below it, under its `symbol` when the code-level name differs from the type's name \u2014 and a pure re-export barrel publishes nothing of its own, so a claim on one is never realized), and each of its pure methods must appear in its own file (the method's sourcePath, else the type's) at the declaration tier, under the method's `symbol`, else the method's name. A type that names no sourcePath claims nothing and is never reported. Findings carry the analysis grade (exact AST | pattern table | generic scan) so weaker analysis is visible, a file that escapes the root, is missing or could not be analyzed is reported once and blocks only what it would have realized, and types under chained subsystems (projectPath) validate standalone in their own project run.",
       codes: [
         { code: "UNREALIZED_TYPE", defaultSeverity: "warning", summary: "A type names a sourcePath but its declaration is nowhere in that file \u2014 the claim points at code that does not hold it" },
@@ -17721,6 +17904,7 @@ var init_type_shape = __esm({
     init_models();
     typeShapeRule = {
       name: "type-shape",
+      judges: "code",
       description: "Code-to-contract for the DATA: a type spec's `fields` are compared, name by name, against the shape its `sourcePath` actually declares. `typeRealization` asks whether a type EXISTS in code; nothing asked whether it is the shape the spec claims, so a type spec could describe two fields of a six-field record \u2014 and call the two that are optional required \u2014 straight through a lock and a CI gate, while the ERD, the agent briefs and every implementer read it as truth. That is the worst of the code-to-spec gaps, because a wrong signature eventually breaks at a call site and a type spec that lies is only ever read by humans and agents. Two origins answer at exact grade: a DECLARED shape, whose members the file lists, and a DERIVED one, an alias followed one hop to the object literal its schema is built from, where the keys are the members. A shape that extends another is judged on what it shows and never on what it omits, since its inherited members are not in this file to count.",
       codes: [
         {
@@ -17861,6 +18045,7 @@ var init_param_conformance = __esm({
     init_models();
     paramConformanceRule = {
       name: "param-conformance",
+      judges: "code",
       description: "Code-to-contract for the SIGNATURE, the last of the three readings a spec-driven gate never made: a contract declares `params`, and nothing ever compared them to the parameters of the function that realizes the method. A contract could promise an argument the code does not take, take one the contract never mentions \u2014 including a secret \u2014 or name the same argument two different things, and the brief handed to an implementer would carry the contract's version. Parameters are matched by POSITION against the tail of the realization's list, and the declared type is what tells a rename from a dropped argument: `seed(config: HostConfig)` realized as `bootstrapInstance(cfg: HostConfig)` is one parameter under two names, which anything matching on names alone reads as a parameter the code lost. What a realization takes BEFORE the contract's own parameters is wiring, and it is declared on the implementation as `injectedParams` rather than inferred, because an inferred prefix cannot be told from a renamed first argument. A method the named file only CALLS is left to `methodRealization`, which already reports that the body is not here.",
       codes: [
         {
@@ -17975,8 +18160,8 @@ var init_param_conformance = __esm({
 });
 
 // src/core/rules/conformance/route-coverage.ts
-function liesUnder2(path83, prefix) {
-  return path83 === prefix || path83.startsWith(prefix + "/");
+function liesUnder2(path82, prefix) {
+  return path82 === prefix || path82.startsWith(prefix + "/");
 }
 function normalizeSegment(segment) {
   return /^\{.+\}$/.test(segment) || segment.startsWith(":") ? "*" : segment;
@@ -18002,6 +18187,7 @@ var init_route_coverage = __esm({
     init_models();
     routeCoverageRule = {
       name: "route-coverage",
+      judges: "code",
       description: "Code-to-contract for the ROUTES: does every route a router actually answers have a contract endpoint, and does every contract endpoint have a route that answers it? A portal's endpoints are what its contract promises; the router is what the code serves; nothing compared the two, so a route with no contract \u2014 including a write \u2014 could run for months without a single rule noticing. The listener's mount names the router function (its `via`), and the routes are read out of that function's guards; the path segment the router never checks is the one the mount's prefix guarantees. One idiom is read \u2014 a method comparison with comparisons on the path's split segments \u2014 and a mounted router that yields no route in it is reported as unread, never passed: a check that cannot see a router must say so rather than stay quiet.",
       codes: [
         {
@@ -18111,6 +18297,7 @@ var init_unclaimed_source = __esm({
     init_models();
     unclaimedSourceRule = {
       name: "unclaimed-source",
+      judges: "code",
       description: "Code\u2194spec Level 1, asked the other way round: every source file under the project's declared source roots must be named by some spec \u2014 an implementation's sourcePath, a method's, a simPath, or a type's \u2014 or be carried in the frozen `rules.conformance.unclaimed` list. A pure re-export barrel declares nothing of its own and only republishes other modules, so it has no code to claim and is exempt (exact grade only: a weaker grade cannot tell a barrel from a file it failed to parse). Declaring no source roots leaves the check silent, which is what makes it opt-in; the unclaimed list is a one-way debt register, so an entry the walk no longer finds unclaimed must be deleted and the list can only shrink.",
       codes: [
         { code: "UNCLAIMED_SOURCE_FILE", defaultSeverity: "warning", summary: "A source file under a declared source root that no spec names and the frozen unclaimed list does not carry \u2014 code nobody designed" },
@@ -18165,6 +18352,7 @@ var init_export_conformance = __esm({
     NOTHING_PROMISED = /* @__PURE__ */ new Set();
     exportConformanceRule = {
       name: "export-conformance",
+      judges: "code",
       description: "Code-to-contract for the SURFACE: does this file publish anything the components it realizes never promised, that another component then takes? The rest of the conformance set reads contract-to-code \u2014 it asks whether the code holds what a spec claims \u2014 so a file could export whatever it liked under a component's name and nothing looked. That is one half of the same hole as a contract promising a parameter it never passes. A method's `exportedVia` names the export a consumer imports to REACH it \u2014 the value that composes it, which `symbol` cannot name because `symbol` names the function inside \u2014 and a listener's mount names the router entry it calls to hand a portal its requests; both are declared publication, and a declared handle the file does not actually export is itself a finding, so naming one can never become a free-text suppression. Both questions are asked only of a file read at exact grade, and a taker counts only when its own import specifier resolves to the file it is accused of taking from: below that nothing separates an export from a mention, or a shared word from a shared module.",
       codes: [
         {
@@ -18329,6 +18517,7 @@ var init_carried_debt = __esm({
     "use strict";
     carriedDebtRule = {
       name: "carried-debt",
+      judges: "code",
       description: "The conformance debt register (`rules.conformance.carried`) holds the code\u2194spec findings this tree carries as declared, classified debt \u2014 `unclaimed`'s one-way shape, for findings about code a spec does name. It is not a second lint.allow: an allow says a finding is wrong here by design, an entry here says the finding is right and unpaid, and each entry states which of the three kinds it is (drift: spec and code disagree; undecided: the fix waits on a modelling decision nobody has taken; unreadable: the analysis cannot follow the shape the code is written in) and why. Only a code a rule declares CARRYABLE may appear, and naming any other is an error, so the register can never widen into general-purpose suppression. An entry carries a finding only when it lists EVERY unit that finding reports, so an aggregating finding cannot grow behind it; an entry that matched nothing, that duplicates another, that names a spec the tree does not hold, or that lists a unit no longer reported is STALE_CARRIED_FINDING, so the register only shrinks. The audit is silent in a run that could not have fired the findings at all: one that built no code model, the specs outside a scoped run, and a code the project switched off. Nothing can check a reason for TRUTH \u2014 a stale entry is one that stopped applying, never one that still applies for a reason that has become false \u2014 so a reason group may declare its own classification provisional (`revisit`: what would settle it), and every run counts those findings beside the kind totals.",
       codes: [
         { code: "UNCARRYABLE_FINDING", defaultSeverity: "error", summary: "The conformance debt register names an issue code no rule emits, or one no rule declares carryable \u2014 the register holds measured code\u2194spec debt, never a design rule somebody wants quiet" },
@@ -18446,6 +18635,7 @@ var init_method_cohesion = __esm({
     "use strict";
     methodCohesionRule = {
       name: "method-cohesion",
+      judges: "design",
       description: "An Orchestrator's methods share collaborators; when they split into groups that call no component in common, the component holds more than one responsibility. Reported only where two or more groups each hold two or more methods, so a single specialized method is not a finding \u2014 and never on a pure forwarder, whose every narrated method is a single hand-off and whose responsibility therefore lives in what it forwards to.",
       codes: [
         { code: "INCOHESIVE_METHODS", defaultSeverity: "warning", summary: "Orchestrator's methods form two or more groups of two or more that share no called component" }
@@ -18498,6 +18688,7 @@ var init_coupling_health = __esm({
     DEFAULT_GOD_COMPONENT_THRESHOLD = 8;
     couplingRule = {
       name: "coupling-health",
+      judges: "design",
       description: "Two subsystems depending on each other is a real architectural commitment (deployment affinity, backpressure, scaling coupling). It is allowed but must be acknowledged with a trustedLinks declaration on either side, stating the reason (e.g. a latency fast lane that bypasses the bus). A trustedLink on the SOURCE subsystem additionally licenses its direct edges into the peer without the client-Adapter shim; the published-Portal target requirement stays either way. Also flags components whose dependsOn fan-out suggests a god component.",
       codes: [
         { code: "MUTUAL_SUBSYSTEM_DEPENDENCY", defaultSeverity: "warning", summary: "Subsystems depend on each other without a declared trusted link" },
@@ -18633,6 +18824,7 @@ var init_signature_language_builtins = __esm({
     };
     signatureLanguageBuiltinsRule = {
       name: "signature-language-builtins",
+      judges: "design",
       description: "Contracts must speak the declared target language: builtin types that unambiguously belong to another language family are flagged in method signatures (e.g. `usize` in a TypeScript system, `Promise` in a Rust one). Set targetLanguage on the system (L0) or override per subsystem (L1).",
       codes: [
         { code: "LANGUAGE_FOREIGN_BUILTIN", defaultSeverity: "warning", summary: "Signature uses a builtin from a different language family" }
@@ -18714,6 +18906,7 @@ var init_narrative_language_constructs = __esm({
     };
     narrativeLanguageConstructsRule = {
       name: "narrative-language-constructs",
+      judges: "design",
       description: "Narratives must describe flows the declared target language can express: steps using constructs the language lacks (e.g. exceptions in Rust/Go, do-while in Python) are flagged with the idiomatic alternative. Set targetLanguage on the system (L0) or override per subsystem (L1).",
       codes: [
         { code: "LANGUAGE_FOREIGN_FLOW", defaultSeverity: "warning", summary: "Narrative flow step uses a construct the target language does not have" }
@@ -18763,6 +18956,7 @@ var init_technology_binding = __esm({
     DATA_LAYER = /* @__PURE__ */ new Set(["Adapter", "Store", "Registry", "Index"]);
     technologyBindingRule = {
       name: "technology-binding",
+      judges: "design",
       description: "Only data-layer stereotypes (Adapter/Store/Registry/Index) should bind a technology directly: an L4 that declares `technologies` on logic has no swap seam. No hardcoded vendor lists \u2014 only declared tokens are policed, so the rule never fires on a tree that doesn't opt in.",
       codes: [
         { code: "TECH_ON_LOGIC_COMPONENT", defaultSeverity: "warning", summary: "Technology bound by a non-data-layer stereotype" }
@@ -18827,6 +19021,7 @@ var init_technology_boundaries = __esm({
     init_models();
     technologyRule = {
       name: "technology-boundaries",
+      judges: "design",
       description: "Technology stays behind its owning boundary: an L4 that declares `technologies` (e.g. [mysql]) makes its component's ownership tree the technology's home. References outside that tree are leakage, and L3 contract identifiers must stay intent-language \u2014 the contract is the swap seam, so the vendor name is wrong even on the owning component's own interface.",
       codes: [
         { code: "TECH_LEAKAGE", defaultSeverity: "warning", summary: "Technology referenced outside its owning boundary" },
@@ -19039,6 +19234,7 @@ var init_naming_conventions = __esm({
     isAllUppercase = (s) => /^[A-Z0-9_]+$/.test(s);
     namingRule = {
       name: "naming-conventions",
+      judges: "design",
       description: "Enforces naming conventions (casing styles or regular expressions) for subsystem, component, interface, type (differentiating entities and value-objects), method, variables/parameters, fields, and constants names/IDs, plus stereotype-specific naming patterns.",
       codes: [
         { code: "NAMING_CONVENTION_VIOLATION", defaultSeverity: "warning", summary: "Item name or ID does not match the configured casing pattern or regex" },
@@ -19205,6 +19401,7 @@ var init_complexity_and_metadata = __esm({
     init_method_cohesion();
     complexityRule = {
       name: "complexity-and-metadata",
+      judges: "design",
       description: "Enforces metadata documentation completeness (checking if descriptions are missing or too short) and structural complexity caps (limits on methods per interface, parameters per method, dependencies per component, and components per subsystem) configured globally or in architectural profiles. A narrative's own length and shape are judged by narrative-complexity.",
       codes: [
         { code: "MISSING_DESCRIPTION", defaultSeverity: "warning", summary: "Required description field is missing or empty" },
@@ -19353,6 +19550,7 @@ var init_narrative_complexity = __esm({
     DEFAULT_MAX_STEPS = 25;
     narrativeComplexityRule = {
       name: "narrative-complexity",
+      judges: "design",
       description: "Judges a narrative on two independent axes: the cognitive band its shape earns, from branching and nesting, and the number of steps it lists. A flat list of registrations is long but linear; a deeply nested guard is short but severe. Each axis warns above its configured level, and reports an error only where a maximum is configured.",
       codes: [
         { code: "NARRATIVE_COMPLEXITY", defaultSeverity: "warning", summary: "Narrative's cognitive band is above the configured level (default: above moderate)" },
@@ -19473,6 +19671,7 @@ var init_naming_discipline = __esm({
     MIN_CONCEPT_LENGTH = 4;
     namingDisciplineRule = {
       name: "naming-discipline",
+      judges: "design",
       description: "A name says what a thing is and never repeats itself: a component's head noun names its own block, generic role words say nothing, a method does not repeat its component's head noun, and a component with one method is not merely that method's name. Adapters and Portals are exempt from the repetition check, because a forwarder's method mirrors the command or route it exposes.",
       codes: [
         { code: "MISLEADING_BLOCK_WORD", defaultSeverity: "warning", summary: "Component's head noun names a building block that is not its componentType" },
@@ -21736,8 +21935,25 @@ var init_pack_impact2 = __esm({
 });
 
 // src/core/rules/gate-identity.ts
+function ruleIdentities(rules) {
+  return byKey(
+    rules.map((r) => ({
+      name: r.name,
+      codes: byKey(r.codes.map((c) => ({ code: c.code, severity: c.defaultSeverity })), (c) => c.code)
+    })),
+    (r) => r.name
+  );
+}
+function codeJudgedCodes(builtinRules) {
+  return new Set(builtinRules.filter(judgesCode).flatMap((r) => r.codes.map((c) => c.code)));
+}
+function designRulesConfig(rules, codeCodes) {
+  if (!rules) return null;
+  const { conformance: _codeTuning, sddRuleSeverity, ...rest } = rules;
+  const severities = Object.fromEntries(Object.entries(sddRuleSeverity ?? {}).filter(([code]) => !codeCodes.has(code)));
+  return { ...rest, ...Object.keys(severities).length > 0 ? { sddRuleSeverity: severities } : {} };
+}
 function doctrineIdentity(doctrine2, builtinRules, gate) {
-  const byKey = (items, key) => [...items].sort((a, b) => compareOrdinal(key(a), key(b)));
   return {
     /**
      * The BUILTIN rule set, by identity rather than by wairon version.
@@ -21754,20 +21970,23 @@ function doctrineIdentity(doctrine2, builtinRules, gate) {
      * in the wairon version would catch it at the cost of churning every lock on
      * every release — the trade this projection deliberately declines.
      */
-    builtinRules: byKey(
-      builtinRules.map((r) => ({
-        name: r.name,
-        codes: byKey(r.codes.map((c) => ({ code: c.code, severity: c.defaultSeverity })), (c) => c.code)
-      })),
-      (r) => r.name
-    ),
+    //
+    // Only the rules that judge DESIGN: a code analyzer that gains a code or a
+    // stricter check must never stale an approval (analyzer-upgrade-keeps-approval).
+    builtinRules: ruleIdentities(builtinRules.filter((r) => !judgesCode(r))),
     /**
-     * Which profile GOVERNS, and the project's own rule tuning. Both decide
-     * verdicts — a projectType switch changes the doctrine family outright, and
-     * `rules` carries severity overrides, complexity caps, and designDepth.
+     * Which profile GOVERNS, and the project's own design rule tuning. Both
+     * decide verdicts — a projectType switch changes the doctrine family
+     * outright, and `rules` carries design severity overrides, complexity caps
+     * and designDepth. Its code-conformance tuning is the analyzer's.
      */
     projectType: gate.projectType ?? null,
-    rulesConfig: gate.rules ?? null,
+    rulesConfig: designRulesConfig(gate.rules, codeJudgedCodes(builtinRules)),
+    /**
+     * What the project requires of the projects it contains (stage 5): a
+     * changed requirement stales the requiring project's lock.
+     */
+    composition: gate.composition ?? null,
     packs: byKey(
       doctrine2.packs.map((p) => ({ name: p.name, version: p.version ?? null, scope: p.scope })),
       (p) => `${p.name}@${p.version ?? ""}#${p.scope}`
@@ -21788,22 +22007,35 @@ function doctrineIdentity(doctrine2, builtinRules, gate) {
     )
   };
 }
-function computeGateIdentity(content, doctrine2, builtinRules, inputs, gate) {
+function computeGateIdentity(content, doctrine2, builtinRules, inputs, gate, members) {
   const payload = {
     content: content.digest,
     doctrine: doctrineIdentity(doctrine2, builtinRules, gate),
-    inputs: [...inputs].sort()
+    inputs: [...inputs].sort(compareOrdinal),
+    members: byKey(Object.entries(members), ([alias]) => alias).map(([alias, subject]) => ({ alias, subject }))
   };
   const digest2 = crypto3.createHash("sha256").update(canonicalize(payload)).digest("hex");
   return { algorithm: GATE_ALGORITHM, digest: digest2 };
 }
-var crypto3, GATE_ALGORITHM;
+function analyzerDigest(builtinRules, gate) {
+  const codeCodes = codeJudgedCodes(builtinRules);
+  const overrides = Object.entries(gate.rules?.sddRuleSeverity ?? {}).filter(([code]) => codeCodes.has(code));
+  const payload = {
+    rules: ruleIdentities(builtinRules.filter(judgesCode)),
+    conformance: gate.rules?.conformance ?? null,
+    severities: byKey(overrides, ([code]) => code).map(([code, severity]) => ({ code, severity }))
+  };
+  return crypto3.createHash("sha256").update(canonicalize(payload)).digest("hex");
+}
+var crypto3, GATE_ALGORITHM, byKey;
 var init_gate_identity = __esm({
   "src/core/rules/gate-identity.ts"() {
     "use strict";
     crypto3 = __toESM(require("crypto"));
     init_canonical_json();
-    GATE_ALGORITHM = "sha256+content+doctrine+inputs";
+    init_types();
+    GATE_ALGORITHM = "sha256+content+doctrine+inputs+members";
+    byKey = (items, key) => [...items].sort((a, b) => compareOrdinal(key(a), key(b)));
   }
 });
 
@@ -21934,6 +22166,9 @@ function memberOwning(owners, memberKeys, key) {
   return best;
 }
 function validateProject(rulesOrOptions, projectType = "backend") {
+  return runOwnersGate(rulesOrOptions, projectType).result;
+}
+function runOwnersGate(rulesOrOptions, projectType = "backend") {
   let rules = rulesOrOptions;
   let scopeSubsystem;
   let extensions;
@@ -21984,7 +22219,7 @@ function validateProject(rulesOrOptions, projectType = "backend") {
     if (!system) {
       const pending = extensions.errors.length > 0 || extensions.selectionFailures.length > 0 ? " Extension packs were not checked yet either, and at least one problem is already known there \u2014 re-run once the L0 exists." : " Extension-pack configuration is not checked until the L0 exists.";
       issues.push(issue("error", "MISSING_SYSTEM_SPEC", `L0 System specification (.system.yaml) is missing.${pending}`));
-      return { valid: false, issues };
+      return { result: { valid: false, issues }, codeModel };
     }
     if (scopeSubsystem) {
       const scopeMatches = subsystems.some(
@@ -22002,7 +22237,7 @@ function validateProject(rulesOrOptions, projectType = "backend") {
             scopeSubsystem
           )
         );
-        return { valid: false, issues };
+        return { result: { valid: false, issues }, codeModel };
       }
     }
     for (const err of extensions.errors) {
@@ -22064,9 +22299,12 @@ function validateProject(rulesOrOptions, projectType = "backend") {
     const count = pinnedExternals.length;
     const hint = count > 0 ? `${count} external${count === 1 ? " was" : "s were"} judged against ${count === 1 ? "its pin" : "their pins"} alone; \`wairon validate --family\` composes ${count === 1 ? "it" : "them"} against the live producer${count === 1 ? "" : "s"}.` : void 0;
     return {
-      valid: issues.every((i) => i.severity !== "error"),
-      issues,
-      ...hint ? { hint } : {}
+      result: {
+        valid: issues.every((i) => i.severity !== "error"),
+        issues,
+        ...hint ? { hint } : {}
+      },
+      codeModel
     };
   } finally {
     statusBearing.forEach((s, i) => {
@@ -22099,7 +22337,33 @@ function settledStatusBearing(loaded) {
   return out;
 }
 function validateAsComplete(options) {
-  return validateProject({ ...options ?? {}, treatAllAsComplete: true });
+  const { result, codeModel } = runOwnersGate({ ...options ?? {}, treatAllAsComplete: true });
+  const sequence = ruleSequence();
+  const doctrineDigest = analyzerDigest(sequence, { rules: options?.rules ?? projectRules() });
+  return { ...result, analysis: codeAnalysisOf(result, sequence, codeModel, doctrineDigest) };
+}
+function projectRules() {
+  try {
+    return loadProjectConfig()?.rules;
+  } catch {
+    return void 0;
+  }
+}
+function weakestGrade(codeModel) {
+  const grades = codeModel.files.filter((f) => f.status === "analyzed" && f.analysisGrade).map((f) => GRADE_ORDER.indexOf(f.analysisGrade));
+  return grades.length ? GRADE_ORDER[Math.min(...grades)] : "none";
+}
+function codeAnalysisOf(result, sequence, codeModel, doctrineDigest) {
+  const codes = [...new Set(sequence.filter(judgesCode).flatMap((r) => r.codes.map((c) => c.code)))].sort();
+  const codeSet = new Set(codes);
+  const count = (severity) => result.issues.filter((i) => codeSet.has(i.code) && i.severity === severity).length;
+  return {
+    analyzer: { validatorVersion: WAIRON_VERSION, doctrineDigest, grade: weakestGrade(codeModel) },
+    codes,
+    errors: count("error"),
+    warnings: count("warning"),
+    notices: count("notice")
+  };
 }
 function validateFamily(options) {
   return run(options);
@@ -22117,19 +22381,37 @@ function builtinProjectKinds() {
   return [...PROJECT_KINDS];
 }
 function computeGateStateId() {
-  const content = computeStateId();
+  scanAllSpecs({ recursive: true });
+  const content = computeOwnStateId();
   const extensions = loadProjectExtensions();
   let gate = {};
   try {
     const config = loadProjectConfig();
-    if (config) gate = { projectType: config.projectType, rules: config.rules };
+    if (config) gate = { projectType: config.projectType, rules: config.rules, composition: config.composition ?? null };
   } catch {
   }
   const inputs = consumedContractInputs();
+  const members = directMemberSubjects();
   registerBuiltinRules();
-  return computeGateIdentity(content, extensions, ruleSequence(), inputs, gate);
+  return computeGateIdentity(content, extensions, ruleSequence(), inputs, gate, members);
 }
-var path19;
+function directMemberSubjects() {
+  const family = graph();
+  const subjects = {};
+  for (const node of family.nodes) {
+    if (node.parent !== "" || node.mountAlias === void 0) continue;
+    const record2 = approvalRecord(node.directory);
+    subjects[node.mountAlias] = record2 ? `${record2.stateId.algorithm}:${record2.stateId.digest}` : NEVER_SUBJECT;
+  }
+  for (const problem of family.problems) {
+    if (problem.kind === "member-absent" && problem.projects[0] === "" && problem.id) subjects[problem.id] = NEVER_SUBJECT;
+  }
+  return subjects;
+}
+function familyApprovals(depth) {
+  return projectApprovals(depth);
+}
+var path19, GRADE_ORDER, NEVER_SUBJECT;
 var init_validation = __esm({
   "src/core/validation.ts"() {
     "use strict";
@@ -22143,9 +22425,12 @@ var init_validation = __esm({
     init_pack_impact2();
     init_gate_identity();
     init_types();
+    init_defaults();
     init_source_analysis();
     init_fs();
     path19 = __toESM(require("path"));
+    GRADE_ORDER = ["generic", "pattern", "exact"];
+    NEVER_SUBJECT = "never";
   }
 });
 
@@ -23085,10 +23370,10 @@ function settle(owner, level, candidates, problems) {
       detail: `"${name}" is bound to ${targets.length} different targets (${targets.join(", ")}) by ${explicit.length ? "explicit entries" : "wildcard re-exports"}; it is left out of the table`
     });
   }
-  const byKey = /* @__PURE__ */ new Map();
-  for (const e of entries) byKey.set(nameKey(e.publicName), [...byKey.get(nameKey(e.publicName)) ?? [], e]);
+  const byKey2 = /* @__PURE__ */ new Map();
+  for (const e of entries) byKey2.set(nameKey(e.publicName), [...byKey2.get(nameKey(e.publicName)) ?? [], e]);
   const clashing = /* @__PURE__ */ new Set();
-  for (const group of byKey.values()) {
+  for (const group of byKey2.values()) {
     const targets = [...new Set(group.map((e) => exportTargetKey(e)))];
     if (group.length < 2 || targets.length < 2) continue;
     group.forEach((e) => clashing.add(e));
@@ -23564,9 +23849,6 @@ function inspectChainedRoots(rootDir = getProjectRoot()) {
   walk2(root, "", /* @__PURE__ */ new Set([chainDirKey(root)]), 0);
   return inspection;
 }
-function listChainedRoots(rootDir = getProjectRoot()) {
-  return inspectChainedRoots(rootDir).roots;
-}
 function mapSpecReferences(kind, spec, map) {
   switch (kind) {
     case "subsystem": {
@@ -23824,10 +24106,10 @@ function keyedSystem(system, key, subsystems) {
   };
 }
 function resolveFamilyTables(raws) {
-  const byKey = new Map(raws.map((r) => [r.record.namespace, r]));
+  const byKey2 = new Map(raws.map((r) => [r.record.namespace, r]));
   const done = /* @__PURE__ */ new Set();
   const resolving = /* @__PURE__ */ new Set();
-  const resolve39 = (raw) => {
+  const resolve40 = (raw) => {
     const key = raw.record.namespace;
     if (done.has(key)) return raw.record.exports;
     if (resolving.has(key)) return null;
@@ -23841,8 +24123,8 @@ function resolveFamilyTables(raws) {
         const source = e.from ?? e.subsystem;
         const producerKey = source !== void 0 ? raw.record.aliases.get(source) : void 0;
         if (producerKey === void 0 || producerTables.has(producerKey)) continue;
-        const producer = byKey.get(producerKey);
-        producerTables.set(producerKey, producer ? resolve39(producer) : null);
+        const producer = byKey2.get(producerKey);
+        producerTables.set(producerKey, producer ? resolve40(producer) : null);
         audienceOf.set(producerKey, "project");
       }
       raw.record.subsystemExports = subsystemTables;
@@ -23858,7 +24140,7 @@ function resolveFamilyTables(raws) {
       resolving.delete(key);
     }
   };
-  raws.forEach((raw) => resolve39(raw));
+  raws.forEach((raw) => resolve40(raw));
 }
 function bindAuthored(raw, raws, readables, authored) {
   const key = raw.record.namespace;
@@ -24467,13 +24749,13 @@ function ineffectiveDeltaPaths(delta, merged, stored) {
   const isPlain = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
   const same = (a, b) => JSON.stringify(a) === JSON.stringify(b);
   const at = (prefix, key) => prefix ? `${prefix}.${key}` : key;
-  const say = (path83, why) => {
-    out.push(`${path83} \u2014 ${why}`);
+  const say = (path82, why) => {
+    out.push(`${path82} \u2014 ${why}`);
   };
-  const walkValue = (d, m, s, path83, field) => {
+  const walkValue = (d, m, s, path82, field) => {
     if (Array.isArray(d)) {
       if (!Array.isArray(m)) {
-        say(path83, "the level does not have this field, so the write dropped it");
+        say(path82, "the level does not have this field, so the write dropped it");
         return;
       }
       if (field === "narrative" && d.some(carriesEditMarker)) return;
@@ -24481,32 +24763,32 @@ function ineffectiveDeltaPaths(delta, merged, stored) {
         if (carriesEditMarker(element)) continue;
         const key = reportIdentityOf(field, element);
         if (key === null) {
-          if (!same(m, d)) say(path83, "the level does not keep this value, so the write dropped it");
-          else if (same(s, d)) say(path83, "the stored spec already held this value");
+          if (!same(m, d)) say(path82, "the level does not keep this value, so the write dropped it");
+          else if (same(s, d)) say(path82, "the stored spec already held this value");
           return;
         }
         const mMatch = m.find((i) => reportIdentityOf(field, i) === key);
         const sMatch = Array.isArray(s) ? s.find((i) => reportIdentityOf(field, i) === key) : void 0;
         if (mMatch === void 0) {
-          say(at(path83, key), "the write did not store this element");
+          say(at(path82, key), "the write did not store this element");
           continue;
         }
-        walk2(element, mMatch, sMatch, at(path83, key), field);
+        walk2(element, mMatch, sMatch, at(path82, key), field);
       }
       return;
     }
     if (isPlain(d)) {
       if (!isPlain(m)) {
-        say(path83, "the level does not have this field, so the write dropped it");
+        say(path82, "the level does not have this field, so the write dropped it");
         return;
       }
-      walk2(d, m, s, path83, field);
+      walk2(d, m, s, path82, field);
       return;
     }
-    if (!same(m, d)) say(path83, "the write did not store it \u2014 the level's schema does not keep this value");
-    else if (same(s, d)) say(path83, "the stored spec already held this value");
+    if (!same(m, d)) say(path82, "the write did not store it \u2014 the level's schema does not keep this value");
+    else if (same(s, d)) say(path82, "the stored spec already held this value");
   };
-  function walk2(d, m, s, path83, container) {
+  function walk2(d, m, s, path82, container) {
     for (const [key, value] of Object.entries(d)) {
       if (DELTA_VERBS.has(key) || JUMP_LABEL_TWINS.has(key)) continue;
       if (key === "label" && LABEL_TWIN_CONTAINERS.has(container)) continue;
@@ -24516,13 +24798,13 @@ function ineffectiveDeltaPaths(delta, merged, stored) {
           if (typeof name !== "string") continue;
           const had = isPlain(s) && s[name] !== void 0;
           const still = isPlain(m) && m[name] !== void 0;
-          if (!had) say(at(path83, name), "unset named a field the stored spec did not have");
-          else if (still) say(at(path83, name), "unset did not remove it");
+          if (!had) say(at(path82, name), "unset named a field the stored spec did not have");
+          else if (still) say(at(path82, name), "unset did not remove it");
         }
         continue;
       }
       if (value === void 0 || value === null) continue;
-      const here = at(path83, key);
+      const here = at(path82, key);
       const mValue = isPlain(m) ? m[key] : void 0;
       const sValue = isPlain(s) ? s[key] : void 0;
       if (mValue === void 0) {
@@ -24822,9 +25104,7 @@ function consumedSurfaceInputsAt(rootDir) {
   return keys;
 }
 function consumedContractInputs() {
-  const root = getProjectRoot();
-  const roots = [root, ...listChainedRoots(root).map((rel2) => path21.join(root, rel2))];
-  return roots.flatMap(consumedSurfaceInputsAt);
+  return consumedSurfaceInputsAt(getProjectRoot());
 }
 function readLockState(current2) {
   const record2 = readLockRecord();
@@ -25773,10 +26053,10 @@ var init_specs2 = __esm({
         return this.relativizeSpec("interface", spec);
       }
       prepareImplementationForWrite(spec, carry = true) {
-        const relative19 = this.relativizeSpec("implementation", spec, carry);
+        const relative18 = this.relativizeSpec("implementation", spec, carry);
         const member = this.getSubprojectPrefix(spec.id);
         const memberRoot = member ? this.resolveSubprojectForNamespace(member) : null;
-        return memberRoot ? childRelativeFilePaths(relative19, this.rootDir, memberRoot) : relative19;
+        return memberRoot ? childRelativeFilePaths(relative18, this.rootDir, memberRoot) : relative18;
       }
       prepareTypeForWrite(spec) {
         return this.relativizeSpec("type", spec);
@@ -27932,13 +28212,13 @@ function scaffoldRequirements(requirements, installed) {
   }
   return { adopted, unadopted, ...profiles.length === 1 ? { projectType: profiles[0] } : {} };
 }
-function createMember(alias, path83, description) {
-  if (!EXTERNAL_ALIAS_RE.test(alias) || typeof path83 !== "string" || path83.trim() === "") {
+function createMember(alias, path82, description) {
+  if (!EXTERNAL_ALIAS_RE.test(alias) || typeof path82 !== "string" || path82.trim() === "") {
     throw new WaironError(
       `an alias and a path are required to create a member: the alias must fit [a-z0-9-_]+ (got "${alias}") and the path must not be empty.`
     );
   }
-  const relPath = toPosixPath(path83);
+  const relPath = toPosixPath(path82);
   const memberDir = assertContainedProjectPath(getProjectRoot(), relPath);
   const requirements = requiredPolicies(projectConfigRepository.load() ?? {});
   const parentName = loadSystemSpec()?.name;
@@ -29280,6 +29560,16 @@ function buildVariantGuidance(comps, allComponents, variantsById) {
   return composeVariantGuidance(comps, allComponents, variantsById);
 }
 function resolveAgentTopology() {
+  return resolveLayer(true);
+}
+function memberAgentIds(alias, memberDir) {
+  try {
+    return runWithProjectRoot(memberDir, () => resolveLayer(false).map((r) => `${alias}::${r.id}`));
+  } catch {
+    return [];
+  }
+}
+function resolveLayer(delegate) {
   projectFilesCache.clear();
   const system = loadSystemSpec();
   if (!system) return [];
@@ -29335,6 +29625,8 @@ function resolveAgentTopology() {
         writePaths: [mountSpecPath],
         tags: ["owner", "subproject", "delegate", "sdd"],
         dependencies: [],
+        // The member's own agents BY REFERENCE, never copied into this layer.
+        ...delegate ? { delegatesTo: memberAgentIds(sub.id, path28.resolve(getProjectRoot(), sub.projectPath)) } : {},
         status: "active",
         targets: activeTargets,
         createdAt: sub.createdAt,
@@ -29470,6 +29762,11 @@ function resolveAgentTopology() {
   return agents;
 }
 function composeAgentBrief(agentId) {
+  const hop = memberHop(agentId);
+  if (hop) {
+    const brief = runWithProjectRoot(hop.directory, () => composeAgentBrief(hop.rest));
+    return throughMount(brief, hop.alias, hop.relative);
+  }
   const records = resolveAgentTopology();
   const record2 = records.find((r) => r.id === agentId);
   if (!record2) {
@@ -29514,6 +29811,25 @@ ${guidance.trim()}
     budget
   };
 }
+function memberHop(agentId) {
+  const at = agentId.indexOf("::");
+  if (at < 0) return null;
+  const alias = agentId.slice(0, at);
+  const member = graph().nodes.find((n) => n.parent === "" && n.mountAlias === alias);
+  if (!member) return null;
+  const relative18 = path28.relative(getProjectRoot(), member.directory).split(path28.sep).join("/");
+  return { alias, rest: agentId.slice(at + 2), directory: member.directory, relative: relative18 };
+}
+function throughMount(brief, alias, relative18) {
+  const under = (p) => path28.posix.join(relative18, p);
+  return {
+    ...brief,
+    agentId: `${alias}::${brief.agentId}`,
+    ownedPaths: brief.ownedPaths.map(under),
+    ...brief.readPaths ? { readPaths: brief.readPaths.map(under) } : {},
+    root: brief.root ? under(brief.root) : relative18
+  };
+}
 function loadRegistry() {
   assertProjectInitialized();
   if (!pathExists(AI_PATHS.specsSystem())) return createEmptyRegistry();
@@ -32846,7 +33162,7 @@ var require_dist = __commonJS({
       return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
     }
     var fs60 = __toESM2(require("fs"));
-    var path83 = __toESM2(require("path"));
+    var path82 = __toESM2(require("path"));
     var import_fflate = require_node();
     var SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".hg", ".svn"]);
     function listEntries(archive) {
@@ -32884,8 +33200,8 @@ var require_dist = __commonJS({
     }
     function writeTree(destDir, files) {
       for (const file of files) {
-        const absolute = path83.join(destDir, file.path);
-        fs60.mkdirSync(path83.dirname(absolute), { recursive: true });
+        const absolute = path82.join(destDir, file.path);
+        fs60.mkdirSync(path82.dirname(absolute), { recursive: true });
         fs60.writeFileSync(absolute, file.contents);
       }
     }
@@ -32898,10 +33214,10 @@ var require_dist = __commonJS({
       for (const entry of fs60.readdirSync(current2, { withFileTypes: true })) {
         if (entry.isDirectory()) {
           if (SKIP_DIRS.has(entry.name)) continue;
-          walkPackDir(root, path83.join(current2, entry.name), out);
+          walkPackDir(root, path82.join(current2, entry.name), out);
         } else if (entry.isFile()) {
-          const absolute = path83.join(current2, entry.name);
-          const relative22 = path83.relative(root, absolute).split(path83.sep).join("/");
+          const absolute = path82.join(current2, entry.name);
+          const relative22 = path82.relative(root, absolute).split(path82.sep).join("/");
           out.push({ path: relative22, contents: fs60.readFileSync(absolute) });
         }
       }
@@ -33102,8 +33418,8 @@ var require_dist = __commonJS({
       return normalized === "." ? ".wai/" : `${normalized}/.wai/`;
     }
     function normalizeRootPath(relativePath) {
-      const posix2 = relativePath.split(path210.sep).join("/").replace(/^\.\//, "").replace(/\/+$/, "");
-      return posix2 === "" || posix2 === "." ? "." : posix2;
+      const posix3 = relativePath.split(path210.sep).join("/").replace(/^\.\//, "").replace(/\/+$/, "");
+      return posix3 === "" || posix3 === "." ? "." : posix3;
     }
     function slugify2(projectName) {
       const slug2 = projectName.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
@@ -33209,19 +33525,19 @@ function commitStagedTree(stagingDir, destDir, roots, backupExisting) {
   const backupDir = path33.join(root, BACKUP_DIR, timestampSlug());
   let backedUp = false;
   for (const rootRel of roots) {
-    const relative19 = rootRel === "." ? "" : rootRel;
-    const stagedSpecDir = path33.join(stagingDir, relative19, ".wai");
+    const relative18 = rootRel === "." ? "" : rootRel;
+    const stagedSpecDir = path33.join(stagingDir, relative18, ".wai");
     if (!fs19.existsSync(stagedSpecDir)) continue;
-    const liveSpecDir = liveSpecDirFor(path33.join(root, relative19));
+    const liveSpecDir = liveSpecDirFor(path33.join(root, relative18));
     if (backupExisting && liveSpecDir && fs19.existsSync(liveSpecDir)) {
-      const backupTarget = path33.join(backupDir, relative19, path33.basename(liveSpecDir));
+      const backupTarget = path33.join(backupDir, relative18, path33.basename(liveSpecDir));
       fs19.mkdirSync(path33.dirname(backupTarget), { recursive: true });
       fs19.renameSync(liveSpecDir, backupTarget);
       backedUp = true;
     } else if (liveSpecDir && fs19.existsSync(liveSpecDir)) {
       fs19.rmSync(liveSpecDir, { recursive: true, force: true });
     }
-    const target = path33.join(root, relative19, ".wai");
+    const target = path33.join(root, relative18, ".wai");
     fs19.mkdirSync(path33.dirname(target), { recursive: true });
     if (fs19.existsSync(target)) fs19.rmSync(target, { recursive: true, force: true });
     fs19.renameSync(stagedSpecDir, target);
@@ -33486,6 +33802,12 @@ function describeApprover(who) {
   const label4 = who.name ? `${who.name} (${who.id})` : who.id;
   return who.source === "hosted" ? `${label4} [authenticated]` : label4;
 }
+function designOnly(result) {
+  if (!result.analysis) return result;
+  const codeCodes = new Set(result.analysis.codes ?? []);
+  const issues = result.issues.filter((i) => !codeCodes.has(i.code));
+  return { ...result, issues, valid: issues.every((i) => i.severity !== "error") };
+}
 var init_lock = __esm({
   "src/models/lock.ts"() {
     "use strict";
@@ -33557,48 +33879,22 @@ function settledSpecPaths(root = getProjectRoot()) {
   const diff = diffAgainstApproval(root);
   return diff ? new Set(diff.unchangedPaths) : null;
 }
-function pinOf(stateId) {
-  return `${stateId.algorithm}:${stateId.digest}`;
-}
-function currentChildPins(mounts, root = getProjectRoot()) {
-  const pins = {};
-  for (const mount of mounts) {
-    if (!mount.projectPath || mount.id.includes("::")) continue;
-    const child = readLockRecordAt(path34.resolve(root, mount.projectPath));
-    if (child) pins[mount.id] = pinOf(child.stateId);
-  }
-  return pins;
-}
-function movedChildren(mounts, root = getProjectRoot()) {
-  const pinned = approvalRecord(root)?.children;
-  if (!pinned) return [];
-  const now = currentChildPins(mounts, root);
-  const moved = [];
-  for (const [id, was] of Object.entries(pinned)) {
-    const current2 = now[id] ?? null;
-    if (current2 !== was) moved.push({ id, pinned: was, now: current2 });
-  }
-  return moved;
-}
-function memberMounts(root = getProjectRoot()) {
-  return graph().nodes.filter((n) => n.parent === "" && n.mountAlias !== void 0).map((n) => ({ id: n.mountAlias, projectPath: path34.relative(root, n.directory).split(path34.sep).join("/") }));
-}
-function approvalVerdict() {
+function approvalVerdict(approvals) {
   const quiet = { text: "", drifted: false };
   try {
     const approval = approvalRecord();
     if (!approval) return quiet;
     const by = describeApprover(approval.lockedBy);
-    const moved = movedChildren(memberMounts());
-    const childNote = moved.length ? `
-${moved.length} chained child project(s) moved since approval: ${moved.map((m) => m.id).join(", ")}.` : "";
+    const notes = memberNotes(approvals ?? []);
+    const pinDrift = notes.drift;
+    const childNote = notes.text;
     const diff = diffAgainstApproval();
     if (!diff) {
       return {
         text: `
 Approved: ${approval.lockedAt} by ${by} \u2014 this lock predates per-spec approval, so drift is only visible at whole-tree level. Re-lock to record it.${childNote}
 `,
-        drifted: moved.length > 0
+        drifted: pinDrift
       };
     }
     if (diffSize(diff) === 0) {
@@ -33606,7 +33902,7 @@ Approved: ${approval.lockedAt} by ${by} \u2014 this lock predates per-spec appro
         text: `
 Approved: ${approval.lockedAt} by ${by} \u2014 no spec has changed since.${childNote}
 `,
-        drifted: moved.length > 0
+        drifted: pinDrift
       };
     }
     const parts = [];
@@ -33629,7 +33925,28 @@ ${headline} \u2014 approved ${approval.lockedAt} by ${by}:
     return quiet;
   }
 }
-var crypto4, path34;
+function memberNotes(approvals) {
+  const own = approvals.find((a) => a.key === "");
+  const direct = approvals.filter((a) => a.parent === "");
+  const moved = direct.filter((a) => a.pinned === "moved");
+  const unapproved = direct.filter((a) => a.state !== "approved");
+  const lines = [];
+  if (own?.upgraded) {
+    lines.push(`This approval was taken under an earlier gate identity \u2014 ${GATE_UPGRADE_NOTE}. Re-lock once.`);
+  }
+  if (moved.length) {
+    lines.push(`${moved.length} member pin(s) moved since approval: ${moved.map((a) => a.alias ?? a.key).join(", ")} \u2014 re-lock to approve them.`);
+  }
+  if (unapproved.length) {
+    lines.push(`Member(s) not approved at their own root: ${unapproved.map((a) => `${a.alias ?? a.key} (${a.state}${a.upgraded ? ", re-lock once" : ""})`).join(", ")}.`);
+  }
+  return {
+    text: lines.map((l) => `
+${l}`).join(""),
+    drift: !!own?.upgraded || moved.length > 0
+  };
+}
+var crypto4, path34, GATE_UPGRADE_NOTE;
 var init_approval = __esm({
   "src/core/approval.ts"() {
     "use strict";
@@ -33639,6 +33956,7 @@ var init_approval = __esm({
     init_specs2();
     init_lockfile();
     init_lock();
+    GATE_UPGRADE_NOTE = "the gate identity gained inputs in stage 5 (members' composition subjects, `composition`; code conformance moved beside the claim)";
   }
 });
 
@@ -34002,6 +34320,11 @@ var init_context = __esm({
 });
 
 // src/core/status.ts
+function approvalTag(entry) {
+  if (!entry) return "";
+  const state = entry.upgraded ? `${entry.state}, re-lock once` : entry.state;
+  return entry.pinned ? ` [${state} \xB7 pin ${entry.pinned}]` : ` [${state}]`;
+}
 function fillDecor(decor) {
   return {
     structure: decor?.structure ?? asWritten,
@@ -34161,12 +34484,21 @@ function getStatusReport(options = {}, decor) {
       const isLast = ownSubs.length + j === total - 1;
       const form = member.mountForm === "mount" ? mark.draft(" [mount form]") : "";
       const label4 = `[Project] ${member.mountAlias ?? member.namespace} (${member.id ?? "no id"})`;
-      output += `${mark.structure(indent + (isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 "))}${mark.layer("project", label4)}${form}
+      const approval = approvalTag(options.approvals?.find((a) => a.key === member.namespace));
+      output += `${mark.structure(indent + (isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 "))}${mark.layer("project", label4)}${form}${approval}
 `;
       renderProject(member.namespace, indent + (isLast ? "    " : "\u2502   "));
     });
   };
   renderProject("", "");
+  for (const absent of (options.approvals ?? []).filter((a) => a.key !== "" && !family.nodes.some((n) => n.namespace === a.key))) {
+    output += `${mark.structure("    ")}${mark.missing(`[Project] ${absent.alias ?? absent.key} (no project on disk)`)}${approvalTag(absent)}
+`;
+  }
+  const own = options.approvals?.find((a) => a.key === "");
+  const hasMembers = (options.approvals ?? []).some((a) => a.key !== "");
+  if (own && (own.state !== "never" || hasMembers)) output += `${mark.layer("system", "Approval:")} this project is ${own.state}${own.upgraded ? " (locked under the pre-stage-5 gate identity \u2014 re-lock once)" : ""}
+`;
   return { text: output, failed: false };
 }
 var path36, asWritten;
@@ -35454,7 +35786,7 @@ function renderAgentBriefMarkdown(brief) {
 }
 function registerSkillResources(server, listChanged) {
   server.server.registerCapabilities({ resources: listChanged ? { listChanged: true } : {} });
-  server.server.setRequestHandler(import_types4.ListResourcesRequestSchema, () => ({
+  server.server.setRequestHandler(import_types5.ListResourcesRequestSchema, () => ({
     resources: [
       ...listResources().map((d) => ({
         uri: d.resourceUri,
@@ -35465,14 +35797,14 @@ function registerSkillResources(server, listChanged) {
       ...listAgentBriefResources()
     ]
   }));
-  server.server.setRequestHandler(import_types4.ReadResourceRequestSchema, (request) => {
+  server.server.setRequestHandler(import_types5.ReadResourceRequestSchema, (request) => {
     const uri = request.params.uri;
     if (uri.startsWith(AGENT_BRIEF_SCHEME)) {
       try {
         const brief = composeAgentBrief(uri.slice(AGENT_BRIEF_SCHEME.length));
         return { contents: [{ uri, mimeType: SKILL_RESOURCE_MIME, text: renderAgentBriefMarkdown(brief) }] };
       } catch (e) {
-        throw new import_types4.McpError(import_types4.ErrorCode.InvalidParams, e instanceof Error ? e.message : String(e));
+        throw new import_types5.McpError(import_types5.ErrorCode.InvalidParams, e instanceof Error ? e.message : String(e));
       }
     }
     try {
@@ -35480,20 +35812,20 @@ function registerSkillResources(server, listChanged) {
       return { contents: [{ uri, mimeType: SKILL_RESOURCE_MIME, text: content }] };
     } catch (e) {
       const message = e instanceof Error ? e.message : String(e);
-      throw new import_types4.McpError(import_types4.ErrorCode.InvalidParams, message);
+      throw new import_types5.McpError(import_types5.ErrorCode.InvalidParams, message);
     }
   });
 }
 function registerSkillPrompts(server, listChanged) {
   server.server.registerCapabilities({ prompts: listChanged ? { listChanged: true } : {} });
-  server.server.setRequestHandler(import_types4.ListPromptsRequestSchema, () => ({
+  server.server.setRequestHandler(import_types5.ListPromptsRequestSchema, () => ({
     prompts: listResources().map((d) => ({
       name: d.id,
       title: d.name,
       description: d.description
     }))
   }));
-  server.server.setRequestHandler(import_types4.GetPromptRequestSchema, (request) => {
+  server.server.setRequestHandler(import_types5.GetPromptRequestSchema, (request) => {
     const name = request.params.name;
     try {
       const content = readResource(name);
@@ -35502,7 +35834,7 @@ function registerSkillPrompts(server, listChanged) {
         messages: [{ role: "user", content: { type: "text", text: content } }]
       };
     } catch (e) {
-      throw new import_types4.McpError(import_types4.ErrorCode.InvalidParams, e instanceof Error ? e.message : String(e));
+      throw new import_types5.McpError(import_types5.ErrorCode.InvalidParams, e instanceof Error ? e.message : String(e));
     }
   });
 }
@@ -36510,12 +36842,19 @@ ${testsBlock}` : ""}`, deletion);
     },
     ({ subsystem, recursive }) => {
       try {
+        let approvals;
+        try {
+          approvals = familyApprovals(recursive === false ? 0 : void 0);
+        } catch {
+          approvals = void 0;
+        }
         const report3 = getStatusReport({
           subsystem,
-          recursive: recursive ?? true
+          recursive: recursive ?? true,
+          approvals
         });
         const family = statusFamilyContext();
-        const verdict = approvalVerdict();
+        const verdict = approvalVerdict(approvals);
         return text2(`${family}${report3.text}${verdict.text}`);
       } catch (e) {
         return errText(String(e));
@@ -36720,20 +37059,20 @@ async function startMcpServer() {
   await server.connect(transport);
   await scopeToClientWorkspace(server);
   try {
-    server.server.setNotificationHandler(import_types4.RootsListChangedNotificationSchema, async () => {
+    server.server.setNotificationHandler(import_types5.RootsListChangedNotificationSchema, async () => {
       await scopeToClientWorkspace(server);
     });
   } catch {
   }
 }
-var import_mcp, import_stdio, import_zod11, import_types4, fs23, path40, import_url, crypto5, TYPE_REF_GRAMMAR, staleServerOutput, externalPinsOutput, externalStatusesOutput, SPEC_KINDS, STATUS_VALUES, testsToRevisitOutput, specWriteReceiptOutput, specDeletionOutput, specChangeOutput, specChangeReportOutput, validationIssueOutput, memberCreationOutput, doctrineChangeOutput, impactTotalsOutput, packImpactOutput, validateTreeOutput, getSpecOutput, FINGERPRINT_VERSION, runningFingerprint, RECONNECT, assessedAsChanged, serverBuildStamps, SERVER_BUILD_STAMP, SPEC_WRITE_TOOLS, listChangedEmitters, statusInput, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
+var import_mcp, import_stdio, import_zod11, import_types5, fs23, path40, import_url, crypto5, TYPE_REF_GRAMMAR, staleServerOutput, externalPinsOutput, externalStatusesOutput, SPEC_KINDS, STATUS_VALUES, testsToRevisitOutput, specWriteReceiptOutput, specDeletionOutput, specChangeOutput, specChangeReportOutput, validationIssueOutput, memberCreationOutput, doctrineChangeOutput, impactTotalsOutput, packImpactOutput, validateTreeOutput, getSpecOutput, FINGERPRINT_VERSION, runningFingerprint, RECONNECT, assessedAsChanged, serverBuildStamps, SERVER_BUILD_STAMP, SPEC_WRITE_TOOLS, listChangedEmitters, statusInput, SKILL_RESOURCE_MIME, AGENT_BRIEF_SCHEME;
 var init_server = __esm({
   "src/mcp/server.ts"() {
     "use strict";
     import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
     import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
     import_zod11 = require("zod");
-    import_types4 = require("@modelcontextprotocol/sdk/types.js");
+    import_types5 = require("@modelcontextprotocol/sdk/types.js");
     fs23 = __toESM(require("fs"));
     path40 = __toESM(require("path"));
     import_url = require("url");
@@ -37324,7 +37663,7 @@ var init_mcp = __esm({
 });
 
 // src/cli/index.ts
-var path82 = __toESM(require("path"));
+var path81 = __toESM(require("path"));
 var import_commander = require("commander");
 init_defaults();
 init_logger();
@@ -38140,7 +38479,7 @@ function pruneStaleAgents(expectedPaths, scanDirs) {
 async function runGenerate(options = {}) {
   await generateLayer(options);
   const scoped = options.root || options.domain || options.domains;
-  if (options.recurse === false || options.dryRun || scoped) return;
+  if (!options.family || options.dryRun || scoped) return;
   const children = listDirectChainedSubprojects(getProjectRoot());
   for (const child of children) {
     logger.blank();
@@ -38255,7 +38594,9 @@ init_core();
 init_project();
 init_lock();
 init_fs();
+init_errors();
 init_validation();
+init_lock();
 function checkApproval(strict) {
   if (!loadSystemSpec()) {
     return {
@@ -38266,6 +38607,7 @@ function checkApproval(strict) {
   }
   const lock = readLockState(computeGateStateId());
   const record2 = lock.record;
+  if (lock.state === "stale" && record2.stateId.algorithm !== lock.current.algorithm) return upgradedCheck(record2);
   switch (lock.state) {
     case "locked":
       return {
@@ -38277,7 +38619,7 @@ function checkApproval(strict) {
       return {
         state: "stale",
         approved: false,
-        message: `The design changed after it was approved (the approval on record is ${record2.lockedAt} by ${describeApprover(record2.lockedBy)}). Nothing says a human has seen what is about to merge. Fix: run \`wairon lock\` on this branch and commit the updated .wai/lock.json.`
+        message: `The design, or something it was approved under (doctrine, declared inputs, \`composition\`, a direct member's approval), changed after it was approved (the approval on record is ${record2.lockedAt} by ${describeApprover(record2.lockedBy)}). Nothing says a human has seen what is about to merge. Fix: run \`wairon lock\` on this branch and commit the updated .wai/lock.json.`
       };
     default:
       return {
@@ -38287,7 +38629,29 @@ function checkApproval(strict) {
       };
   }
 }
-async function runLock(options = {}, gate) {
+function upgradedCheck(record2) {
+  const diff = diffAgainstApproval();
+  const specs = !diff ? "This approval predates per-spec digests, so whether a spec file moved since cannot be said." : diffSize(diff) === 0 ? "No own spec file has changed since the approval." : `${diffSize(diff)} own spec file(s) changed since the approval.`;
+  return {
+    state: "stale",
+    approved: false,
+    message: `The approval on record (${record2.lockedAt} by ${describeApprover(record2.lockedBy)}) was taken under an earlier gate identity \u2014 the gate identity gained inputs in stage 5: members' composition subjects, \`composition\`; code conformance moved beside the claim. ${specs} Fix: re-lock once (\`wairon lock\`) and commit the updated .wai/lock.json.`
+  };
+}
+var LockRefusedError = class extends WaironError {
+  constructor(message) {
+    super(message);
+    this.name = "LockRefusedError";
+  }
+};
+function describeMemberState(entry) {
+  return `${entry.alias ?? entry.key} (${entry.state}${entry.upgraded ? " \u2014 approved under the pre-stage-5 identity, re-lock it once" : ""})`;
+}
+function codeLine(code) {
+  if (!code) return "code: no code analysis recorded";
+  return `code: ${code.errors} error(s), ${code.warnings} warning(s) recorded beside the claim (analyzer ${code.analyzer.validatorVersion}, grade ${code.analyzer.grade}) \u2014 CI enforces them, not the lock`;
+}
+function summarize3(gate, members) {
   const diff = diffAgainstApproval();
   if (!diff) {
     logger.info("First approval of this tree \u2014 the whole spec tree becomes the approved baseline.");
@@ -38299,12 +38663,21 @@ async function runLock(options = {}, gate) {
     for (const p of diff.added) logger.info(`  + ${p}`);
     for (const p of diff.removed) logger.info(`  - ${p}`);
   }
-  const moved = movedChildren(memberMounts2());
-  if (moved.length > 0) {
-    logger.info(`${moved.length} chained child project(s) moved since the last approval:`);
-    for (const m of moved) {
-      logger.info(`  ${m.id}: ${m.pinned.slice(0, 19)}\u2026 \u2192 ${m.now ? `${m.now.slice(0, 19)}\u2026` : "(no approval)"}`);
-    }
+  logger.info(codeLine(gate.analysis));
+  for (const m of members) {
+    const pin2 = m.pinned === "moved" ? " \u2014 its pin moved since the last approval" : "";
+    logger.info(`  member ${m.alias ?? m.key}: ${m.state}${m.upgraded ? " (pre-stage-5 lock, re-lock once)" : ""}${pin2}`);
+  }
+}
+async function runLock(options, gate, captured) {
+  const members = familyApprovals(1).filter((a) => a.parent === "");
+  summarize3(gate, members);
+  const config = loadProjectConfig();
+  const unapproved = members.filter((m) => m.state !== "approved");
+  if (config?.composition?.requireApprovedMembers && unapproved.length > 0) {
+    throw new LockRefusedError(
+      `composition.requireApprovedMembers: direct member(s) not approved \u2014 ${unapproved.map(describeMemberState).join(", ")}. Lock each at its own root first (\`wairon lock\` there); a parent never approves below itself. Nothing was written.`
+    );
   }
   logger.blank();
   logger.warn("This records the current design as approved and (re)generates the agent topology.");
@@ -38329,30 +38702,48 @@ async function runLock(options = {}, gate) {
       specPathsInScope(options.subsystem).map((p) => path44.relative(root, p).split(path44.sep).join("/"))
     )
   } : void 0;
-  const config = loadProjectConfig();
   const projectId = config ? effectiveProjectId(config) : null;
+  const specs = captureApprovedSpecs(root, scope);
+  const lockedBy = localApprover();
+  const now = computeGateStateId();
+  if (now.algorithm !== captured.algorithm || now.digest !== captured.digest) {
+    throw new LockRefusedError(
+      "The lock's inputs changed while it ran \u2014 a spec, the doctrine, an input, the composition block or a member's approval moved between the validation and the write. Nothing was written; run `wairon lock` again."
+    );
+  }
+  const design = designOnly(gate);
+  const count = (severity) => design.issues.filter((i) => i.severity === severity).length;
   const record2 = {
-    stateId: computeGateStateId(),
+    // The record format: 2 from stage 5 on (members, code, no children).
+    format: 2,
+    stateId: captured,
     lockedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    lockedBy: localApprover(),
+    lockedBy,
     validatorVersion: WAIRON_VERSION,
-    validationResult: {
-      valid: true,
-      errors: 0,
-      warnings: gate ? gate.issues.filter((i) => i.severity === "warning").length : 0,
-      notices: gate ? gate.issues.filter((i) => i.severity === "notice").length : 0
-    },
+    validationResult: { valid: design.valid, errors: count("error"), warnings: count("warning"), notices: count("notice") },
     status: "ready",
     ...projectId !== null ? { projectId } : {},
-    specs: captureApprovedSpecs(root, scope),
-    children: currentChildPins(memberMounts2(), root)
+    specs,
+    members: memberPins(members),
+    ...gate.analysis ? { code: withoutCodes(gate.analysis) } : {}
   };
   writeLockRecord(record2);
   return record2;
 }
-function memberMounts2() {
-  const root = getProjectRoot();
-  return graph().nodes.filter((n) => n.parent === "" && n.mountAlias !== void 0).map((n) => ({ id: n.mountAlias, projectPath: path44.relative(root, n.directory).split(path44.sep).join("/") }));
+function memberPins(members) {
+  const pins = {};
+  for (const m of members) {
+    pins[m.alias ?? m.key] = {
+      ...m.projectId !== void 0 ? { project: m.projectId } : {},
+      ...m.subject !== void 0 ? { subject: m.subject } : {},
+      state: m.state
+    };
+  }
+  return pins;
+}
+function withoutCodes(analysis) {
+  const { codes: _codes, ...rest } = analysis;
+  return rest;
 }
 
 // src/commands/validate.ts
@@ -38551,6 +38942,7 @@ async function runValidate(options = {}) {
 }
 
 // src/cli/index.ts
+init_lock();
 init_paths();
 init_fs();
 
@@ -38681,14 +39073,14 @@ var http = __toESM(require("http"));
 var https = __toESM(require("https"));
 init_defaults();
 function downloadFile(url, dest) {
-  return new Promise((resolve39, reject) => {
+  return new Promise((resolve40, reject) => {
     const file = fs26.createWriteStream(dest);
     const get4 = url.startsWith("https://") ? https.get : http.get;
     get4(url, { headers: { "User-Agent": `wairon/${WAIRON_VERSION}` }, agent: false }, (res) => {
       if (res.statusCode === 301 || res.statusCode === 302) {
         file.close();
         res.destroy();
-        downloadFile(res.headers.location, dest).then(resolve39).catch(reject);
+        downloadFile(res.headers.location, dest).then(resolve40).catch(reject);
         return;
       }
       if (res.statusCode !== 200) {
@@ -38700,7 +39092,7 @@ function downloadFile(url, dest) {
       res.pipe(file);
       file.on("finish", () => {
         res.destroy();
-        file.close(() => resolve39());
+        file.close(() => resolve40());
       });
       file.on("error", (err) => {
         res.destroy();
@@ -38877,7 +39269,7 @@ function releaseChannelLabel(tag) {
   return version.slice(dash + 1).replace(/\.\d+$/, "") || "stable";
 }
 function fetchReleases(repo) {
-  return new Promise((resolve39, reject) => {
+  return new Promise((resolve40, reject) => {
     const url = `https://api.github.com/repos/${repo}/releases?per_page=100`;
     const options = {
       headers: {
@@ -38897,7 +39289,7 @@ function fetchReleases(repo) {
           return;
         }
         try {
-          resolve39(JSON.parse(data));
+          resolve40(JSON.parse(data));
         } catch {
           reject(new Error("Failed to parse GitHub API response"));
         }
@@ -39040,16 +39432,26 @@ function refuseUnreadableTree(explanation) {
 function withoutTrailingNewline(text3) {
   return text3.endsWith("\n") ? text3.slice(0, -1) : text3;
 }
+function depthOf2(recursive) {
+  if (recursive === false) return 0;
+  return typeof recursive === "number" ? recursive : void 0;
+}
 async function runStatus(options = {}) {
   assertProjectInitialized();
-  const report3 = getStatusReport(options, TERMINAL_DECOR);
+  let approvals;
+  try {
+    approvals = familyApprovals(depthOf2(options.recursive));
+  } catch {
+    approvals = void 0;
+  }
+  const report3 = getStatusReport({ ...options, approvals }, TERMINAL_DECOR);
   if (report3.failed) {
     refuseUnreadableTree(report3.text);
   }
   logger.header("Architecture Status Dashboard");
   logger.blank();
   console.log(withoutTrailingNewline(report3.text));
-  const lock = approvalVerdict();
+  const lock = approvalVerdict(approvals);
   if (lock.text.trim()) {
     logger.blank();
     if (lock.drifted) logger.warn(lock.text.trim());
@@ -39125,7 +39527,7 @@ async function filteredCheckbox(config) {
     32,
     Math.max(...items.map((i) => i.label.length))
   );
-  return new Promise((resolve39) => {
+  return new Promise((resolve40) => {
     const checked = /* @__PURE__ */ new Set();
     let cursor = 0;
     let filterIdx = 0;
@@ -39192,7 +39594,7 @@ async function filteredCheckbox(config) {
       );
       teardown();
       const result = items.filter((_, idx) => checked.has(idx)).map((i) => i.value);
-      resolve39(result);
+      resolve40(result);
     }
     function abort() {
       process.stdout.write("\n");
@@ -40537,7 +40939,13 @@ function coverProject(node, family) {
     const line2 = {
       key: node.namespace,
       ...record2 ? { lockedBy: record2.validatorVersion } : {},
-      ...record2 ? { lockedTotals: totals2(record2.validationResult.errors, record2.validationResult.warnings, record2.validationResult.notices) } : {},
+      // A format-2 record counts the design half and the code half apart; the
+      // run below counts both, so the locked totals add them back together.
+      ...record2 ? { lockedTotals: totals2(
+        record2.validationResult.errors + (record2.code?.errors ?? 0),
+        record2.validationResult.warnings + (record2.code?.warnings ?? 0),
+        record2.validationResult.notices === void 0 ? void 0 : record2.validationResult.notices + (record2.code?.notices ?? 0)
+      ) } : {},
       currentTotals: totals2(count("error"), count("warning"), count("notice")),
       predatesStage4: record2 ? predatesStage4(record2.validatorVersion) : false
     };
@@ -40841,12 +41249,19 @@ async function runDoctor(options = {}) {
           line(tally, "warn", "this lock predates per-spec approval \u2014 re-lock so `wairon status` can name what drifts");
         }
         logger.blank();
+      } else if (lock.state === "stale" && lock.record.stateId.algorithm !== lock.current.algorithm) {
+        console.log(import_chalk12.default.bold("Lock"));
+        line(
+          tally,
+          "warn",
+          `stale \u2014 the lock of ${lock.record.lockedAt} was taken under an earlier gate identity: the gate identity gained inputs in stage 5 (members' composition subjects, \`composition\`; code conformance moved beside the claim). Re-lock once (\`wairon lock\`).`
+        );
       } else if (lock.state === "stale") {
         console.log(import_chalk12.default.bold("Lock"));
         line(
           tally,
           "warn",
-          `stale \u2014 the specs or the governing doctrine changed since ${lock.record.lockedAt}, so this lock no longer holds. Re-run \`wairon lock\` to freeze the current state.`
+          `stale \u2014 the design or something it was approved under changed since ${lock.record.lockedAt}, so this lock no longer holds. Re-run \`wairon lock\` to freeze the current state.`
         );
         logger.blank();
       }
@@ -42182,7 +42597,7 @@ async function impactPack(spec) {
 
 // src/commands/host.ts
 var fs57 = __toESM(require("fs"));
-var path79 = __toESM(require("path"));
+var path78 = __toESM(require("path"));
 var os11 = __toESM(require("os"));
 var crypto24 = __toESM(require("crypto"));
 var import_child_process7 = require("child_process");
@@ -42193,9 +42608,9 @@ init_errors();
 
 // src/server/admin.ts
 var crypto11 = __toESM(require("crypto"));
-var path64 = __toESM(require("path"));
 init_fs();
 init_defaults();
+init_lock();
 init_project();
 
 // src/server/auth.ts
@@ -44463,6 +44878,7 @@ function list() {
 init_validation();
 init_errors();
 init_validation();
+init_validation();
 function validateAsComplete2() {
   const config = loadProjectConfig();
   if (!config) throw new ProjectNotInitializedError();
@@ -44609,57 +45025,115 @@ function hostedApprover(subject) {
     source: "hosted"
   };
 }
-function directMembers(family, root) {
-  return family.nodes.filter((n) => n.parent === "" && n.mountAlias !== void 0).map((n) => ({ id: n.mountAlias, projectPath: path64.relative(root, n.directory).split(path64.sep).join("/") }));
-}
 function boundLifecycleRoot(cfg, projectId, subproject) {
   const root = existingProjectRoot(cfg.dataDir, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
   if (!subproject) return root;
   return resolveSubprojectMounts(projectId, root, subproject.split(SUBPROJECT_SEPARATOR));
 }
-function executeApprovedLock(cfg, projectId, approver, subproject) {
+var LockRefusedError2 = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "LockRefusedError";
+  }
+};
+var RequestedDesignMovedError = class extends LockRefusedError2 {
+  constructor(requested, now) {
+    super(`The design changed since the lock was requested (requested ${requested}, now ${now}); request the lock again. Nothing was written.`);
+    this.requested = requested;
+    this.now = now;
+  }
+};
+function renderIdentity(stateId) {
+  return `${stateId.algorithm}:${stateId.digest}`;
+}
+function gateIdentity(cfg, projectId, subproject) {
+  const root = boundLifecycleRoot(cfg, projectId, subproject);
+  return runWithProjectRoot(root, () => renderIdentity(computeGateStateId()));
+}
+function executeApprovedLock(cfg, projectId, approver, subproject, expected) {
   const root = boundLifecycleRoot(cfg, projectId, subproject);
   return runWithProjectRoot(root, () => {
     sync();
-    const result = validateAsComplete2();
-    const errors = result.issues.filter((i) => i.severity === "error");
-    if (errors.length) {
-      throw new LockValidationError(errors.map((e) => ({ code: e.code, message: e.message, specId: e.specId })));
-    }
-    const stateId = computeGateStateId();
-    const specs = captureApprovedSpecs();
-    const children = currentChildPins(directMembers(graph(), root));
+    const captured = computeGateStateId();
+    refuseUnrequestedDesign(captured, expected);
+    const gate = validateAsComplete2();
+    const design = refuseDesignErrors(gate);
+    const members = familyApprovals(1).filter((a) => a.parent === "");
     const config = loadProjectConfig();
-    const projectId2 = config ? effectiveProjectId(config) : null;
-    const record2 = {
-      stateId,
-      lockedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      lockedBy: approver,
-      validatorVersion: WAIRON_VERSION,
-      validationResult: {
-        valid: true,
-        errors: 0,
-        warnings: result.issues.filter((i) => i.severity === "warning").length,
-        notices: result.issues.filter((i) => i.severity === "notice").length
-      },
-      status: "ready",
-      ...projectId2 !== null ? { projectId: projectId2 } : {},
-      specs,
-      children
-    };
+    refuseUnapprovedMembers(config?.composition?.requireApprovedMembers === true, members);
+    const specs = captureApprovedSpecs();
+    refuseMovedInputs(captured, computeGateStateId());
+    const record2 = lockRecordOf(captured, approver, design, gate, config, specs, members);
     writeLockRecord(record2);
-    const publish2 = publish(`wairon lock: ${projectId2} @ ${stateId}`);
-    if (!publish2.published) return record2;
-    const published = {
-      ...record2,
-      commitSha: publish2.commitSha,
-      compareUrl: publish2.compareUrl
-    };
-    writeLockRecord(published);
-    return published;
+    return publishLock(record2);
   });
 }
+function refuseUnrequestedDesign(captured, expected) {
+  if (expected === void 0 || renderIdentity(captured) === expected) return;
+  throw new RequestedDesignMovedError(expected, renderIdentity(captured));
+}
+function refuseDesignErrors(gate) {
+  const design = designOnly(gate);
+  const errors = design.issues.filter((i) => i.severity === "error");
+  if (errors.length) {
+    throw new LockValidationError(errors.map((e) => ({ code: e.code, message: e.message, specId: e.specId })));
+  }
+  return design;
+}
+function refuseUnapprovedMembers(required, members) {
+  const unapproved = members.filter((m) => m.state !== "approved");
+  if (!required || unapproved.length === 0) return;
+  const named2 = unapproved.map((m) => `${m.alias ?? m.key} (${m.state}${m.upgraded ? " \u2014 approved under the pre-stage-5 identity, re-lock it once" : ""})`);
+  throw new LockRefusedError2(
+    `composition.requireApprovedMembers: direct member(s) not approved \u2014 ${named2.join(", ")}. Lock each at its own root first; a parent never approves below itself. Nothing was written.`
+  );
+}
+function refuseMovedInputs(captured, now) {
+  if (now.algorithm === captured.algorithm && now.digest === captured.digest) return;
+  throw new LockRefusedError2(
+    "The lock's inputs changed while it ran \u2014 a spec, the doctrine, an input, the composition block or a member's approval moved between the validation and the write. Nothing was written; run the lock again."
+  );
+}
+function lockRecordOf(captured, approver, design, gate, config, specs, members) {
+  const count = (severity) => design.issues.filter((i) => i.severity === severity).length;
+  const projectId = config ? effectiveProjectId(config) : null;
+  return {
+    format: 2,
+    stateId: captured,
+    lockedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    lockedBy: approver,
+    validatorVersion: WAIRON_VERSION,
+    validationResult: { valid: design.valid, errors: count("error"), warnings: count("warning"), notices: count("notice") },
+    status: "ready",
+    ...projectId !== null ? { projectId } : {},
+    specs,
+    members: memberPins2(members),
+    ...gate.analysis ? { code: withoutCodes2(gate.analysis) } : {}
+  };
+}
+function memberPins2(members) {
+  const pins = {};
+  for (const m of members) {
+    pins[m.alias ?? m.key] = {
+      ...m.projectId !== void 0 ? { project: m.projectId } : {},
+      ...m.subject !== void 0 ? { subject: m.subject } : {},
+      state: m.state
+    };
+  }
+  return pins;
+}
+function withoutCodes2(analysis) {
+  const { codes: _codes, ...rest } = analysis;
+  return rest;
+}
+function publishLock(record2) {
+  const publish2 = publish(`wairon lock: ${record2.projectId ?? "project"} @ ${renderIdentity(record2.stateId)}`);
+  if (!publish2.published) return record2;
+  const published = { ...record2, commitSha: publish2.commitSha, compareUrl: publish2.compareUrl };
+  writeLockRecord(published);
+  return published;
+}
 function projectGitCredentialKey(project2) {
   return `git-project:${project2}`;
 }
@@ -44834,7 +45308,7 @@ function diagramViewLink(cfg, credential, project2) {
 
 // src/server/packs.ts
 var fs43 = __toESM(require("fs"));
-var path65 = __toESM(require("path"));
+var path64 = __toESM(require("path"));
 init_fs();
 init_yaml();
 
@@ -44890,7 +45364,7 @@ function assertNotCodeArchive(info) {
 function extractDeclarativeArchive(archive, destDir) {
   const result = extractArchive(archive, destDir, HOSTED_STRICT_LIMITS);
   try {
-    assertDeclarative(fs43.readFileSync(path65.join(result.directory, result.entryPath), "utf8"));
+    assertDeclarative(fs43.readFileSync(path64.join(result.directory, result.entryPath), "utf8"));
   } catch (e) {
     fs43.rmSync(destDir, { recursive: true, force: true });
     throw e;
@@ -44899,10 +45373,10 @@ function extractDeclarativeArchive(archive, destDir) {
 function probe(loadRef, baseRoot, scope, displayRef) {
   const loaded = loadExtensionPacks([{ ref: loadRef, scope }], baseRoot);
   if (loaded.errors.length) {
-    return { name: path65.basename(displayRef), scope, ref: displayRef, profiles: 0, languages: 0, rules: 0, error: loaded.errors[0] };
+    return { name: path64.basename(displayRef), scope, ref: displayRef, profiles: 0, languages: 0, rules: 0, error: loaded.errors[0] };
   }
   return {
-    name: loaded.packNames[0] ?? path65.basename(displayRef),
+    name: loaded.packNames[0] ?? path64.basename(displayRef),
     scope,
     ref: displayRef,
     profiles: Object.keys(loaded.profiles).length,
@@ -44916,20 +45390,20 @@ function probe(loadRef, baseRoot, scope, displayRef) {
   };
 }
 function writeFileAtomic(file, content) {
-  fs43.mkdirSync(path65.dirname(file), { recursive: true });
+  fs43.mkdirSync(path64.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
   fs43.writeFileSync(tmp, content);
   fs43.renameSync(tmp, file);
 }
 function stem(ref) {
-  return path65.basename(ref).replace(PACK_EXT_RE2, "");
+  return path64.basename(ref).replace(PACK_EXT_RE2, "");
 }
 function imagePacksDir() {
   return process.env.WAIRON_IMAGE_PACKS_DIR ?? "/opt/wairon/packs";
 }
 function probeTier(dir, tier) {
   return discoverPacks(dir).map((full) => {
-    const d = probe(full, path65.dirname(full), "global", path65.basename(full));
+    const d = probe(full, path64.dirname(full), "global", path64.basename(full));
     d.tier = tier;
     return d;
   });
@@ -44947,9 +45421,9 @@ function scanGlobalPackProfiles() {
   for (const dir of [globalPacksDir(), imagePacksDir()]) {
     for (const full of discoverPacks(dir)) {
       try {
-        const loaded = loadExtensionPacks([{ ref: full, scope: "global" }], path65.dirname(full));
+        const loaded = loadExtensionPacks([{ ref: full, scope: "global" }], path64.dirname(full));
         if (loaded.errors.length) continue;
-        const source = loaded.packNames[0] ?? path65.basename(full);
+        const source = loaded.packNames[0] ?? path64.basename(full);
         for (const [id, def] of Object.entries(loaded.profiles)) out.push({ id, source, family: def.family });
       } catch {
       }
@@ -45005,7 +45479,7 @@ function readPackContent(full) {
   if (st.isFile()) return fs43.readFileSync(full, "utf8");
   if (st.isDirectory()) {
     for (const entry of ["pack.yaml", "pack.yml"]) {
-      const p = path65.join(full, entry);
+      const p = path64.join(full, entry);
       if (fs43.existsSync(p) && fs43.statSync(p).isFile()) return fs43.readFileSync(p, "utf8");
     }
   }
@@ -45015,9 +45489,9 @@ function storeResolveGlobalPacks(names) {
   const index = /* @__PURE__ */ new Map();
   const indexTier = (dir, tier) => {
     for (const full of discoverPacks(dir)) {
-      const manifestName = probe(full, path65.dirname(full), "global", path65.basename(full)).name;
+      const manifestName = probe(full, path64.dirname(full), "global", path64.basename(full)).name;
       const candidate = { full, manifestName, tier };
-      for (const key of [manifestName, stem(full), path65.basename(full)]) {
+      for (const key of [manifestName, stem(full), path64.basename(full)]) {
         if (!index.has(key)) index.set(key, candidate);
       }
     }
@@ -45044,7 +45518,7 @@ function storeInstallGlobalPack(name, content) {
   assertName(name);
   assertDeclarative(content);
   const dir = globalPacksDir();
-  const file = path65.join(dir, `${name}.yaml`);
+  const file = path64.join(dir, `${name}.yaml`);
   writeFileAtomic(file, content);
   const descriptor = probe(file, dir, "global", `${name}.yaml`);
   descriptor.tier = "instance";
@@ -45055,7 +45529,7 @@ function storeInstallGlobalPackArchive(archive, name) {
   assertNotCodeArchive(info);
   const packName = name ?? info.name;
   assertName(packName);
-  const dir = path65.join(globalPacksDir(), packName);
+  const dir = path64.join(globalPacksDir(), packName);
   extractDeclarativeArchive(archive, dir);
   const descriptor = probe(dir, globalPacksDir(), "global", packName);
   descriptor.tier = "instance";
@@ -45066,7 +45540,7 @@ function declaredName2(loadRef, baseRoot, scope) {
   return d.error ? void 0 : d.name;
 }
 function pickByName(candidates, name, fileOf, manifestOf2) {
-  const byFile = candidates.find((c) => stem(fileOf(c)) === name || path65.basename(fileOf(c)) === name);
+  const byFile = candidates.find((c) => stem(fileOf(c)) === name || path64.basename(fileOf(c)) === name);
   if (byFile !== void 0) return byFile;
   const byManifest = candidates.filter((c) => manifestOf2(c) === name);
   if (byManifest.length > 1) {
@@ -45079,11 +45553,11 @@ function pickByName(candidates, name, fileOf, manifestOf2) {
 function storeRemoveGlobalPack(name) {
   assertName(name);
   const dir = globalPacksDir();
-  const manifestOf2 = (ref) => declaredName2(ref, path65.dirname(ref), "global");
-  const match2 = pickByName(discoverPacks(dir), name, path65.basename, manifestOf2);
+  const manifestOf2 = (ref) => declaredName2(ref, path64.dirname(ref), "global");
+  const match2 = pickByName(discoverPacks(dir), name, path64.basename, manifestOf2);
   if (!match2) {
     const inImage = discoverPacks(imagePacksDir()).some(
-      (ref) => stem(ref) === name || path65.basename(ref) === name || manifestOf2(ref) === name
+      (ref) => stem(ref) === name || path64.basename(ref) === name || manifestOf2(ref) === name
     );
     throw new Error(
       inImage ? `Pack "${name}" is an immutable image-layer pack (WAIRON_IMAGE_PACKS_DIR) and cannot be removed at runtime; rebuild the extension image without it.` : `No server-global instance pack named "${name}".`
@@ -45105,7 +45579,7 @@ function storeInstallProjectPack(name, content) {
   assertDeclarative(content);
   const root = getProjectRoot();
   const relRef = `.wai/packs/${name}.yaml`;
-  writeFileAtomic(path65.join(root, ".wai", "packs", `${name}.yaml`), content);
+  writeFileAtomic(path64.join(root, ".wai", "packs", `${name}.yaml`), content);
   return probe(relRef, root, "project", relRef);
 }
 function storeInstallProjectPackArchive(archive, name) {
@@ -45115,15 +45589,15 @@ function storeInstallProjectPackArchive(archive, name) {
   assertName(packName);
   const root = getProjectRoot();
   const relRef = `.wai/packs/${packName}`;
-  extractDeclarativeArchive(archive, path65.join(root, ".wai", "packs", packName));
+  extractDeclarativeArchive(archive, path64.join(root, ".wai", "packs", packName));
   return probe(relRef, root, "project", relRef);
 }
 function storeRemoveProjectPack(name, ref) {
   assertName(name);
   const root = getProjectRoot();
-  const resolved = path65.resolve(root, ref ?? path65.join(".wai", "packs", name));
-  const vendorDir = path65.resolve(root, ".wai", "packs");
-  if (resolved.startsWith(vendorDir + path65.sep)) {
+  const resolved = path64.resolve(root, ref ?? path64.join(".wai", "packs", name));
+  const vendorDir = path64.resolve(root, ".wai", "packs");
+  if (resolved.startsWith(vendorDir + path64.sep)) {
     fs43.rmSync(resolved, { recursive: true, force: true });
   }
 }
@@ -45146,7 +45620,7 @@ function boundProject2(cfg, project2) {
 function findPackRegistration(config, name) {
   const relRef = `.wai/packs/${name}.yaml`;
   const entries = config?.extensions?.packs ?? [];
-  const direct = entries.find((entry) => typeof entry === "string" ? entry === relRef || stem(entry) === name || path65.basename(entry) === name : entry.name === name);
+  const direct = entries.find((entry) => typeof entry === "string" ? entry === relRef || stem(entry) === name || path64.basename(entry) === name : entry.name === name);
   if (direct !== void 0) return direct;
   const root = getProjectRoot();
   const refs = entries.filter((entry) => typeof entry === "string");
@@ -45290,7 +45764,7 @@ function installProjectPackArchive(cfg, credential, project2, archive, name) {
 
 // src/server/audit.ts
 var fs44 = __toESM(require("fs"));
-var path66 = __toESM(require("path"));
+var path65 = __toESM(require("path"));
 var crypto12 = __toESM(require("crypto"));
 var LEVEL_ORDER = {
   debug: 0,
@@ -45313,7 +45787,7 @@ var DEFAULT_AUDIT_POLICY = {
   metadataMode: "redacted"
 };
 function storePath9(dataDir) {
-  return path66.join(dataDir, "audit-events.json");
+  return path65.join(dataDir, "audit-events.json");
 }
 function readEvents(dataDir) {
   const p = storePath9(dataDir);
@@ -45334,7 +45808,7 @@ function readEvents(dataDir) {
 }
 function persistEvents(dataDir, events) {
   const p = storePath9(dataDir);
-  fs44.mkdirSync(path66.dirname(p), { recursive: true });
+  fs44.mkdirSync(path65.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs44.writeFileSync(tmp, JSON.stringify(events, null, 2) + "\n");
   fs44.renameSync(tmp, p);
@@ -46026,7 +46500,7 @@ function assertAllowedRedirectUri(provider, redirectUri) {
 
 // src/server/policy.ts
 var fs45 = __toESM(require("fs"));
-var path67 = __toESM(require("path"));
+var path66 = __toESM(require("path"));
 init_fs();
 init_yaml();
 init_pack_impact();
@@ -46045,7 +46519,7 @@ function sendJson(res, status2, body) {
 
 // src/server/policy.ts
 function packPolicyPath(dataDir) {
-  return path67.join(dataDir, "pack-policy.json");
+  return path66.join(dataDir, "pack-policy.json");
 }
 function getPackPolicyRecord(dataDir) {
   const p = packPolicyPath(dataDir);
@@ -46065,14 +46539,14 @@ function getPackPolicyRecord(dataDir) {
 function setPackPolicyRecord(dataDir, policy) {
   const stored = { ...policy, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
   const p = packPolicyPath(dataDir);
-  fs45.mkdirSync(path67.dirname(p), { recursive: true });
+  fs45.mkdirSync(path66.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs45.writeFileSync(tmp, JSON.stringify(stored, null, 2) + "\n");
   fs45.renameSync(tmp, p);
   return stored;
 }
 function exposurePolicyPath(dataDir) {
-  return path67.join(dataDir, "exposure-policy.json");
+  return path66.join(dataDir, "exposure-policy.json");
 }
 var COMPATIBLE_DEFAULT_EXPOSURE = {
   adminApiMode: "local_only",
@@ -46102,7 +46576,7 @@ function getExposurePolicyRecord(dataDir) {
 }
 function setExposurePolicyRecord(dataDir, policy) {
   const p = exposurePolicyPath(dataDir);
-  fs45.mkdirSync(path67.dirname(p), { recursive: true });
+  fs45.mkdirSync(path66.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs45.writeFileSync(tmp, JSON.stringify(policy, null, 2) + "\n");
   fs45.renameSync(tmp, p);
@@ -46123,7 +46597,7 @@ function effectivePolicy(dataDir) {
   return getPackPolicyRecord(dataDir) ?? PERMISSIVE_DEFAULT_POLICY;
 }
 function identityProvidersPath(dataDir) {
-  return path67.join(dataDir, "identity-providers.json");
+  return path66.join(dataDir, "identity-providers.json");
 }
 function sanitizeIdentityProvider(config) {
   const clean = {
@@ -46147,7 +46621,7 @@ function sanitizeIdentityProvider(config) {
 }
 function writeIdentityProviderRecords(dataDir, records) {
   const p = identityProvidersPath(dataDir);
-  fs45.mkdirSync(path67.dirname(p), { recursive: true });
+  fs45.mkdirSync(path66.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs45.writeFileSync(tmp, JSON.stringify(records, null, 2) + "\n");
   fs45.renameSync(tmp, p);
@@ -47239,10 +47713,10 @@ init_fs();
 
 // src/server/relations.ts
 var fs46 = __toESM(require("fs"));
-var path68 = __toESM(require("path"));
+var path67 = __toESM(require("path"));
 var crypto15 = __toESM(require("crypto"));
 function storePath10(dataDir) {
-  return path68.join(dataDir, "relations.json");
+  return path67.join(dataDir, "relations.json");
 }
 function readRelations(dataDir) {
   const p = storePath10(dataDir);
@@ -47263,7 +47737,7 @@ function readRelations(dataDir) {
 }
 function persistRelations(dataDir, relations) {
   const p = storePath10(dataDir);
-  fs46.mkdirSync(path68.dirname(p), { recursive: true });
+  fs46.mkdirSync(path67.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs46.writeFileSync(tmp, JSON.stringify(relations, null, 2) + "\n");
   fs46.renameSync(tmp, p);
@@ -47377,9 +47851,9 @@ function listProjectRelations(dataDir, sourceProjectId, targetProjectId, status2
 
 // src/server/surfaces.ts
 var fs47 = __toESM(require("fs"));
-var path69 = __toESM(require("path"));
+var path68 = __toESM(require("path"));
 function storePath11(dataDir) {
-  return path69.join(dataDir, "public-surfaces.json");
+  return path68.join(dataDir, "public-surfaces.json");
 }
 function readSnapshots(dataDir) {
   const p = storePath11(dataDir);
@@ -47400,7 +47874,7 @@ function readSnapshots(dataDir) {
 }
 function persistSnapshots(dataDir, snapshots) {
   const p = storePath11(dataDir);
-  fs47.mkdirSync(path69.dirname(p), { recursive: true });
+  fs47.mkdirSync(path68.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs47.writeFileSync(tmp, JSON.stringify(snapshots, null, 2) + "\n");
   fs47.renameSync(tmp, p);
@@ -47546,12 +48020,12 @@ function resolveVisibility(observerProjectId, units, placements) {
   const best = /* @__PURE__ */ new Map();
   for (const placement of placements) {
     if (placement.projectId === observerProjectId) continue;
-    const path83 = chainOf(placement.unitId, unitById);
-    if (!path83.length) continue;
-    const closedOk = path83.every((u) => effectivePosture(u, unitById) !== "closed" || observerInside(u.id) || grantedTo(u));
+    const path82 = chainOf(placement.unitId, unitById);
+    if (!path82.length) continue;
+    const closedOk = path82.every((u) => effectivePosture(u, unitById) !== "closed" || observerInside(u.id) || grantedTo(u));
     if (!closedOk) continue;
-    const crossTenant = !tenantRoots.has(path83[path83.length - 1].id);
-    if (crossTenant && !path83.some(grantedTo)) continue;
+    const crossTenant = !tenantRoots.has(path82[path82.length - 1].id);
+    if (crossTenant && !path82.some(grantedTo)) continue;
     if (crossTenant && directUnits.length === 0) continue;
     const distance = crossTenant ? "partner" : sameBranch(placement.unitId) ? "department" : "instance";
     const existing = best.get(placement.projectId);
@@ -48171,7 +48645,7 @@ function handleLandscapeRequest(cfg, credential, req, res, body, url) {
 
 // src/server/migration.ts
 var fs48 = __toESM(require("fs"));
-var path70 = __toESM(require("path"));
+var path69 = __toESM(require("path"));
 var LEGACY_CAPABILITY_MAP = {
   "mcp:read": "project:read",
   "operations:read": "project:read",
@@ -48209,7 +48683,7 @@ function readRaw(file) {
   }
 }
 function writeRaw(file, value) {
-  fs48.mkdirSync(path70.dirname(file), { recursive: true });
+  fs48.mkdirSync(path69.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
   fs48.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n");
   fs48.renameSync(tmp, file);
@@ -48246,13 +48720,13 @@ function migratePermissionModel(dataDir, apply3) {
     findings.push({ area, detail });
   };
   const grid = readRaw(
-    path70.join(dataDir, "permissions.json")
+    path69.join(dataDir, "permissions.json")
   ) ?? [];
   if (!getInstanceIdentity(dataDir)) {
     found("instance", "instance identity is not seeded \u2014 the built-in admin/dev subjects have no persisted UUIDs");
     if (apply3) ensureInstanceIdentity(dataDir);
   }
-  const orgPath = path70.join(dataDir, "organization.json");
+  const orgPath = path69.join(dataDir, "organization.json");
   const org = readRaw(orgPath);
   if (org?.units?.length) {
     const units = org.units;
@@ -48306,7 +48780,7 @@ function migratePermissionModel(dataDir, apply3) {
       found("units", `${remap.length} unit id(s) would be remapped across placements, exposeTo, assignments, and users`);
     }
   }
-  const usersPath = path70.join(dataDir, "users.json");
+  const usersPath = path69.join(dataDir, "users.json");
   const users = readRaw(usersPath);
   if (users) {
     let changed = false;
@@ -48333,7 +48807,7 @@ function migratePermissionModel(dataDir, apply3) {
     }
     if (apply3 && changed) writeRaw(usersPath, users);
   }
-  const keysPath = path70.join(dataDir, "auth", "credentials.json");
+  const keysPath = path69.join(dataDir, "auth", "credentials.json");
   const keys = readRaw(keysPath);
   if (keys) {
     let changed = false;
@@ -48383,7 +48857,7 @@ function migratePermissionModel(dataDir, apply3) {
     }
     if (apply3 && changed) writeRaw(keysPath, keys);
   }
-  const sessionsPath = path70.join(dataDir, "web-sessions.json");
+  const sessionsPath = path69.join(dataDir, "web-sessions.json");
   const sessions = readRaw(sessionsPath);
   if (sessions) {
     let changed = false;
@@ -48463,7 +48937,7 @@ function migratePermissionModel(dataDir, apply3) {
 // src/server/http.ts
 var http2 = __toESM(require("http"));
 var fs56 = __toESM(require("fs"));
-var path78 = __toESM(require("path"));
+var path77 = __toESM(require("path"));
 
 // src/server/request.ts
 var import_streamableHttp = require("@modelcontextprotocol/sdk/server/streamableHttp.js");
@@ -48477,10 +48951,10 @@ function createScopedServer() {
 
 // src/server/approvals.ts
 var fs49 = __toESM(require("fs"));
-var path71 = __toESM(require("path"));
+var path70 = __toESM(require("path"));
 var crypto16 = __toESM(require("crypto"));
 function storePath12(dataDir) {
-  return path71.join(dataDir, "approvals.json");
+  return path70.join(dataDir, "approvals.json");
 }
 function readRequests(dataDir) {
   const p = storePath12(dataDir);
@@ -48501,7 +48975,7 @@ function readRequests(dataDir) {
 }
 function persistRequests(dataDir, requests) {
   const p = storePath12(dataDir);
-  fs49.mkdirSync(path71.dirname(p), { recursive: true });
+  fs49.mkdirSync(path70.dirname(p), { recursive: true });
   const tmp = `${p}.tmp`;
   fs49.writeFileSync(tmp, JSON.stringify(requests, null, 2) + "\n");
   fs49.renameSync(tmp, p);
@@ -48634,6 +49108,33 @@ var ApprovalRegistry = class {
     this.store.replaceAll(next);
     return completed2;
   }
+  /**
+   * Locate the request by id (not-found error when absent) and transition it to
+   * cancelled only from an approved status (any other status is a validation
+   * error), recording the reason as its executionSummary, then persist and
+   * refresh the store. Used when the approved workflow refused because the
+   * request no longer describes what would be done; a cancelled request is
+   * final and is never executed.
+   */
+  cancel(id, reason) {
+    const requests = this.store.all();
+    const idx = requests.findIndex((r) => r.id === id);
+    if (idx === -1) {
+      throw new Error(`Approval request "${id}" not found.`);
+    }
+    const current2 = requests[idx];
+    if (current2.status !== "approved") {
+      throw new Error(
+        `Approval request "${id}" is ${current2.status}, not approved; only an approved request can be cancelled.`
+      );
+    }
+    const cancelled = { ...current2, status: "cancelled", executionSummary: reason };
+    const next = [...requests];
+    next[idx] = cancelled;
+    persistRequests(this.dataDir, next);
+    this.store.replaceAll(next);
+    return cancelled;
+  }
   /**
    * Flip every pending request whose expiresAt is at or before the supplied
    * now-timestamp to expired and return the count flipped. A set with no overdue
@@ -48705,6 +49206,11 @@ function markApprovalCompleted(dataDir, id, executionSummary) {
   store.load();
   return new ApprovalRegistry(dataDir, store).markCompleted(id, executionSummary);
 }
+function cancelApprovalRequest(dataDir, id, reason) {
+  const store = new ApprovalStore(dataDir);
+  store.load();
+  return new ApprovalRegistry(dataDir, store).cancel(id, reason);
+}
 function expirePendingApprovals(dataDir, now) {
   const store = new ApprovalStore(dataDir);
   store.load();
@@ -48863,12 +49369,16 @@ function lockProject2(cfg, credential, projectId, subproject) {
       return {
         status: "completed",
         action: "project:lock",
-        summary: `Locked project "${projectId}"${subprojectSuffix(subproject)} (status: ${lock.status}).`,
+        summary: `Locked project "${projectId}"${subprojectSuffix(subproject)} (status: ${lock.status}). ${codeBesideClaim(lock)}.`,
         lock
       };
     }
   });
 }
+function codeBesideClaim(lock) {
+  if (!lock.code) return "code: no code analysis recorded";
+  return `code: ${lock.code.errors} errors recorded beside the claim (${lock.code.warnings} warnings; analyzer ${lock.code.analyzer.validatorVersion}, grade ${lock.code.analyzer.grade})`;
+}
 function subprojectSuffix(subproject) {
   return subproject ? ` subproject "${subproject}"` : "";
 }
@@ -48909,12 +49419,13 @@ function lifecycleAction(cfg, credential, projectId, opts) {
       if (!existingProjectRoot(cfg.dataDir, projectId)) {
         throw new Error(`Unknown project "${projectId}".`);
       }
+      const gateStateId = gateIdentity(cfg, projectId, opts.subproject);
       const pending = buildPendingRequest(
         principal,
         opts.action,
         `${opts.verb} project ${projectId}${subprojectSuffix(opts.subproject)}`,
         projectId,
-        subprojectScopePayload(opts.subproject)
+        { ...subprojectScopePayload(opts.subproject), gateStateId }
       );
       return createPendingOutcome(cfg, principal, pending, opts.action);
     }
@@ -48997,13 +49508,31 @@ function executeApproved(cfg, req) {
     }
     case "project:lock": {
       const scope = readSubprojectScope(req);
-      const lock = executeApprovedLock(cfg, req.projectId ?? "", hostedApprover(req.decidedBy), scope);
-      return { outcome: `Locked project "${req.projectId}"${subprojectSuffix(scope)} (status: ${lock.status}).` };
+      const lock = lockAsRequested(cfg, req, scope);
+      return {
+        outcome: `Locked project "${req.projectId}"${subprojectSuffix(scope)} (status: ${lock.status}). ${codeBesideClaim(lock)}.`
+      };
     }
     default:
       throw new Error(`Unsupported approval kind "${req.kind}".`);
   }
 }
+function lockAsRequested(cfg, req, scope) {
+  try {
+    return executeApprovedLock(cfg, req.projectId ?? "", hostedApprover(req.decidedBy), scope, req.gateStateId);
+  } catch (err) {
+    const moved = designMovedSince(err);
+    if (!moved) throw err;
+    const reason = `the design changed since it was requested (requested ${moved.requested}, now ${moved.now}); request the lock again`;
+    cancelApprovalRequest(cfg.dataDir, req.id, reason);
+    throw new Error(`Approval request "${req.id}" was cancelled: ${reason}.`);
+  }
+}
+function designMovedSince(err) {
+  if (!(err instanceof Error) || err.name !== "LockRefusedError") return null;
+  const { requested, now } = err;
+  return typeof requested === "string" && typeof now === "string" ? { requested, now } : null;
+}
 function executeApprovedRequest(cfg, credential, requestId) {
   const principal = requirePrincipal7(cfg, credential);
   const req = getApprovalRequestById(cfg.dataDir, requestId);
@@ -49042,7 +49571,7 @@ async function awaitApproval(cfg, credential, requestId, timeoutSeconds) {
   let current2 = req;
   while (current2.status === "pending" && Date.now() < deadline) {
     const remaining = deadline - Date.now();
-    await new Promise((resolve39) => setTimeout(resolve39, Math.min(AWAIT_POLL_INTERVAL_MS, remaining)));
+    await new Promise((resolve40) => setTimeout(resolve40, Math.min(AWAIT_POLL_INTERVAL_MS, remaining)));
     expirePendingApprovals(cfg.dataDir, (/* @__PURE__ */ new Date()).toISOString());
     current2 = getApprovalRequestById(cfg.dataDir, requestId) ?? current2;
   }
@@ -49330,11 +49859,11 @@ function handleOperationsRequest(cfg, credential, req, res, url) {
 
 // src/server/gitbacking.ts
 var fs50 = __toESM(require("fs"));
-var path72 = __toESM(require("path"));
+var path71 = __toESM(require("path"));
 var crypto17 = __toESM(require("crypto"));
 var import_child_process6 = require("child_process");
 function storePath13(dataDir) {
-  return path72.join(dataDir, "git-backing.json");
+  return path71.join(dataDir, "git-backing.json");
 }
 var GitBackingStore = class {
   constructor(dataDir) {
@@ -49365,7 +49894,7 @@ var GitBackingStore = class {
   /** Swap the persisted collection wholesale via write-temp-then-rename. */
   replaceAll(bindings) {
     const p = storePath13(this.dataDir);
-    fs50.mkdirSync(path72.dirname(p), { recursive: true });
+    fs50.mkdirSync(path71.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
     fs50.writeFileSync(tmp, JSON.stringify(bindings, null, 2) + "\n");
     fs50.renameSync(tmp, p);
@@ -49473,7 +50002,7 @@ function checkoutBranch(workdir, branch) {
   }
 }
 function cloneOrOpen(remote, branch, workdir, credentialRef) {
-  if (!fs50.existsSync(path72.join(workdir, ".git"))) {
+  if (!fs50.existsSync(path71.join(workdir, ".git"))) {
     fs50.mkdirSync(workdir, { recursive: true });
     git2(["clone", authRemote2(remote, credentialRef), "."], workdir);
     git2(["config", "user.name", process.env["WAIRON_GIT_NAME"] || "wairon-bot"], workdir);
@@ -49489,7 +50018,7 @@ function mirrorTree(sourceDir, targetDir) {
   fs50.rmSync(targetDir, { recursive: true, force: true });
   const stat = fs50.statSync(sourceDir, { throwIfNoEntry: false });
   if (!stat) return;
-  fs50.mkdirSync(path72.dirname(targetDir), { recursive: true });
+  fs50.mkdirSync(path71.dirname(targetDir), { recursive: true });
   fs50.cpSync(sourceDir, targetDir, { recursive: true });
 }
 function commitAndPush(workdir, message) {
@@ -49612,7 +50141,7 @@ function unbindScope(cfg, credential, bindingId) {
   tryAppendAudit7(cfg, buildAuditEvent6(principal, "git.backing.unbind", "security", bindingId));
 }
 function runMirrorSync(cfg, binding) {
-  const workdir = path72.join(cfg.dataDir, "git-backing", binding.id);
+  const workdir = path71.join(cfg.dataDir, "git-backing", binding.id);
   cloneOrOpen(binding.remote, binding.branch, workdir, binding.credentialRef);
   if (binding.scopeKind === "unit") {
     const units = listOrganizationUnits(cfg.dataDir);
@@ -49620,23 +50149,23 @@ function runMirrorSync(cfg, binding) {
     const placedIds = new Set(
       listProjectPlacements(cfg.dataDir).filter((p) => subtree.has(p.unitId)).map((p) => p.projectId)
     );
-    const projectsDir = path72.join(workdir, "projects");
+    const projectsDir = path71.join(workdir, "projects");
     fs50.rmSync(projectsDir, { recursive: true, force: true });
     for (const rec of listProjectRecords(cfg.dataDir)) {
       if (!placedIds.has(rec.id)) continue;
-      mirrorTree(path72.join(rec.rootPath, ".wai"), path72.join(projectsDir, rec.id, ".wai"));
+      mirrorTree(path71.join(rec.rootPath, ".wai"), path71.join(projectsDir, rec.id, ".wai"));
     }
   } else {
-    const instanceDir = path72.join(workdir, "instance");
+    const instanceDir = path71.join(workdir, "instance");
     fs50.rmSync(instanceDir, { recursive: true, force: true });
     const files = binding.includeCredentials ? INSTANCE_STRUCTURE_FILES : INSTANCE_STRUCTURE_FILES.filter((rel2) => rel2 !== "auth/credentials.json");
     for (const rel2 of files) {
-      mirrorTree(path72.join(cfg.dataDir, rel2), path72.join(instanceDir, rel2));
+      mirrorTree(path71.join(cfg.dataDir, rel2), path71.join(instanceDir, rel2));
     }
-    const projectsDir = path72.join(workdir, "projects");
+    const projectsDir = path71.join(workdir, "projects");
     fs50.rmSync(projectsDir, { recursive: true, force: true });
     for (const rec of listProjectRecords(cfg.dataDir)) {
-      mirrorTree(path72.join(rec.rootPath, ".wai"), path72.join(projectsDir, rec.id, ".wai"));
+      mirrorTree(path71.join(rec.rootPath, ".wai"), path71.join(projectsDir, rec.id, ".wai"));
     }
   }
   const published = commitAndPush(
@@ -49960,7 +50489,7 @@ function encodeFrame(opcode, payload) {
 // src/server/web.ts
 var crypto23 = __toESM(require("crypto"));
 var fs55 = __toESM(require("fs"));
-var path77 = __toESM(require("path"));
+var path76 = __toESM(require("path"));
 
 // src/server/webadmin.ts
 function listUsers3(cfg, sessionId, project2) {
@@ -50215,14 +50744,14 @@ var crypto22 = __toESM(require("crypto"));
 
 // src/server/sharesnapshots.ts
 var fs51 = __toESM(require("fs"));
-var path73 = __toESM(require("path"));
+var path72 = __toESM(require("path"));
 var crypto19 = __toESM(require("crypto"));
 init_fs();
 function snapshotDir(dataDir) {
-  return path73.join(dataDir, "share-snapshots");
+  return path72.join(dataDir, "share-snapshots");
 }
 function snapshotPath2(dataDir, id) {
-  return path73.join(snapshotDir(dataDir), `${id}.json`);
+  return path72.join(snapshotDir(dataDir), `${id}.json`);
 }
 var ShareSnapshotStore = class {
   constructor(dataDir) {
@@ -50231,7 +50760,7 @@ var ShareSnapshotStore = class {
   write(snapshot) {
     const p = snapshotPath2(this.dataDir, snapshot.id);
     if (fs51.existsSync(p)) return;
-    fs51.mkdirSync(path73.dirname(p), { recursive: true });
+    fs51.mkdirSync(path72.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
     fs51.writeFileSync(tmp, JSON.stringify(snapshot, null, 2) + "\n");
     fs51.renameSync(tmp, p);
@@ -50333,10 +50862,10 @@ function captureSnapshot(dataDir, principal, projectId, view, artifacts) {
 
 // src/server/sharelinks.ts
 var fs52 = __toESM(require("fs"));
-var path74 = __toESM(require("path"));
+var path73 = __toESM(require("path"));
 var crypto20 = __toESM(require("crypto"));
 function storePath14(dataDir) {
-  return path74.join(dataDir, "share-links.json");
+  return path73.join(dataDir, "share-links.json");
 }
 var ShareLinkStore = class {
   constructor(dataDir) {
@@ -50364,7 +50893,7 @@ var ShareLinkStore = class {
   }
   replaceAll(links) {
     const p = storePath14(this.dataDir);
-    fs52.mkdirSync(path74.dirname(p), { recursive: true });
+    fs52.mkdirSync(path73.dirname(p), { recursive: true });
     const tmp = `${p}.tmp`;
     fs52.writeFileSync(tmp, JSON.stringify(links, null, 2) + "\n");
     fs52.renameSync(tmp, p);
@@ -50436,10 +50965,10 @@ function listProjectLinks(dataDir, projectId) {
 
 // src/server/shareaccesslog.ts
 var fs53 = __toESM(require("fs"));
-var path75 = __toESM(require("path"));
+var path74 = __toESM(require("path"));
 var crypto21 = __toESM(require("crypto"));
 function storePath15(dataDir) {
-  return path75.join(dataDir, "share-access.json");
+  return path74.join(dataDir, "share-access.json");
 }
 var ShareAccessStore = class {
   constructor(dataDir) {
@@ -50467,7 +50996,7 @@ var ShareAccessStore = class {
   }
   append(entry) {
     const p = storePath15(this.dataDir);
-    fs53.mkdirSync(path75.dirname(p), { recursive: true });
+    fs53.mkdirSync(path74.dirname(p), { recursive: true });
     const next = [...this.load(), entry];
     const tmp = `${p}.tmp`;
     fs53.writeFileSync(tmp, JSON.stringify(next, null, 2) + "\n");
@@ -50623,15 +51152,15 @@ init_fs();
 
 // src/server/swagger.ts
 var fs54 = __toESM(require("fs"));
-var path76 = __toESM(require("path"));
+var path75 = __toESM(require("path"));
 var cache;
 function loadAssets() {
   if (cache !== void 0) return cache;
   try {
-    const dir = path76.dirname(require.resolve("swagger-ui-dist/package.json"));
+    const dir = path75.dirname(require.resolve("swagger-ui-dist/package.json"));
     cache = {
-      css: fs54.readFileSync(path76.join(dir, "swagger-ui.css"), "utf8"),
-      js: fs54.readFileSync(path76.join(dir, "swagger-ui-bundle.js"), "utf8")
+      css: fs54.readFileSync(path75.join(dir, "swagger-ui.css"), "utf8"),
+      js: fs54.readFileSync(path75.join(dir, "swagger-ui-bundle.js"), "utf8")
     };
   } catch {
     cache = null;
@@ -51043,11 +51572,11 @@ function nonceMatches(a, b) {
 }
 function loadReactBundle() {
   const candidates = [
-    path77.resolve(__dirname, "webapp.html"),
+    path76.resolve(__dirname, "webapp.html"),
     // dist/index.js -> dist/webapp.html
-    path77.resolve(__dirname, "..", "webapp.html"),
+    path76.resolve(__dirname, "..", "webapp.html"),
     // dist/cli/index.js -> dist/webapp.html
-    path77.resolve(__dirname, "..", "..", "web", "dist", "index.html")
+    path76.resolve(__dirname, "..", "..", "web", "dist", "index.html")
     // tsx dev: src/server -> web/dist
   ];
   for (const candidate of candidates) {
@@ -53618,6 +54147,7 @@ async function handleWebRequest(cfg, req, res, body, url, ctx) {
       const errors = err.errors;
       return sendJson(res, 409, { error: err.message, errors });
     }
+    if (err instanceof Error && err.name === "LockRefusedError") return sendJson(res, 409, { error: err.message });
     const msg = err instanceof Error ? err.message : String(err);
     if (/unsupported graph tier/i.test(msg)) return sendJson(res, 400, { error: msg });
     if (/not found|unknown/i.test(msg)) return sendJson(res, 404, { error: msg });
@@ -53644,8 +54174,8 @@ var RealtimeHub = class {
    *  complete the handshake, and register the connection. A bad path or session
    *  destroys the socket. */
   handleUpgrade(cfg, req, socket) {
-    const path83 = (req.url ?? "/").split("?")[0];
-    if (path83 !== REALTIME_PATH || !isWebSocketUpgrade(req)) {
+    const path82 = (req.url ?? "/").split("?")[0];
+    if (path82 !== REALTIME_PATH || !isWebSocketUpgrade(req)) {
       socket.destroy();
       return;
     }
@@ -54653,7 +55183,7 @@ function routeData(cfg, req, res) {
 }
 function readExposurePolicyFile(dataDir) {
   try {
-    const raw = fs56.readFileSync(path78.join(dataDir, "exposure-policy.json"), "utf8");
+    const raw = fs56.readFileSync(path77.join(dataDir, "exposure-policy.json"), "utf8");
     const parsed = JSON.parse(raw);
     return parsed && typeof parsed === "object" ? parsed : void 0;
   } catch {
@@ -54842,6 +55372,7 @@ async function routeAdmin(cfg, req, res) {
     if (err instanceof ForbiddenError) return sendJson(res, 403, { error: err.message });
     if (err instanceof AdminAuthError) return sendJson(res, 403, { error: "forbidden" });
     if (err instanceof LockValidationError) return sendJson(res, 409, { error: err.message, errors: err.errors });
+    if (err instanceof Error && err.name === "LockRefusedError") return sendJson(res, 409, { error: err.message });
     sendJson(res, 400, { error: err instanceof Error ? err.message : String(err) });
   }
 }
@@ -55352,9 +55883,9 @@ function seedDemoTree() {
 
 // src/commands/host.ts
 function resolveHostConfig(options) {
-  const dataDir = options.dataDir || process.env["WAIRON_DATA_DIR"] || path79.join(os11.homedir(), ".wairon", "data");
+  const dataDir = options.dataDir || process.env["WAIRON_DATA_DIR"] || path78.join(os11.homedir(), ".wairon", "data");
   if (!process.env["WAIRON_PACKS_DIR"]) {
-    process.env["WAIRON_PACKS_DIR"] = path79.join(dataDir, "packs");
+    process.env["WAIRON_PACKS_DIR"] = path78.join(dataDir, "packs");
   }
   const cfg = {
     host: options.host || "0.0.0.0",
@@ -55411,11 +55942,11 @@ async function runServe(options = {}) {
   logger.info(`  data dir:    ${import_chalk17.default.gray(cfg.dataDir)}`);
   logger.blank();
   logger.info("Press Ctrl+C to stop.");
-  await new Promise((resolve39) => {
+  await new Promise((resolve40) => {
     const shutdown = () => {
       logger.info("Shutting down\u2026");
       handle.close();
-      resolve39();
+      resolve40();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -55435,13 +55966,13 @@ function openBrowser(url) {
 }
 async function runDev(options = {}) {
   const cwd = process.cwd();
-  if (!fs57.existsSync(path79.join(cwd, ".wai"))) {
+  if (!fs57.existsSync(path78.join(cwd, ".wai"))) {
     throw new WaironError(
       "No .wai/ found in the current directory. Run `wairon dev` from a wairon project root (or run `wairon init` first)."
     );
   }
   const hash = crypto24.createHash("sha256").update(cwd).digest("hex").slice(0, 16);
-  const dataDir = path79.join(os11.tmpdir(), "wairon-dev", hash);
+  const dataDir = path78.join(os11.tmpdir(), "wairon-dev", hash);
   fs57.mkdirSync(dataDir, { recursive: true });
   const port = options.port ? Number(options.port) : 8080;
   const exposurePolicy = {
@@ -55480,11 +56011,11 @@ async function runDev(options = {}) {
   logger.blank();
   logger.info("An agent edits specs; refresh the page to see the live graph. Press Ctrl+C to stop.");
   if (options.open) openBrowser(url);
-  await new Promise((resolve39) => {
+  await new Promise((resolve40) => {
     const shutdown = () => {
       logger.info("Shutting down\u2026");
       handle.close();
-      resolve39();
+      resolve40();
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -55880,8 +56411,8 @@ async function runHostPacks(action, options = {}) {
       }
       case "install": {
         if (!options.file) throw new WaironError("`--file <path>` (a declarative pack YAML) is required for install.");
-        const name = options.name ?? path79.basename(options.file).replace(/\.(ya?ml)$/i, "");
-        const content = fs57.readFileSync(path79.resolve(options.file), "utf8");
+        const name = options.name ?? path78.basename(options.file).replace(/\.(ya?ml)$/i, "");
+        const content = fs57.readFileSync(path78.resolve(options.file), "utf8");
         if (project2 && !hostPackWriteUnattended(options.yes)) {
           printHostPackImpact(previewProjectPack(cfg, cred, project2, name, content));
           if (!await askHostPackWrite(`Install the pack "${name}" into ${scope}?`)) {
@@ -56184,7 +56715,7 @@ async function runExternals(action, aliases, options = {}) {
 
 // src/commands/remote.ts
 var fs59 = __toESM(require("fs"));
-var path81 = __toESM(require("path"));
+var path80 = __toESM(require("path"));
 var import_chalk21 = __toESM(require("chalk"));
 init_logger();
 init_errors();
@@ -56195,15 +56726,15 @@ init_mcp();
 // src/commands/remotebinding.ts
 var fs58 = __toESM(require("fs"));
 var os12 = __toESM(require("os"));
-var path80 = __toESM(require("path"));
+var path79 = __toESM(require("path"));
 init_paths();
 var BINDING_FILE = "remote.json";
 var CREDENTIALS_FILE = "credentials.json";
 function bindingPath(root) {
-  return path80.join(aiPathsAt(root).root(), BINDING_FILE);
+  return path79.join(aiPathsAt(root).root(), BINDING_FILE);
 }
 function credentialsPath() {
-  return path80.join(os12.homedir(), ".wairon", CREDENTIALS_FILE);
+  return path79.join(os12.homedir(), ".wairon", CREDENTIALS_FILE);
 }
 function normalizeInstanceUrl(url) {
   return url.trim().replace(/\/+$/, "").toLowerCase();
@@ -56217,7 +56748,7 @@ function readJson(file) {
   }
 }
 function writeJsonAtomic(file, value, mode) {
-  fs58.mkdirSync(path80.dirname(file), { recursive: true });
+  fs58.mkdirSync(path79.dirname(file), { recursive: true });
   const tmp = `${file}.tmp`;
   fs58.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", mode !== void 0 ? { mode } : void 0);
   fs58.renameSync(tmp, file);
@@ -56559,7 +57090,7 @@ async function runRemote(action, options = {}) {
         allowPartial: options.allowPartial === true
       };
       if (options.archive) transfer.archivePath = options.archive;
-      if (options.dir) transfer.destDir = path81.resolve(options.dir);
+      if (options.dir) transfer.destDir = path80.resolve(options.dir);
       report2(await pullTree(target, transfer));
       return;
     }
@@ -56643,9 +57174,9 @@ function topProjectId2(selector) {
 }
 function writeArchiveIfAsked(archive, archivePath, suggestedFileName) {
   if (!archivePath) return void 0;
-  const resolved = path81.resolve(archivePath);
-  const target = fs59.existsSync(resolved) && fs59.statSync(resolved).isDirectory() ? path81.join(resolved, suggestedFileName) : resolved;
-  fs59.mkdirSync(path81.dirname(target), { recursive: true });
+  const resolved = path80.resolve(archivePath);
+  const target = fs59.existsSync(resolved) && fs59.statSync(resolved).isDirectory() ? path80.join(resolved, suggestedFileName) : resolved;
+  fs59.mkdirSync(path80.dirname(target), { recursive: true });
   fs59.writeFileSync(target, Buffer.from(archive));
   return target;
 }
@@ -56791,14 +57322,15 @@ program.command("init").description("Initialize wairon and bootstrap the SDD Spe
     await addPack(source, false, opts.yes);
   }
 });
-program.command("generate").description("Generate agent output files from the spec tree").option("--target <type>", "limit to a specific target (claude|gemini|custom)").option("--domain <id>", "limit to agents in a single domain").option("--domains <ids>", "limit to a comma-separated list of domain ids").option("--root", "only generate root-level agents").option("--no-recurse", "only generate this project's layer; do not cascade into chained subprojects").option("--no-prune", "do not remove wairon-managed agent files that are no longer in the topology").option("--dry-run", "preview what would be generated without writing files").action(async (opts) => {
+program.command("generate").description("Generate agent output files from the spec tree").option("--target <type>", "limit to a specific target (claude|gemini|custom)").option("--domain <id>", "limit to agents in a single domain").option("--domains <ids>", "limit to a comma-separated list of domain ids").option("--root", "only generate root-level agents").option("--family", "also generate each member's own layer in its own root (generate never cascades otherwise)").option("--no-recurse", "accepted for one release: generating only this project's layer is now the default").option("--no-prune", "do not remove wairon-managed agent files that are no longer in the topology").option("--dry-run", "preview what would be generated without writing files").action(async (opts) => {
   await runGenerate({
     target: opts.target,
     domain: opts.domain,
     domains: opts.domains,
     root: opts.root,
-    // commander maps --no-recurse / --no-prune to opts.recurse/opts.prune === false
-    recurse: opts.recurse,
+    // --family walks the members explicitly; --no-recurse is the default now
+    // and is accepted for one release. commander maps --no-prune to opts.prune === false.
+    family: opts.family === true,
     prune: opts.prune,
     dryRun: opts.dryRun
   });
@@ -56811,16 +57343,17 @@ async function runLock2(options) {
   }
   const projectConfig = loadProjectConfig();
   if (!projectConfig) throw new ProjectNotInitializedError();
+  const captured = computeGateStateId();
   logger.info("Analyzing and validating specifications in-memory...");
   const dry = validateAsComplete({
     rules: projectConfig.rules,
     projectType: projectConfig.projectType,
-    scopeSubsystem: options.subsystem,
-    recursive: options.recursive ?? true
+    scopeSubsystem: options.subsystem
   });
-  const errors = dry.issues.filter((i) => i.severity === "error");
+  const design = designOnly(dry);
+  const errors = design.issues.filter((i) => i.severity === "error");
   if (errors.length > 0) {
-    logger.header("Cannot lock \u2014 the spec tree does not validate as complete");
+    logger.header("Cannot lock \u2014 the design does not validate as complete");
     let errorCount = 0;
     const MAX_PRINT = 100;
     let skippedErrors = 0;
@@ -56840,7 +57373,7 @@ async function runLock2(options) {
     process.exit(1);
   }
   logger.header("Lock SDD specs");
-  const record2 = await runLock(options, dry);
+  const record2 = await runLock(options, dry, captured);
   if (!record2) {
     logger.info("Cancelled. Nothing was changed.");
     return;
@@ -56850,6 +57383,11 @@ async function runLock2(options) {
   logger.blank();
   logger.success("Specs locked and generated outputs reconciled.");
   logger.info(`Lock record written (.wai/lock.json): stateId ${record2.stateId.algorithm}:${record2.stateId.digest} \u2014 status ${record2.status}.`);
+  for (const [alias, pin2] of Object.entries(record2.members ?? {})) {
+    logger.info(`  member ${alias}: ${pin2.state}${pin2.subject ? ` (${pin2.subject.slice(0, 26)}\u2026)` : ""}`);
+  }
+  const code = record2.code;
+  logger.info(code ? `code: ${code.errors} error(s), ${code.warnings} warning(s) recorded beside the claim (analyzer ${code.analyzer.validatorVersion}, grade ${code.analyzer.grade}) \u2014 CI enforces them, not the lock` : "code: no code analysis recorded");
   logger.info(
     "Live agent briefs (sdd_get_agent_brief / wairon-agent://) are composed per call and already current \u2014 no session restart needed."
   );
@@ -57067,7 +57605,7 @@ async function runAgent(action, id) {
     }
     case "customize": {
       const brief = composeAgentBrief(id);
-      const guidancePath = path82.join(AI_PATHS.root(), "agents", `${id}.md`);
+      const guidancePath = path81.join(AI_PATHS.root(), "agents", `${id}.md`);
       const relPath = `.wai/agents/${id}.md`;
       if (pathExists(guidancePath)) {
         throw new GuidanceFileExistsError(relPath);