@wairon/cli 5.1.1-dev.85 → 5.1.1-dev.86

package/dist/index.js

@@ -3317,8 +3317,8 @@ var require_dist = __commonJS({
       return normalized === "." ? ".wai/" : `${normalized}/.wai/`;
     }
     function normalizeRootPath(relativePath) {
-      const posix2 = relativePath.split(path210.sep).join("/").replace(/^\.\//, "").replace(/\/+$/, "");
-      return posix2 === "" || posix2 === "." ? "." : posix2;
+      const posix3 = relativePath.split(path210.sep).join("/").replace(/^\.\//, "").replace(/\/+$/, "");
+      return posix3 === "" || posix3 === "." ? "." : posix3;
     }
     function slugify(projectName) {
       const slug2 = projectName.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
@@ -3542,6 +3542,7 @@ __export(src_exports, {
   complexityLevel: () => complexityLevel,
   composeAgentBrief: () => composeAgentBrief,
   composeRuleSequence: () => composeRuleSequence,
+  computeOwnStateId: () => computeOwnStateId,
   computeStateId: () => computeStateId,
   computeStateIdAt: () => computeStateIdAt,
   conceptNoun: () => conceptNoun,
@@ -3552,7 +3553,6 @@ __export(src_exports, {
   createEmptyTopologyConfig: () => createEmptyTopologyConfig,
   createMember: () => createMember,
   createProjectConfig: () => createProjectConfig,
-  currentChildPins: () => currentChildPins,
   currentRootBinding: () => currentRootBinding,
   declareExternal: () => declareExternal,
   declaredExternals: () => declaredExternals,
@@ -3632,6 +3632,7 @@ __export(src_exports, {
   isProjectInitialized: () => isProjectInitialized,
   isProvidedBy: () => isProvidedBy,
   isRetired: () => isRetired,
+  judgesCode: () => judgesCode,
   keyIn: () => keyIn,
   landReference: () => landReference,
   listDirectChainedSubprojects: () => listDirectChainedSubprojects,
@@ -3674,7 +3675,6 @@ __export(src_exports, {
   moveMember: () => moveMember,
   moveMethods: () => moveMethods,
   moveMountToMembers: () => moveMountToMembers,
-  movedChildren: () => movedChildren,
   nameKey: () => nameKey,
   narrativeStepForeignFields: () => narrativeStepForeignFields,
   normalizeReferences: () => normalizeReferences2,
@@ -4154,6 +4154,13 @@ var AgentRecordSchema = import_zod2.z.object({
   dependencies: import_zod2.z.array(import_zod2.z.string()).default([]),
   /** Rendered implementation guidance for this agent's variant-tagged components (deep variant integration); empty when none. */
   variantGuidance: import_zod2.z.string().optional(),
+  /**
+   * A member project's delegating owner only: the ids of the member's own
+   * agents, each qualified `<alias>::<agentId>`, resolved from the member's
+   * topology at the member's own root. REFERENCES, never copies: nothing of the
+   * member's agents is rendered into this layer (one level deep, ids only).
+   */
+  delegatesTo: import_zod2.z.array(import_zod2.z.string()).optional(),
   /** Why this agent was created — the architectural reason for its existence */
   creationReason: import_zod2.z.string(),
   status: AgentStatusSchema.default("active"),
@@ -4185,6 +4192,13 @@ var AgentBriefSchema = import_zod2.z.object({
   instructions: import_zod2.z.string(),
   /** Rendered variant guidance, also folded into instructions */
   variantGuidance: import_zod2.z.string().optional(),
+  /**
+   * Set only on a brief for a member's agent (an id qualified `<alias>::`): the
+   * member's directory relative to the root the brief was asked from. The
+   * brief was composed at that root, and its ownedPaths and readPaths are
+   * re-expressed under this prefix so the fence is correct from the asking root.
+   */
+  root: import_zod2.z.string().optional(),
   /**
    * The resource shape of this agent's work, and the allowance it earns.
    *
@@ -4579,7 +4593,13 @@ var PackRequirementSchema = import_zod3.z.object({
   profile: import_zod3.z.string().optional()
 });
 var CompositionConfigSchema = import_zod3.z.object({
-  requirePolicies: import_zod3.z.array(PackRequirementSchema).optional()
+  requirePolicies: import_zod3.z.array(PackRequirementSchema).optional(),
+  /**
+   * Opt-in, off by default (stage 5). When true, this project's lock refuses
+   * while any DIRECT member is drifted or never approved, naming each, and
+   * writes nothing. Off: the lock proceeds and records each member's state.
+   */
+  requireApprovedMembers: import_zod3.z.boolean().optional()
 });
 var ProjectConfigSchema = import_zod3.z.object({
   /**
@@ -5929,18 +5949,26 @@ var CONTENT_ALGORITHM = "sha256";
 function inIdentityOrder(specs) {
   return specs.map((spec) => ({ spec, content: canonicalize(spec) })).sort((a, b) => compareOrdinal(a.spec.id, b.spec.id) || compareOrdinal(a.content, b.content)).map((entry) => entry.spec);
 }
-function computeStateId() {
+function digestTree(keep) {
+  const kind = (specs) => inIdentityOrder(specs.filter((s) => keep(s.id)));
   const tree = {
     system: loadSystemSpec(),
-    subsystems: inIdentityOrder(loadSubsystemSpecs()),
-    components: inIdentityOrder(loadComponentSpecs()),
-    interfaces: inIdentityOrder(loadInterfaceSpecs()),
-    implementations: inIdentityOrder(loadImplementationSpecs()),
-    types: inIdentityOrder(loadTypeSpecs())
+    subsystems: kind(loadSubsystemSpecs()),
+    components: kind(loadComponentSpecs()),
+    interfaces: kind(loadInterfaceSpecs()),
+    implementations: kind(loadImplementationSpecs()),
+    types: kind(loadTypeSpecs())
   };
   const digest2 = crypto.createHash("sha256").update(canonicalize(tree)).digest("hex");
   return { algorithm: CONTENT_ALGORITHM, digest: digest2 };
 }
+function computeStateId() {
+  return digestTree(() => true);
+}
+function computeOwnStateId() {
+  const owners = graph().owners;
+  return digestTree((id) => (owners.get(id) ?? "") === "");
+}
 function stateIdEquals(a, b) {
   return !!a && !!b && a.algorithm === b.algorithm && a.digest === b.digest;
 }
@@ -5991,12 +6019,13 @@ function withSortedMaps(record) {
     for (const k of Object.keys(m).sort()) out[k] = m[k];
     return out;
   };
-  const specs = sorted(record.specs);
-  const children = sorted(record.children);
+  const { children: _legacy, ...rest } = record;
+  const specs = sorted(rest.specs);
+  const members = sorted(rest.members);
   return {
-    ...record,
+    ...rest,
     ...specs ? { specs } : {},
-    ...children ? { children } : {}
+    ...members ? { members } : {}
   };
 }
 
@@ -7797,12 +7826,12 @@ function exportTargetKey(e) {
 }
 
 // src/models/project-family.ts
-function walkMemberPath(byKey, start, segments) {
+function walkMemberPath(byKey2, start, segments) {
   let node = start;
   for (const segment of segments.slice(0, -1)) {
     const next = node.aliases.get(segment);
     if (next !== void 0) {
-      const found = byKey.get(next);
+      const found = byKey2.get(next);
       if (!found) return null;
       node = found;
       continue;
@@ -7814,13 +7843,13 @@ function walkMemberPath(byKey, start, segments) {
   return { project: node, name: segments[segments.length - 1] };
 }
 function landReference(projects, reference, from) {
-  const byKey = new Map(projects.map((p) => [p.namespace, p]));
-  const origin = byKey.get(from);
-  const root = byKey.get("");
+  const byKey2 = new Map(projects.map((p) => [p.namespace, p]));
+  const origin = byKey2.get(from);
+  const root = byKey2.get("");
   if (!reference.includes("::")) return { kind: "project", project: from, name: reference };
   const land = (form, start, segments2) => {
     if (!start) return { kind: "unresolved", form };
-    const walked = walkMemberPath(byKey, start, segments2);
+    const walked = walkMemberPath(byKey2, start, segments2);
     if (walked === "outside") return { kind: "outside", form };
     if (walked) return { kind: "project", form, project: walked.project.namespace, name: walked.name };
     return { kind: "unresolved", form };
@@ -7832,7 +7861,7 @@ function landReference(projects, reference, from) {
     while (segments[0] === "super") {
       segments.shift();
       if (!node || node.parent === void 0) return { kind: "outside", form: "super" };
-      node = byKey.get(node.parent);
+      node = byKey2.get(node.parent);
     }
     if (segments.length === 0 || !node) return { kind: "unresolved", form: "super" };
     return land("super", node, segments);
@@ -7844,11 +7873,11 @@ function landReference(projects, reference, from) {
     return land(segments.length === 2 ? "alias" : "path", origin, segments);
   }
   if (origin.subsystems.has(first)) return { kind: "project", project: from, name: segments[segments.length - 1] };
-  const fromRoot = root ? walkMemberPath(byKey, root, segments) : null;
+  const fromRoot = root ? walkMemberPath(byKey2, root, segments) : null;
   if (fromRoot && fromRoot !== "outside") return { kind: "project", form: "path", project: fromRoot.project.namespace, name: fromRoot.name };
   const byId = projects.filter((p) => p.id === first || p.namespace !== "" && p.namespace === first);
   if (byId.length === 1) {
-    const walked = walkMemberPath(byKey, byId[0], segments.slice(1));
+    const walked = walkMemberPath(byKey2, byId[0], segments.slice(1));
     if (walked === "outside") return { kind: "outside", form: "path" };
     if (walked) return { kind: "project", form: "path", project: walked.project.namespace, name: walked.name };
   }
@@ -13729,38 +13758,102 @@ function cycleFindings(family, config) {
   }
   return out;
 }
-function approvalFinding(node, config) {
-  return runWithProjectRoot(node.directory, () => {
-    const current2 = computeGateStateId();
-    const record = readLockRecord();
-    if (!record) {
-      return finding(
-        config,
-        "MEMBER_UNAPPROVED",
-        `The member ${named(node.namespace)} has never been locked: nobody has approved its design. Lock it at its own root (\`wairon lock\`).`,
-        node.namespace
-      );
-    }
-    if (record.stateId.algorithm !== current2.algorithm || record.stateId.digest !== current2.digest) {
-      return finding(
-        config,
-        "MEMBER_DRIFTED",
-        `The member ${named(node.namespace)} changed since it was approved on ${record.lockedAt}: its lock no longer matches its own gate identity. Re-lock it at its own root (\`wairon lock\`).`,
-        node.namespace
-      );
-    }
-    return null;
-  });
+function approvalFinding(entry, config) {
+  if (entry.state === "never") {
+    return finding(
+      config,
+      "MEMBER_UNAPPROVED",
+      `The member ${named(entry.key)} has never been locked: nobody has approved its design. Lock it at its own root (\`wairon lock\`).`,
+      entry.key
+    );
+  }
+  if (entry.state === "drifted" && entry.upgraded) {
+    return finding(
+      config,
+      "MEMBER_DRIFTED",
+      `The member ${named(entry.key)} was approved under an earlier gate identity \u2014 the gate identity gained inputs in stage 5 (members' composition subjects, \`composition\`; code conformance moved beside the claim), which says nothing about its design. Re-lock it once at its own root (\`wairon lock\`).`,
+      entry.key
+    );
+  }
+  if (entry.state === "drifted") {
+    return finding(
+      config,
+      "MEMBER_DRIFTED",
+      `The member ${named(entry.key)} changed since it was approved: its lock no longer matches its own gate identity. Re-lock it at its own root (\`wairon lock\`).`,
+      entry.key
+    );
+  }
+  return null;
 }
 function checkMembers(family) {
   const config = configOrNull();
   const out = [...problemFindings(family, config), ...cycleFindings(family, config)];
-  for (const node of family.nodes) {
-    if (node.namespace === "") continue;
-    out.push(approvalFinding(node, config));
+  const present = new Set(family.nodes.filter((n) => n.namespace !== "").map((n) => n.namespace));
+  for (const entry of projectApprovals()) {
+    if (present.has(entry.key)) out.push(approvalFinding(entry, config));
   }
   return out.filter((f) => f !== null);
 }
+function subjectOf(record) {
+  return `${record.stateId.algorithm}:${record.stateId.digest}`;
+}
+function ownApproval(node, root) {
+  return within(node.directory, { topRoot: root, narrowed: true }, () => {
+    const current2 = computeGateStateId();
+    const record = readLockRecord();
+    const base = {
+      key: node.namespace,
+      ...node.mountAlias !== void 0 ? { alias: node.mountAlias } : {},
+      ...node.parent !== void 0 ? { parent: node.parent } : {},
+      ...node.id !== void 0 ? { projectId: node.id } : {},
+      state: "never"
+    };
+    if (!record) return base;
+    const matches = record.stateId.algorithm === current2.algorithm && record.stateId.digest === current2.digest;
+    return {
+      ...base,
+      state: matches ? "approved" : "drifted",
+      subject: subjectOf(record),
+      ...!matches && record.stateId.algorithm !== current2.algorithm ? { upgraded: true } : {}
+    };
+  });
+}
+function pinOf(parent, alias, subject) {
+  if (!parent) return "unpinned";
+  const recorded = parent.members ? alias in parent.members ? parent.members[alias].subject ?? "never" : void 0 : parent.children?.[alias];
+  if (recorded === void 0) return "unpinned";
+  return recorded === (subject ?? "never") ? "matches" : "moved";
+}
+function projectApprovals(depth) {
+  const family = graph();
+  const root = path11.resolve(getProjectRoot());
+  const limit = depth ?? Infinity;
+  const selected = family.nodes.filter((n) => depthOf(family, n) <= limit);
+  const directoryOf = new Map(family.nodes.map((n) => [n.namespace, n.directory]));
+  const parentRecord = (key) => {
+    const dir = directoryOf.get(key);
+    return dir === void 0 ? null : approvalRecord(dir);
+  };
+  const entries = selected.map((node) => {
+    const own = ownApproval(node, root);
+    if (node.parent === void 0 || node.mountAlias === void 0) return own;
+    return { ...own, pinned: pinOf(parentRecord(node.parent), node.mountAlias, own.subject) };
+  });
+  for (const problem of family.problems) {
+    if (problem.kind !== "member-absent" || !problem.id) continue;
+    const parentKey = problem.projects[0] ?? "";
+    const parentNode = family.nodes.find((n) => n.namespace === parentKey);
+    if (!parentNode || depthOf(family, parentNode) + 1 > limit) continue;
+    entries.push({
+      key: parentKey === "" ? problem.id : `${parentKey}::${problem.id}`,
+      alias: problem.id,
+      parent: parentKey,
+      state: "never",
+      pinned: pinOf(parentRecord(parentKey), problem.id, void 0)
+    });
+  }
+  return entries;
+}
 function requiredBy(key) {
   return key === "" ? "the family root" : `"${key}"`;
 }
@@ -13936,7 +14029,7 @@ function defaultTargetConfig(type) {
     enabled: true
   };
 }
-var WAIRON_VERSION = "5.1.1-dev.85";
+var WAIRON_VERSION = "5.1.1-dev.86";
 var GITHUB_REPO = "SYW-Apps/Waffle-AIron";
 var ARCHITECT_AGENT_ID = "agent-architect";
 var ARCHITECT_TEMPLATE_ID = "architect";
@@ -14670,6 +14763,9 @@ var BUILTIN_PROFILES = [
   "plc-cyclic"
 ];
 var PROJECT_KINDS = ["fullstack", "system-of-systems", "monorepo"];
+function judgesCode(rule) {
+  return rule.judges === "code";
+}
 
 // src/core/rules/read-model.ts
 var NO_NAMES = /* @__PURE__ */ new Set();
@@ -14993,6 +15089,7 @@ function offTreeEdge(ctx, from, ref, fromDraft) {
 // src/core/rules/integrity/hierarchy-integrity.ts
 var hierarchyRule = {
   name: "hierarchy-integrity",
+  judges: "design",
   description: "Every subsystem references the system, every component an existing subsystem, every interface an existing component, and every implementation an existing interface contract. Draft/design specs are reported informationally.",
   codes: [
     { code: "DRAFT_SUBSYSTEM_WARNING", defaultSeverity: "warning", summary: "Subsystem is in draft/design status" },
@@ -15066,6 +15163,7 @@ var hierarchyRule = {
 // src/core/rules/integrity/reserved-id-segments.ts
 var reservedIdSegmentsRule = {
   name: "reserved-id-segments",
+  judges: "design",
   description: 'No segment of a spec id may be the reserved namespace keyword "super" \u2014 the :: grammar consumes it as a namespace hop, so a stored reference to such an id resolves to a different spec.',
   codes: [
     { code: "RESERVED_ID_SEGMENT", defaultSeverity: "error", summary: 'Id uses the reserved namespace keyword "super"' }
@@ -15099,6 +15197,7 @@ function localIdOf(key, project) {
 }
 var localIdsRule = {
   name: "local-ids",
+  judges: "design",
   description: "Inside one project an id names one spec, and an id without `::` is always local. Two spec files of one project declaring one key are DUPLICATE_SPEC_ID: whichever the loader kept, every reference to that key \u2014 local, or `alias::name` from another project \u2014 could mean either, so the tree has no single reading. A local id equal to one of the project's aliases (a `members` or `externals` key) is LOCAL_ID_SHADOWS_PROJECT: the grammar keeps them apart (a bare id is local, `alias::name` crosses), but a reader seeing `billing` beside `billing::invoice_portal` cannot tell a local subsystem from a member, so the shadow is made visible. It reads the project graph's owners, alias tables and duplicate-spec problems.",
   codes: [
     { code: "DUPLICATE_SPEC_ID", defaultSeverity: "error", summary: "Two spec files of one project declare the same id" },
@@ -15143,6 +15242,7 @@ var localIdsRule = {
 // src/core/rules/integrity/project-identity.ts
 var projectIdentityRule = {
   name: "project-identity",
+  judges: "design",
   description: "The bound project is keyed on its id, so the id must be declared, well-formed, stable and its own: a project that declares none answers to its display name slugified until it writes one (PROJECT_ID_DEFAULTED), a project whose name yields no id or whose declared id breaks the grammar has nothing reliable to key on (PROJECT_ID_AMBIGUOUS), and an id that differs from the one the lock approved has moved under everything that keyed on it (PROJECT_ID_CHANGED). It judges the bound project's own identity only. The family half \u2014 a member with a defaulted id (named with its alias as the id to declare), a member with no id, and two members resolving to one id \u2014 is a family check since stage 4 (family_validator.checkMembers), which reads the family root's graph.",
   codes: [
     { code: "PROJECT_ID_AMBIGUOUS", defaultSeverity: "warning", summary: "Project has no usable id: its name yields no slug, or its declared id breaks the grammar" },
@@ -15184,6 +15284,7 @@ function judgeOwnIdentity(ctx, identity2) {
 // src/core/rules/integrity/roundtrip-serialization.ts
 var roundtripRule = {
   name: "roundtrip-serialization",
+  judges: "design",
   description: "Every loaded spec must re-serialize through the exact writer pipeline (same relativization, same schema, no I/O) \u2014 validate must predict every refusal that lock's status promotion or any later save would otherwise raise mid-write.",
   codes: [
     { code: "ROUNDTRIP_SERIALIZATION", defaultSeverity: "error", summary: "Spec cannot be re-serialized through the writer schema (any save or lock would refuse it)" }
@@ -15198,6 +15299,7 @@ var roundtripRule = {
 // src/core/rules/integrity/type-declarations.ts
 var typeDeclarationsRule = {
   name: "type-declarations",
+  judges: "design",
   description: "A type owned by a subsystem must reference an existing one, and a type declaring neither fields nor methods is a placeholder that can inform neither implementers nor the ERD.",
   codes: [
     { code: "INVALID_SUBSYSTEM_REFERENCE", defaultSeverity: "error", summary: "Type references a non-existent owning subsystem" },
@@ -15232,6 +15334,7 @@ var typeDeclarationsRule = {
 // src/core/rules/integrity/field-type-references.ts
 var fieldTypeReferencesRule = {
   name: "field-type-references",
+  judges: "design",
   description: "Every type identifier a type field's declared type names must resolve to a builtin or a defined entity/value-object type \u2014 the type's own generic parameters are not field references.",
   codes: [
     { code: "UNDEFINED_TYPE_REFERENCE", defaultSeverity: "error", summary: "Reference to a type that is not defined anywhere" }
@@ -15263,6 +15366,7 @@ var fieldTypeReferencesRule = {
 // src/core/rules/integrity/signature-type-references.ts
 var signatureTypeReferencesRule = {
   name: "signature-type-references",
+  judges: "design",
   description: "Every type identifier an interface method signature names must resolve to a builtin, a generic parameter in scope on the interface or the method, or a defined entity/value-object type.",
   codes: [
     { code: "UNDEFINED_TYPE_REFERENCE", defaultSeverity: "error", summary: "Reference to a type that is not defined anywhere" }
@@ -15299,6 +15403,7 @@ var signatureTypeReferencesRule = {
 // src/core/rules/integrity/public-surface-binding.ts
 var publicSurfaceBindingRule = {
   name: "public-surface-binding",
+  judges: "design",
   description: "Every declared publicInterface names a backing component, that component exists, and the subsystem owns it \u2014 a subsystem may only publish its own components.",
   codes: [
     { code: "PUBLIC_INTERFACE_UNBOUND", defaultSeverity: "error", summary: "Public interface with no backing component" },
@@ -15330,6 +15435,7 @@ var publicSurfaceBindingRule = {
 // src/core/rules/integrity/public-surface-consumers.ts
 var publicSurfaceConsumersRule = {
   name: "public-surface-consumers",
+  judges: "design",
   description: "Every subsystem a published surface names as its consumer must exist in the tree. A consumers list restricts who may depend on the surface, so an id that names nothing locks the surface against a caller nobody can be \u2014 and a typo there silently locks out the caller that was meant, which the boundary rule would then report against the wrong party.",
   codes: [
     { code: "PUBLIC_INTERFACE_UNKNOWN_CONSUMER", defaultSeverity: "error", summary: "A published surface names as its consumer a subsystem the tree does not have" }
@@ -15387,6 +15493,7 @@ var expectedFor = (t) => {
 };
 var publicSurfaceDeclaredTypeRule = {
   name: "public-surface-declared-type",
+  judges: "design",
   description: "A publicInterface entry's declared type must be realizable by the stereotype of its backing component; Custom entries whose prose implies eventing must be backed by an event-capable component.",
   codes: [
     { code: "PUBLIC_INTERFACE_TYPE_MISMATCH", defaultSeverity: "error", summary: "Backing component cannot realize the declared interface type" },
@@ -15417,6 +15524,7 @@ var publicSurfaceDeclaredTypeRule = {
 // src/core/rules/integrity/public-surface-bound-contract.ts
 var publicSurfaceBoundContractRule = {
   name: "public-surface-bound-contract",
+  judges: "design",
   description: "A publicInterface entry that binds an L3 interface must bind one that exists and that belongs to the component the entry publishes.",
   codes: [
     { code: "PUBLIC_INTERFACE_INVALID_INTERFACE", defaultSeverity: "error", summary: "Bound L3 interface missing or belonging to another component" }
@@ -15441,6 +15549,7 @@ var publicSurfaceBoundContractRule = {
 // src/core/rules/integrity/export-tables.ts
 var exportTablesRule = {
   name: "export-tables",
+  judges: "design",
   description: "Every level's export table must resolve the way a module resolver resolves `export \u2026 from`: one public name binds one target (EXPORT_ID_DUPLICATE when two wildcards \u2014 or two explicit entries \u2014 bind a name to different targets, or two public names share one nameKey, since a bare import could not tell them apart; the name is left out), no chain leads back to itself (EXPORT_CYCLE \u2014 an error for a named chain that never reaches a component or type, a warning for a wildcard cycle, which resolves to its union), every entry names a source and an item that exist, that the source exports and, for an own type, that the level owns \u2014 a subsystem-owned type at L1, a project-level type (no subsystem) for an L0 `{ typeDef }` without `from` \u2014 under a public name of [a-z0-9-_]+ (EXPORT_INVALID), every re-exported component can serve a boundary caller \u2014 a Portal, a gateway being a Portal variant, or an Observer for events (EXPORT_UNCONSUMABLE, at L0 and for L1 re-exports; an error since stage 4), and an L0 entry that re-exports a member's or an external's export never declares a wider audience than that export has (EXPORT_WIDENS_AUDIENCE): a re-export can narrow reach, never widen it. The rule judges the facts the export resolver recorded in the scan \u2014 for the bound root's table and every contained member's \u2014 and resolves nothing itself.",
   codes: [
     { code: "EXPORT_ID_DUPLICATE", defaultSeverity: "error", summary: "One public name bound to different targets by two wildcard re-exports or two explicit entries" },
@@ -15486,6 +15595,7 @@ var exportTablesRule = {
 // src/core/rules/integrity/external-declarations.ts
 var externalDeclarationsRule = {
   name: "external-declarations",
+  judges: "design",
   description: "Every external a project declares in project.yaml must be usable: its alias fits [a-z0-9-_]+ (a dotted producer id needs an explicit alias) and is not also a `members` key (one alias names one project), its producer id fits the project-id grammar, and it has something to be judged against \u2014 a project of the scan answers to the id, source.path names a directory (whose project, when it is in the scan, answers to the declared id), or the project holds a pin for the alias. A declaration that fails is reported (EXTERNAL_UNRESOLVED) with its reason, so a misspelled declaration never passes as declared. A member validated from its own root that declares its parent or a sibling is not reported when it has pinned it: the pin is what its gate judges against, and nothing is climbed to find the producer. Every name an external's or a member's `use` lists by name must be a public name the producer exports to this project \u2014 a contained member's live L0 table, an external's pin \u2014 compared by nameKey (IMPORT_UNRESOLVED, naming the closest public names; a `use` on an unpinned external is left to the pin's own EXTERNAL_CHECK_UNAVAILABLE), and must not share its nameKey with a spec of the project itself (IMPORT_SHADOWED_BY_LOCAL: the local spec wins every bare reference, so the named import can never take effect and says something false \u2014 rename one or drop the import). A `*` import shadowed by locals is silent, as a glob import is in Rust. One code, one meaning: IMPORT_UNRESOLVED is only a name the producer does not export, IMPORT_SHADOWED_BY_LOCAL only a named import a local spec hides. A malformed `use` entry is the declaration's problem (EXTERNAL_UNRESOLVED for an external, the member's for a member). The findings name no spec: externals and members live in configuration. It reads the bound root's node of the project graph, its alias-conflict problems, the members' export tables, the project's own spec ids and ctx.pinnedExternals.",
   codes: [
     { code: "EXTERNAL_UNRESOLVED", defaultSeverity: "notice", summary: "A declared external whose alias is malformed or taken by a member, whose producer id is malformed, or whose producer the family and its source.path do not provide" },
@@ -15601,6 +15711,7 @@ function whyNoRewrite(ref) {
 }
 var referenceFormsRule = {
   name: "reference-forms",
+  judges: "design",
   description: "A cross-project reference is `alias::name` (or a bare name a `use` imports): the alias is one of the referring project's members or externals, the name a public name of that project's L0 table. The older forms still bind for one release and are reported (DEPRECATED_REFERENCE_FORM), each naming the spec, where in it, the form as written and the text to write instead (the scan's rewrite: a bare local id, or `alias::publicName`): a leading `::`, which escapes to the root of whatever checkout loads it; `super::`, which climbs the containing projects \u2014 a place in one family, not a name; a member path (`desktop::shell` written inside desktop, `waffler_core::transpiler::x` written inside transpiler), a first segment the referring project does not declare, read from the bound root; and a self-prefix \u2014 the referring project's own id as the first segment, with `::` or `.` (`registry.advisory-channel` inside registry), which stage 3's migration did not rewrite and stage 4's positional step does. Wairon's own writer emits none of them. A form with no rewrite (its target is out of reach) is reported with the reason. It reads the project graph's authored references, which the scan records before binding erases the form.",
   codes: [
     { code: "DEPRECATED_REFERENCE_FORM", defaultSeverity: "notice", summary: "A reference written with a leading ::, super:: or a member path where a local id or alias::name belongs" }
@@ -15631,6 +15742,7 @@ function carriedFields(mount) {
 }
 var memberDeclarationsRule = {
   name: "member-declarations",
+  judges: "design",
   description: "A project declares its members in project.yaml `members`; a member is not a subsystem and carries no content in its parent. The L1 form \u2014 a subsystem carrying projectPath \u2014 still loads for one release and is reported (DEPRECATED_MOUNT_FORM), naming the mount, its path, the `members` entry that replaces it, and every field it carries that `doctor --fix` will move into the member (or stop on); a mount whose alias `members` also declares is reported as ignored. It reads the project graph's nodes and their legacy mounts.",
   codes: [
     { code: "DEPRECATED_MOUNT_FORM", defaultSeverity: "notice", summary: "A member declared as an L1 subsystem carrying projectPath instead of a project.yaml `members` entry" }
@@ -15687,6 +15799,7 @@ function declaration(producer) {
 }
 var projectBoundariesRule = {
   name: "project-boundaries",
+  judges: "design",
   description: "The one judge of every cross-project reference the bound project writes (decision 9 \u2014 every project is a crate of its own, reached only through its L0 exports and only as a dependency it declared). It reads each of the project's own references from the project graph \u2014 `::` forms and bare names bound through `use` imports alike \u2014 takes its resolution from resolveCrossProject, decided before any severity from the project's own files alone, and reports every outcome but resolved once, carrying the resolution: forbidden is EXTERNAL_UNDECLARED (the reference reaches a project the referrer declares neither as a member nor as an external, or names a first segment that is none of its subsystems, aliases or foreign providers); missing is EXTERNAL_NOT_EXPORTED (the producer's table \u2014 a contained member's live one, or the external's pin \u2014 has no public name covering the referrer, or not the used method, or exports the type only inside a signature's closure); an ambiguous import is IMPORT_AMBIGUOUS (two imports supply one bare name: two explicit `use` names, or two `*` with no explicit one \u2014 name it `alias::name` or narrow a `use`); unavailable is EXTERNAL_CHECK_UNAVAILABLE (no pin, an unreadable pin, a member absent on disk, or a deprecated form naming no alias \u2014 never a pass). A bare name no import supplies is not this rule's: it is the unresolved-reference finding it always was, with rule_context.importHint appended. A trustedLinks entry naming a subsystem of another project (`alias::sub`) is TRUSTED_LINK_CROSSES_PROJECT: a sanctioned fast lane stays inside one project. Stage 4 makes the three stage-2 notices errors now that the owner's gate judges them exactly; a reference is never left to a parent's verdict.",
   codes: [
     { code: "EXTERNAL_UNDECLARED", defaultSeverity: "error", summary: "A reference reaches another project the referring project declares neither as a member nor as an external, or names a first segment that is none of its subsystems, aliases or foreign providers" },
@@ -15778,6 +15891,7 @@ var projectBoundariesRule = {
 // src/core/rules/integrity/lint-allows.ts
 var lintAllowsRule = {
   name: "lint-allows",
+  judges: "design",
   description: "Per-spec lint suppressions (lint.allow) must name real issue codes and actually suppress a finding \u2014 unknown codes and stale allows are flagged. An allow covers exactly the occurrence it names: a finding that reports a site is silenced only by an allow whose `at` is that site, a finding that reports none only by an allow that names none, and an aggregating finding only by an allow whose `covers` lists every unit it reports \u2014 a unit nobody listed is named back as new instead of inheriting a decision taken about its neighbours. So a coarse allow left on a rule that names sites, and an allow whose site the run no longer reports, are both UNUSED_LINT_ALLOW, and the finding names the sites that did fire. Allows silence warnings and notices; errors always surface.",
   codes: [
     { code: "UNKNOWN_LINT_ALLOW_CODE", defaultSeverity: "warning", summary: "lint.allow names an issue code no registered rule emits" },
@@ -15819,6 +15933,7 @@ var lintAllowsRule = {
 // src/core/rules/narrative/contract-symmetry.ts
 var contractSymmetryRule = {
   name: "contract-symmetry",
+  judges: "design",
   description: "Implementations mirror their contract method-for-method: every method an implementation declares is defined on the contract it realizes, and every contract method has an implementation.",
   codes: [
     { code: "UNEXPECTED_IMPLEMENTATION_METHOD", defaultSeverity: "error", summary: "Implementation method not present on the contract" },
@@ -15878,6 +15993,7 @@ var targetsOf = (implMethod) => {
 };
 var narrativeTargetReferencesRule = {
   name: "narrative-target-references",
+  judges: "design",
   description: `A narrative call, dispatch or register step must name a target component, and a target method unless it dispatches; a method's declared calls name the same pair as one "<component>.<method>" reference, the spelling the conformance debt register and a lint allow name a unit with. A target this tree contains must be a collaborator the calling component declares, must carry the named method on one of its interfaces, and that method must declare every semantic guarantee the entry asserts.`,
   codes: [
     { code: "MISSING_TARGET_COMPONENT", defaultSeverity: "error", summary: "Call/register step missing targetComponent" },
@@ -15979,6 +16095,7 @@ var narrativeTargetReferencesRule = {
 // src/core/rules/narrative/cross-tree-references.ts
 var crossTreeReferencesRule = {
   name: "cross-tree-references",
+  judges: "design",
   description: `A narrative call, dispatch or register target that is not a component of this tree either leaves the project \u2014 and then its resolution (resolveCrossProject) decides: resolved is surface-reference-backing's, foreign snapshots that disagree are SURFACE_REF_AMBIGUOUS here, and every other outcome is project-boundaries' single finding \u2014 or it is a local id that names nothing, the INVALID_TARGET_COMPONENT_REFERENCE typo it always was. The CROSS_TREE_REF_UNRESOLVED warning ("only the parent project can verify it") is retired: no reference is left for a parent to judge.`,
   codes: [
     { code: "INVALID_TARGET_COMPONENT_REFERENCE", defaultSeverity: "error", summary: "Call/register step targets a non-existent component" },
@@ -16035,6 +16152,7 @@ var crossTreeReferencesRule = {
 // src/core/rules/narrative/surface-reference-backing.ts
 var surfaceReferenceBackingRule = {
   name: "surface-reference-backing",
+  judges: "design",
   description: "The contract entry a narrative target in another project resolves to \u2014 a contained member's live export table, a declared external's pinned snapshot, or a foreign surface snapshot \u2014 must back what the step asks of it: the calling component declares the collaborator, the entry exposes the called method (or serves the dispatched capability), and it declares every semantic guarantee the step asserts. These are contract verdicts on a resolved reference, and each carries that resolution.",
   codes: [
     { code: "SURFACE_REF_NOT_EXPOSED", defaultSeverity: "error", summary: "Cross-tree reference resolves to a surface snapshot that does not expose the called method/capability" },
@@ -16117,6 +16235,7 @@ var surfaceReferenceBackingRule = {
 // src/core/rules/narrative/guarantee-tokens.ts
 var guaranteeTokensRule = {
   name: "guarantee-tokens",
+  judges: "design",
   description: "Every semantic-guarantee token an L3 method declares or a narrative step asserts must be a builtin guarantee or one a loaded extension pack declares in its `guarantees` list. The vocabulary is open for packs, not for typos \u2014 an undeclared token is matched by nothing and silently escapes the narrative\u2194contract consistency checks.",
   codes: [
     { code: "UNKNOWN_GUARANTEE", defaultSeverity: "warning", summary: "Guarantee token is neither builtin nor pack-declared" }
@@ -16164,6 +16283,7 @@ var guaranteeTokensRule = {
 // src/core/rules/narrative/narrative-step-config.ts
 var narrativeStepConfigRule = {
   name: "narrative-step-config",
+  judges: "design",
   description: 'The step configuration of L5 narratives: every flow step (branch, switch, loop, try, parallel, jump) carries the config its type requires and no simple step carries flow config, "detach" (fire-and-forget) is legal on call/dispatch steps only, no step carries a field foreign to its type, a parallel body is covered by contiguous, ordered arms (>= 2), no two steps share a step number or a label, and every jump field targets an existing step number in the same narrative.',
   codes: [
     { code: "MALFORMED_FLOW_STEP", defaultSeverity: "error", summary: "Flow step missing required config (or flow config on a local/call step)" },
@@ -16189,6 +16309,7 @@ var narrativeStepConfigRule = {
 // src/core/rules/narrative/narrative-reachability.ts
 var narrativeReachabilityRule = {
   name: "narrative-reachability",
+  judges: "design",
   description: "Every step of an L5 narrative must be reachable from the first step following fall-through and jumps, and the loop/try/parallel regions it declares must nest or stay disjoint \u2014 interleaved regions map onto no structured code. Judged over the step graph, and only for a narrative whose step configuration is sound (narrative-step-config reports the rest).",
   codes: [
     { code: "UNREACHABLE_STEP", defaultSeverity: "warning", summary: "Step not reachable from the first step following fall-through and jumps" },
@@ -16255,6 +16376,7 @@ function regionsOf(steps) {
 // src/core/rules/narrative/narrative-jump-edges.ts
 var narrativeJumpEdgesRule = {
   name: "narrative-jump-edges",
+  judges: "design",
   description: "Where an L5 narrative's jump edges land: a loop/try/parallel region is entered through its header, never into the middle of its body; a backward jump is only idiomatic as a continue to an enclosing loop header, and otherwise models repetition that belongs in a loop step; and a try body must not fall through into its own catch/finally region on the success path. Judged only for a narrative whose step configuration is sound (narrative-step-config reports the rest).",
   codes: [
     { code: "JUMP_INTO_REGION", defaultSeverity: "warning", summary: "Jump lands in the middle of a loop/try body from outside \u2014 regions are entered through their header" },
@@ -16455,6 +16577,7 @@ function stronglyConnected(nums, successorsOf) {
 // src/core/rules/narrative/meaningless-branches.ts
 var meaninglessBranchesRule = {
   name: "meaningless-branches",
+  judges: "design",
   description: "A branch or switch whose arms all target the same step decides nothing: the condition is evaluated and flow continues at one place whatever it answers. A decision's targets are its explicit ones plus, where it leaves its fall-through field unset, the steps the step graph continues it at \u2014 so the classic authoring slip of pointing both arms at the next step is caught. Structure-only \u2014 a warning, lint.allow-suppressible.",
   codes: [
     { code: "MEANINGLESS_BRANCH", defaultSeverity: "warning", summary: "Branch/switch whose arms all target the same step \u2014 the decision changes nothing" }
@@ -16507,6 +16630,7 @@ var meaninglessBranchesRule = {
 // src/core/rules/narrative/inescapable-cycles.ts
 var inescapableCyclesRule = {
   name: "inescapable-cycles",
+  judges: "design",
   description: "A cycle in a narrative's step graph with no exit edge and no return or throw member never terminates, by construction: every path that enters it stays inside it forever. Read over the step graph closed by a completion step, so falling off the end of the narrative counts as leaving. Structure-only \u2014 prose conditions are never judged \u2014 and reported as a warning, lint.allow-suppressible.",
   codes: [
     { code: "INESCAPABLE_CYCLE", defaultSeverity: "warning", summary: "Step cycle with no exit edge and no return/throw member \u2014 never terminates by construction" }
@@ -16548,6 +16672,7 @@ var inescapableCyclesRule = {
 var byCodeUnit = (a, b) => a < b ? -1 : a > b ? 1 : 0;
 var unconditionalCallCyclesRule = {
   name: "unconditional-call-cycles",
+  judges: "design",
   description: "A method-level call cycle across components in which every call edge is unavoidable on every entry-to-exit path of its narrative is unbounded recursion, by construction. Dispatch steps are resolved through their portal's table; register steps are never edges (a handoff defers the invocation to the runtime, so it cannot recurse). A cycle with even one guarded edge is NOT flagged, since prose conditions are never judged. Structure-only \u2014 a warning, lint.allow-suppressible, anchored on the member edge that sorts first so one allow covers the cycle.",
   codes: [
     { code: "UNCONDITIONAL_CALL_CYCLE", defaultSeverity: "warning", summary: "Cross-component call cycle in which every call edge is unavoidable \u2014 unbounded recursion by construction" }
@@ -16622,6 +16747,7 @@ var unconditionalCallCyclesRule = {
 // src/core/rules/narrative/narrative-detail.ts
 var narrativeDetailRule = {
   name: "narrative-detail",
+  judges: "design",
   description: "The narrative detail dial: each method resolves to full | calls-only | intent (method override \u2192 spec default \u2192 stereotype default). full requires a narrative; intent-level methods without a narrative must specify behavior as non-trivial prose (L4 intent or L3 description) \u2014 dialing detail down never means leaving behavior unspecified. Explicit declarations are held to their promise as errors; stereotype-defaulted gaps surface as warnings. An honest lint over declarations \u2014 it never claims the narrative or the prose is CORRECT.",
   codes: [
     { code: "MISSING_NARRATIVE", defaultSeverity: "warning", summary: "Method resolved to detail: full but has no narrative (error when the level was declared explicitly)" },
@@ -16667,6 +16793,7 @@ var narrativeDetailRule = {
 var DEFAULT_MAX_UNNARRATED_COMPLEXITY = 8;
 var detailSufficiencyRule = {
   name: "detail-sufficiency",
+  judges: "code",
   description: "A method dialed below detail: full with no narrative may not be hiding behavior it owes a reader. A method whose realized function \u2014 in the method's own source file, else the implementation's \u2014 measures real branching (cyclomatic complexity above rules.complexity.maxUnnarratedComplexity, exact AST grade only) is reported (UNNARRATED_COMPLEXITY), and an explicit dial below a full-floor logic stereotype without a narrative is a visible, lint.allow-justifiable choice (DETAIL_BELOW_STEREOTYPE) \u2014 reported only where the measured finding did not already fire, since evidence outranks expectation. Both are honest lints over declarations: they never claim a narrative would be correct, only that the dial hides something.",
   codes: [
     { code: "UNNARRATED_COMPLEXITY", defaultSeverity: "warning", summary: "Method below detail: full with no narrative whose realized function, in the method's source file, has real branching (cyclomatic complexity over the configured threshold, exact-grade analysis only)" },
@@ -16724,6 +16851,7 @@ var detailSufficiencyRule = {
 // src/core/rules/intrinsic/portal-fields.ts
 var portalFieldsRule = {
   name: "portal-fields",
+  judges: "design",
   scope: "spec",
   description: "A Portal declares its portalType. Non-Portal components carry no portalType, basePath, or auth (auth is inbound transport auth \u2014 it belongs on the Portal that exposes the surface). Intrinsic to one component: no tree required.",
   codes: [
@@ -16771,6 +16899,7 @@ var portalFieldsRule = {
 // src/core/rules/intrinsic/durability-declaration.ts
 var durabilityDeclarationRule = {
   name: "durability-declaration",
+  judges: "design",
   scope: "spec",
   description: "Every Store declares its durability (MISSING_DURABILITY) and nothing but a Store may declare one (DURABILITY_ON_NON_STORE). Intrinsic to one component: no tree required. The round-trip consequences of the declaration are enforced by durability-round-trip.",
   codes: [
@@ -16808,6 +16937,7 @@ var durabilityDeclarationRule = {
 // src/core/rules/intrinsic/logic-declaration.ts
 var logicDeclarationRule = {
   name: "logic-declaration",
+  judges: "design",
   scope: "spec",
   description: "Only an Orchestrator may declare a dependencyClass (DEPENDENCY_CLASS_ON_NON_ORCHESTRATOR); what the class allows is judged by logic-dependency-class. Intrinsic to one component: no tree required.",
   codes: [
@@ -16832,6 +16962,7 @@ var logicDeclarationRule = {
 // src/core/rules/intrinsic/retired-stereotypes.ts
 var retiredStereotypesRule = {
   name: "retired-stereotypes",
+  judges: "design",
   scope: "spec",
   description: "A component typed with a retired stereotype is an error until it is migrated (STEREOTYPE_RETIRED). A Specialist becomes an Orchestrator with the dependencyClass its dependencies give it, which `wairon doctor --fix` applies. A Gateway becomes the Portal it owns, with the gateway variant: its other members are depended on rather than owned, its consumers depend on that Portal, and the Gateway spec is deleted, steps the finding lists for the author. Intrinsic to one component: no tree required.",
   codes: [
@@ -16875,6 +17006,7 @@ var PORTAL_TRANSPORT = {
 };
 var portalsRule = {
   name: "portal-endpoints",
+  judges: "design",
   description: "A Portal binds every interface method to a concrete endpoint of the transport its portalType expects.",
   codes: [
     { code: "MISSING_ENDPOINT", defaultSeverity: "error", summary: "Portal method without a wire endpoint binding" },
@@ -16915,6 +17047,7 @@ var portalsRule = {
 // src/core/rules/doctrine/non-portal-endpoints.ts
 var nonPortalEndpointsRule = {
   name: "non-portal-endpoints",
+  judges: "design",
   description: "Only a Portal may carry endpoints: a method on a non-Portal component's interface that declares one is publishing a block that is not the system's boundary as if it were.",
   codes: [
     { code: "ARCHITECTURE_VIOLATION_NON_PORTAL_ENDPOINT", defaultSeverity: "error", summary: "Non-Portal component method declaring an endpoint" }
@@ -16944,6 +17077,7 @@ var nonPortalEndpointsRule = {
 // src/core/rules/doctrine/portal-call-auth.ts
 var portalCallAuthRule = {
   name: "portal-call-auth",
+  judges: "design",
   description: "Hardens authenticated cross-service calls. An OUTBOUND narrative `call` into ANOTHER component's Portal whose auth is not `none` must (a) be made by an Adapter \u2014 the only block that does external I/O \u2014 and (b) declare the credential source it presents via the step's `auth.from`. Absence of a source warns PORTAL_AUTH_UNMET; a non-Adapter presenter warns AUTH_PRESENTER_NOT_ADAPTER. The actual secret is never stored in the spec. Dispatch steps (a portal's OWN inbound routing) and self-calls are not cross-service calls and are excluded.",
   codes: [
     { code: "PORTAL_AUTH_UNMET", defaultSeverity: "warning", summary: "A narrative call into another component's authed Portal does not declare where its credential loads from" },
@@ -16989,6 +17123,7 @@ var portalCallAuthRule = {
 var COMPONENT_REF_PREFIX = "component:";
 var authSourceWiringRule = {
   name: "auth-source-wiring",
+  judges: "design",
   description: "Resolves the credential source a narrative call presents to an authenticated Portal. When the step's `auth.from` is a modeled reference (`component:<id>`) it must name a component that exists (UNKNOWN_AUTH_SOURCE), that can hold or load a secret \u2014 an Adapter or a Store (AUTH_SOURCE_NOT_PROVIDER) \u2014 and that the presenting component depends on or owns (AUTH_SOURCE_UNWIRED). Opaque sources (env:/config:/vault:/free note) are design notes and are never resolved; a missing source is portal-call-auth's finding.",
   codes: [
     { code: "UNKNOWN_AUTH_SOURCE", defaultSeverity: "warning", summary: "auth.from references a component: source that does not exist" },
@@ -17049,6 +17184,7 @@ var authSourceWiringRule = {
 // src/core/rules/doctrine/subsystem-boundary-dependencies.ts
 var subsystemBoundaryDepsRule = {
   name: "subsystem-boundary-dependencies",
+  judges: "design",
   description: "Judges every dependsOn edge that leaves its own subsystem, and every one that resolves nowhere. Across subsystems the shape is client Adapter \u2192 published remote Portal, OR a direct in-process edge licensed by a trustedLink declared on the SOURCE subsystem (the published-Portal target requirement applies either way). A published surface may also name the subsystems it serves (a publicInterfaces entry's consumers): a component every one of whose entries names consumers may be depended on only from those subsystems. An edge into another project is judged on the contract entry it resolves to (resolveSurfaceRef \u2014 a contained member's live table, a declared external's pin, or a foreign snapshot): the same Adapter requirement applies to it, and foreign snapshots of several providers that disagree make it SURFACE_REF_AMBIGUOUS. An edge into another project that does not resolve is reported once, by project-boundaries, with its resolution \u2014 never here, and never as the retired CROSS_TREE_REF_UNRESOLVED warning. A bare id that names nothing is INVALID_DEPENDENCY_REFERENCE. Boundary rules are never relaxed by a pack profile.",
   codes: [
     { code: "INVALID_DEPENDENCY_REFERENCE", defaultSeverity: "error", summary: "dependsOn names a non-existent component" },
@@ -17169,6 +17305,7 @@ var stereotypeOf = (comp) => comp.dependencyClass ? `${comp.componentType} (depe
 // src/core/rules/doctrine/logic-dependency-class.ts
 var logicDependencyClassRule = {
   name: "logic-dependency-class",
+  judges: "design",
   description: "Bounds an Orchestrator's dependencies by the dependencyClass it declares: pure logic depends only on pure Orchestrators; read logic also on read Orchestrators, Repositories, Indexes and Adapters; an Orchestrator that declares no class is a workflow and may depend on anything the rest of the matrix allows. Whether read logic calls a WRITE method on one of those is judged only once facade methods carry effect tags.",
   codes: [
     { code: "DEPENDENCY_CLASS_VIOLATION", defaultSeverity: "error", summary: "Orchestrator depending on a component its dependencyClass does not allow: pure logic depends only on pure Orchestrators; read logic also on read Orchestrators, Repositories, Indexes and Adapters" }
@@ -17226,6 +17363,7 @@ function derivedIndexBreach(ctx, from, to) {
 }
 var dataBlockDepsRule = {
   name: "data-block-dependencies",
+  judges: "design",
   description: "Keeps the data layer facing down. A Store may depend only on another Store, a backend Adapter or pure logic \u2014 Registries and Indexes depend on the Store, never the reverse. A Registry is the write path to its Store and may depend on that Store, a backend Adapter, or the pure logic that validates the write. An Index is a read projection and a Query a computed read, each over its Store through a backend Adapter where one serves it; as an exceptional case an Index may project another Index of the same Repository, never in a cycle. An Adapter is a sink toward the system: it may use pure logic, but never a Store or any other Orchestrator.",
   codes: [
     { code: "ARCHITECTURE_VIOLATION_STORE_DEP", defaultSeverity: "error", summary: "Store depending on anything but another Store, a backend Adapter or pure logic" },
@@ -17295,6 +17433,7 @@ var dataBlockDepsRule = {
 // src/core/rules/doctrine/entrypoint-dependencies.ts
 var entrypointDepsRule = {
   name: "entrypoint-dependencies",
+  judges: "design",
   description: "Judges the edges at the system's entry points and its process layer. Portals and Observers are top-level entry points and subscribers, so nothing may depend on them \u2014 and that is the edge's one finding, which is why no other matrix rule judges it. Downward, a Portal dispatches to Orchestrators and may READ through Indexes and Repository facades but never reaches Store/Registry/Query or an Adapter, while an Observer forwards to one Orchestrator or Supervisor over a message-bus Adapter. A View stays a passive presenter. A Supervisor reaches data only through workflows, and a component depending on a live Actor must also depend on a Supervisor that supervises it.",
   codes: [
     { code: "ARCHITECTURE_VIOLATION_PORTAL_DEP", defaultSeverity: "error", summary: "Component depending on a Portal/Observer" },
@@ -17372,6 +17511,7 @@ var entrypointDepsRule = {
 // src/core/rules/doctrine/portal-write-shortcut.ts
 var portalWriteShortcutRule = {
   name: "portal-write-shortcut",
+  judges: "design",
   description: "A Portal narrative call step or dispatch-table binding that reaches a write-effect method on a Repository or Index directly is the write shortcut: the Portal\u2192data-facade edge is licensed for reads only, and a write routes through an Orchestrator that owns the workflow. A dispatch step reaches its server only through a table binding, so judging every binding judges each dispatch step that takes it, once, where the route is declared. Methods that carry no effect tag are not judged.",
   codes: [
     { code: "PORTAL_WRITE_SHORTCUT", defaultSeverity: "error", summary: "Portal narrative call or dispatch-table binding reaches a write-effect method on a Repository/Index directly \u2014 reads may shortcut, writes route through an Orchestrator (judged on effect-tagged facade methods; untagged methods are not yet judged)" }
@@ -17422,6 +17562,7 @@ var portalWriteShortcutRule = {
 // src/core/rules/doctrine/pattern-membership.ts
 var patternMembershipRule = {
   name: "pattern-membership",
+  judges: "design",
   description: "Only patterns (Repository/FeatureComponent/RouterComponent) own member blocks, and every pattern owns at least one. Each claim must name a component that exists and is itself a building block \u2014 patterns compose at the subsystem (L1) level, never by owning one another \u2014 and a block has exactly one owner, the first pattern to claim it.",
   codes: [
     { code: "EMPTY_PATTERN", defaultSeverity: "error", summary: "Pattern with no owned member blocks" },
@@ -17471,6 +17612,7 @@ var patternMembershipRule = {
 var REPOSITORY_MEMBERS = /* @__PURE__ */ new Set(["Store", "Registry", "Index", "Query", "Adapter"]);
 var patternContainmentRule = {
   name: "pattern-containment",
+  judges: "design",
   description: "Holds each pattern to the containment its definition prescribes. A Repository may own only Store, Registry, Index, Query and (optionally) Adapter, judged member by member. A FeatureComponent owns exactly one Orchestrator (the logic side) and one or more Views (its faces \u2014 list, detail, form \u2014 sharing the one logic component), and nothing else. A RouterComponent owns exactly one Portal as its facade and at least one other child to route to. A counting pattern that still owns a retired member is not judged until that member is migrated: its counts change with the migration, and STEREOTYPE_RETIRED is the one finding.",
   codes: [
     { code: "REPOSITORY_CONTAINMENT", defaultSeverity: "error", summary: "Repository owning a non Store/Registry/Index/Query/Adapter member" },
@@ -17531,6 +17673,7 @@ var patternContainmentRule = {
 // src/core/rules/doctrine/unowned-blocks.ts
 var unownedBlocksRule = {
   name: "unowned-blocks",
+  judges: "design",
   description: `Judges the data blocks no pattern owns. A Store may stand alone deliberately \u2014 the sanctioned lightweight form for genuinely simple state, acknowledged with a lint.allow \u2014 while the recommended shape stays a Repository; what must never happen is folding the state into a consuming component, where no spec, diagram or conformance check can see it again. A Registry standing alone with no Store to write to is either mistyped (the "file-backed Registry" idiom, a fused persistent store that belongs typed Store) or orphaned. A Query has no standalone form at all: it computes reads over its own Repository's Store.`,
   codes: [
     { code: "UNOWNED_STORE", defaultSeverity: "warning", summary: "Store not owned by any pattern \u2014 recommended shape is a Repository; a deliberate standalone Store needs a lint.allow" },
@@ -17576,6 +17719,7 @@ var unownedBlocksRule = {
 // src/core/rules/doctrine/member-visibility.ts
 var memberVisibilityRule = {
   name: "member-visibility",
+  judges: "design",
   description: "A component may depend on a block within its own group (it is the owning pattern, or a sibling member of the same pattern), on any pattern facade, or on a standalone block \u2014 never on a block privately owned by ANOTHER pattern, which must be reached through that pattern's facade. A retired depending component is skipped, as everywhere in this family.",
   codes: [
     { code: "VISIBILITY_VIOLATION", defaultSeverity: "error", summary: "Dependency on a block privately owned by another pattern" }
@@ -17598,6 +17742,7 @@ var memberVisibilityRule = {
 // src/core/rules/doctrine/facade-forwarding.ts
 var facadeForwardingRule = {
   name: "facade-forwarding",
+  judges: "design",
   description: "A Repository facade method with an authored narrative must be pure 1:1 forwarding: exactly one call step, targeting one of the pattern's owned members. Anything else is logic living on the facade \u2014 move it into a member block, or acknowledge a deliberate exception via lint.allow.",
   codes: [
     { code: "FACADE_FORWARDING", defaultSeverity: "warning", summary: "Pattern facade narrative is not a single call to an owned member" }
@@ -17639,6 +17784,7 @@ var facadeForwardingRule = {
 var PROJECT_KINDS2 = new Set(PROJECT_KINDS);
 var profileRegistrationRule = {
   name: "profile-registration",
+  judges: "design",
   description: "Every profile name in play \u2014 the project's own projectType and each subsystem's declared profile \u2014 must be a built-in profile, a composite project kind, or one a loaded extension pack registers. An unregistered name is flagged rather than guessed at: no doctrine is governing it.",
   codes: [
     { code: "UNKNOWN_PROFILE", defaultSeverity: "warning", summary: "Profile name is neither built-in nor registered by an extension pack" }
@@ -17670,6 +17816,7 @@ var BACKEND_LIKE = /* @__PURE__ */ new Set(["backend", "lowlevel-os", "game-ecs"
 var FRONTEND_LIKE = /* @__PURE__ */ new Set(["frontend-reactive", "frontend-controller"]);
 var profileStereotypeFencingRule = {
   name: "profile-stereotype-fencing",
+  judges: "design",
   description: "The built-in profile families fence which stereotypes may run under them: View/FeatureComponent/RouterComponent only in a frontend-like profile; Actor/Supervisor forbidden in plc-cyclic, whose logic runs single-threaded inside one execution scan cycle; Actor/Supervisor in a frontend-like profile warned. A pack profile opts in by declaring its family; an unregistered profile is neutral, with no doctrine to guess.",
   codes: [
     { code: "FRONTEND_STEREOTYPE_IN_BACKEND", defaultSeverity: "error", summary: "Frontend stereotype in a backend-oriented subsystem" },
@@ -17723,6 +17870,7 @@ var profileStereotypeFencingRule = {
 // src/core/rules/extension/pack-profile-stereotypes.ts
 var packProfileStereotypesRule = {
   name: "pack-profile-stereotypes",
+  judges: "design",
   description: "A pack-registered profile carries its own stereotype doctrine on top of the built-in family fencing: the stereotypes it lists as forbidden are errors and the ones it discourages are warnings, each reported with the reason the pack states for it.",
   codes: [
     { code: "PROFILE_FORBIDDEN_STEREOTYPE", defaultSeverity: "error", summary: "Stereotype forbidden by the governing pack-defined profile" },
@@ -17763,6 +17911,7 @@ var packProfileStereotypesRule = {
 // src/core/rules/extension/pattern-references.ts
 var patternReferencesRule = {
   name: "pattern-references",
+  judges: "design",
   description: "Every component pattern reference resolves to a reusable pattern declared by a loaded extension pack (UNKNOWN_PATTERN_REF); a pinned version with no matching pack pattern is warned (PATTERN_VERSION_MISMATCH). Pattern constraint enforcement itself is delegated to the declaring pack's rules.",
   codes: [
     { code: "UNKNOWN_PATTERN_REF", defaultSeverity: "warning", summary: "Component references a pattern no loaded pack declares" },
@@ -17807,6 +17956,7 @@ var patternReferencesRule = {
 // src/core/rules/extension/component-variants.ts
 var variantReferencesRule = {
   name: "component-variants",
+  judges: "design",
   description: "A component's variant resolves to a declared registry variant (UNKNOWN_VARIANT), and the component's stereotype equals the variant's declared base (VARIANT_BASE_MISMATCH). A variant is a base-anchored specialization (a kind of the base stereotype), not a cross-cutting attribute \u2014 those stay method guarantees.",
   codes: [
     { code: "UNKNOWN_VARIANT", defaultSeverity: "warning", summary: "Component references a variant no registry declares" },
@@ -17866,6 +18016,7 @@ function reportAssertion(ctx, a, message, specId, isDraftCtx) {
 // src/core/rules/extension/assertion-forbidden-edges.ts
 var assertionForbiddenEdgesRule = {
   name: "assertion-forbidden-edges",
+  judges: "design",
   description: "Evaluates the `forbid-edge` assertions loaded packs declare: for every component matching the assertion's from-selector, every dependsOn/owns id whose target matches the to-selector is reported. Findings carry the pack's namespaced code (<PACK>_<CODE>) and its stated reason; severity is the pack's declaration (project sddRuleSeverity still wins, and error downgrades to warning in draft context). The codes are the packs' own, so no fixed code list applies.",
   // Static codes are unknown here — packs bring their own. The validator
   // gathers every loaded assertion's fullCode into knownIssueCodes.
@@ -17930,6 +18081,7 @@ function holdersAt(ctx, level) {
 }
 var assertionRequiredFieldsRule = {
   name: "assertion-required-fields",
+  judges: "design",
   description: "Evaluates the `require-field` assertions loaded packs declare: at the assertion's level (component / interface / implementation), every spec whose owning component matches the on-selector must declare the named field \u2014 a top-level spec field or an `ext.*` path \u2014 and, when the assertion states a closed value set, hold one of those values. Findings carry the pack's namespaced code (<PACK>_<CODE>) and its stated reason; severity is the pack's declaration (project sddRuleSeverity still wins, and error downgrades to warning in draft context). The codes are the packs' own, so no fixed code list applies.",
   // Static codes are unknown here — packs bring their own. The validator
   // gathers every loaded assertion's fullCode into knownIssueCodes.
@@ -17987,6 +18139,7 @@ function boundEndpoints(ctx, on) {
 }
 var assertionEndpointShapesRule = {
   name: "assertion-endpoint-shapes",
+  judges: "design",
   description: "Evaluates the `endpoint-shape` assertions loaded packs declare: every endpoint bound on a contract whose component matches the on-selector must use an allowed transport and bind an address (path / topic / command / pipe / channel) matching the assertion's anchored pattern. Findings carry the pack's namespaced code (<PACK>_<CODE>) and its stated reason; severity is the pack's declaration (project sddRuleSeverity still wins, and error downgrades to warning in draft context). The codes are the packs' own, so no fixed code list applies.",
   // Static codes are unknown here — packs bring their own. The validator
   // gathers every loaded assertion's fullCode into knownIssueCodes.
@@ -18012,6 +18165,7 @@ var assertionEndpointShapesRule = {
 // src/core/rules/extension/pack-resolution.ts
 var packResolutionRule = {
   name: "pack-resolution",
+  judges: "design",
   description: "Every pack a project declares must resolve \u2014 from a committed bundle under .wai/packs/, or from this wairon install's pack store \u2014 and must be the content it claims. An unresolvable selection is an error reported under the code that names the remedy: PACK_NOT_INSTALLED (absent entirely), PACK_VERSION_UNSATISFIED (installed, but no version satisfies the pin), or PACK_INTEGRITY_MISMATCH (resolved content does not match the pinned integrity digest, recomputed from the files rather than read from metadata, on whichever path won). Those never downgrade to warnings: a project whose declared doctrine is missing or altered is misconfigured, and a gate running without it must not look clean. PACK_STORE_DRIFT is the one warning \u2014 a committed bundle and the store hold different content for the same name@version; the bundle applies, so the store copy is silently ignored and that deserves saying.",
   codes: [
     { code: "PACK_NOT_INSTALLED", defaultSeverity: "error", summary: "A declared pack is neither bundled nor installed in the pack store" },
@@ -18029,6 +18183,7 @@ var packResolutionRule = {
 // src/core/rules/extension/pack-reproducibility.ts
 var reproducibilityRule = {
   name: "pack-reproducibility",
+  judges: "design",
   description: "Under rules.enforceReproducibility (default true), every by-name pack selection must be reproducible elsewhere: pinned to an exact version (ideally with an integrity digest) or bundled into the repository. A floating selection resolves against whatever the local machine happens to have installed, so a clone or CI can validate the same tree against a different rule set (UNPINNED_PACK_SELECTION). A selection that records no fetchable source cannot be obtained by CI at all (PACK_SOURCE_UNFETCHABLE).",
   codes: [
     { code: "UNPINNED_PACK_SELECTION", defaultSeverity: "warning", summary: "Pack selection floats to the latest installed version instead of pinning one" },
@@ -18059,6 +18214,7 @@ var reproducibilityRule = {
 // src/core/rules/extension/pack-requirements.ts
 var packRequirementsRule = {
   name: "pack-requirements",
+  judges: "design",
   description: "Every requirement in the bound project's own composition.requirePolicies must be readable: a pack name and a semver range that parses (pack_requirement.rangeProblem). One that does not is POLICY_REQUIREMENT_INVALID, quoting the range and the unreadable token \u2014 an error on the requiring project's own gate, because the requirement is its own configuration and the family run cannot judge a member against it. It judges only the syntax: whether members adopt the requirement is the family run's question (family_validator.adoption), and nothing here reads a parent's requirements.",
   codes: [
     { code: "POLICY_REQUIREMENT_INVALID", defaultSeverity: "error", summary: "A project's composition.requirePolicies names a pack range that does not parse" }
@@ -18080,6 +18236,7 @@ var packRequirementsRule = {
 // src/core/rules/wiring/dependency-cycles.ts
 var cyclesRule = {
   name: "dependency-cycles",
+  judges: "design",
   description: "The component dependsOn graph must be a DAG; the first cycle through a component in the run's scope is reported with its full path.",
   codes: [
     { code: "CIRCULAR_DEPENDENCY", defaultSeverity: "error", summary: "Circular dependency between components" }
@@ -18124,6 +18281,7 @@ var cyclesRule = {
 // src/core/rules/wiring/dispatch-table-bindings.ts
 var dispatchTableBindingsRule = {
   name: "dispatch-table-bindings",
+  judges: "design",
   description: "A dispatch table belongs to a Portal, binds each capability once, and binds it to an existing component.method inside the portal's own subsystem (the portal dispatches inward) that the portal declares under dependsOn or owns \u2014 the table is a real runtime invocation path.",
   codes: [
     { code: "DISPATCH_ON_NON_PORTAL", defaultSeverity: "error", summary: "Dispatch table declared on a component that is not a Portal" },
@@ -18203,6 +18361,7 @@ var dispatchTableBindingsRule = {
 // src/core/rules/wiring/dispatch-step-routing.ts
 var dispatchStepRoutingRule = {
   name: "dispatch-step-routing",
+  judges: "design",
   description: "A dispatch narrative step must name the capability it routes and route it through a Portal whose dispatch table actually serves that capability; a guarantee the step asserts must be declared by the contract method the capability resolves to.",
   codes: [
     { code: "MALFORMED_DISPATCH_STEP", defaultSeverity: "error", summary: "Dispatch step missing its capability (targetComponent presence is narrative-target-references' finding)" },
@@ -18273,6 +18432,7 @@ var dispatchStepRoutingRule = {
 // src/core/rules/wiring/lifecycle-entrypoints.ts
 var lifecycleRule = {
   name: "lifecycle-entrypoints",
+  judges: "design",
   description: "Declared subsystem lifecycle entrypoints (init/shutdown flows) must name an existing component and a method on one of its interfaces \u2014 they are reachability roots, so a dangling entrypoint would silently detach every flow rooted in it.",
   codes: [
     { code: "INVALID_LIFECYCLE_ENTRYPOINT", defaultSeverity: "error", summary: "Lifecycle entrypoint names a missing component or method" },
@@ -18322,6 +18482,7 @@ function liesUnder(path38, prefix) {
 }
 var portalMountsRule = {
   name: "portal-mounts",
+  judges: "design",
   description: "Which listener serves which portal: a portal's routes are its methods' endpoint bindings, but nothing said which listener hands it its requests, so a portal no listener serves was unreachable without anyone noticing, and the call that mounts one crossed a boundary no contract described. A listener Portal declares its mounts \u2014 each a portal, the path prefixes routed to it, and optionally the router entry it calls \u2014 and this rule checks them against the tree: a mount must name a Portal, every HTTP endpoint of a mounted portal must lie under one of its prefixes, and every portal with HTTP endpoints must be mounted by some listener unless it is one. A path lies under a prefix when it equals it or continues it past a slash, so `/` covers only the root. Whether the named entry is really exported is the code's question, and export-conformance asks it.",
   codes: [
     {
@@ -18494,6 +18655,7 @@ function walk(ctx, seeds, options = {}) {
 // src/core/rules/wiring/unused-detection.ts
 var reachabilityRule = {
   name: "unused-detection",
+  judges: "design",
   description: "Walks the narrative execution graph (call steps, register handoffs, dispatch-table routing, lifecycle flows) from every entrypoint (Portal/Observer/published component/lifecycle entrypoint/invokedBy-declared method) and flags components and methods no execution chain reaches. An interface method declaring invokedBy (a real caller outside the modeled graph) seeds the walk, so its narrative propagates reachability; a declaration the INTERNAL walk (without those seeds) already reaches is stale and is reported.",
   codes: [
     { code: "UNUSED_COMPONENT", defaultSeverity: "warning", summary: "Component never reached by any narrative call chain" },
@@ -18578,6 +18740,7 @@ var reachabilityRule = {
 // src/core/rules/wiring/invoked-by-description.ts
 var invokedByDescriptionRule = {
   name: "invoked-by-description",
+  judges: "design",
   description: 'An invokedBy declaration names a caller outside the modeled graph and silences unused-detection for its method, so the claim must stay reviewable: its "caller" prose is held to the intent floor (missing or placeholder-thin prose is reported), stating WHO invokes the method and when.',
   codes: [
     { code: "INVOKED_BY_UNDESCRIBED", defaultSeverity: "warning", summary: "invokedBy declaration whose caller prose is missing or placeholder-thin" }
@@ -18605,6 +18768,7 @@ var invokedByDescriptionRule = {
 // src/core/rules/wiring/unused-types.ts
 var unusedTypesRule = {
   name: "unused-types",
+  judges: "design",
   description: "Flags types no field of any type, no interface method signature and no other type's method signature references. References are matched through the type-reference grammar (generic arguments, collections, qualified ids), and the declaring type's own generic parameters are left out \u2014 a type parameter is not a reference to a type. A type named only by its OWN methods stays unused, the way a function that only calls itself is.",
   codes: [
     { code: "UNUSED_TYPE", defaultSeverity: "warning", summary: "Type never referenced by fields, signatures or type methods" }
@@ -18664,6 +18828,7 @@ var unusedTypesRule = {
 // src/core/rules/wiring/durability-round-trip.ts
 var durabilityRule = {
   name: "durability-round-trip",
+  judges: "design",
   description: "A durable Store (persisted RAM projection) must carry effect-tagged contract methods, and its writes require a hydration read-back reachable from a lifecycle init entrypoint. read-through is exempt (every read IS the read-back), as are ram-projection (rebuilt not restored) and cache (evictable, loss-safe). The flagship semantic check is opt-out by declaration, never silently absent \u2014 the declaration itself is enforced by durability-declaration.",
   codes: [
     { code: "MISSING_EFFECT_TAG", defaultSeverity: "warning", summary: "Durable Store contract method lacks an effect: read | write tag" },
@@ -18719,6 +18884,7 @@ function namesBareType(refs) {
 }
 var untypedSeamRule = {
   name: "untyped-seams",
+  judges: "design",
   description: "Methods on a subsystem's published components (its public surface) should not take or return bare Json/any/unknown/object, judged through each method's type references so a prose signature is judged like structured params: cross-subsystem contracts are the swap seam and must be typed. Generic-dispatch portals carry per-capability types via their dispatch table instead.",
   codes: [
     { code: "UNTYPED_SEAM", defaultSeverity: "warning", summary: "Bare Json/any/unknown/object parameter or return crossing a subsystem public surface" }
@@ -18776,6 +18942,7 @@ function withoutQuotedText(text3) {
 }
 var proseClaimRule = {
   name: "prose-claims",
+  judges: "design",
   description: 'Flags durability/side-effect claims that exist only in prose: a local step description or an intent paragraph claiming persistence ("persisted", "persistence", "survives restart", "registered into") on a logic component whose narrative has no call, register or dispatch edge to any data-layer component (Store/Registry/Index/Adapter/Repository). Text inside quotes or backticks names a value or quotes a message and claims nothing. Data-layer components are exempt \u2014 they ARE the persistence.',
   codes: [
     { code: "UNREALIZED_CLAIM", defaultSeverity: "warning", summary: "Durability/side-effect claim in prose with no matching structural edge" }
@@ -18833,6 +19000,7 @@ var proseClaimRule = {
 // src/core/rules/wiring/unique-invariant-ids.ts
 var uniqueInvariantIdsRule = {
   name: "unique-invariant-ids",
+  judges: "design",
   description: `An entity's declared invariant ids must be unique within the entity: a narrative step asserts an invariant by "<type-id>.<invariant-id>", so a repeated id makes one assertion stand for two properties and satisfying either silences both.`,
   codes: [
     { code: "DUPLICATE_INVARIANT_ID", defaultSeverity: "error", summary: "An entity declares two invariants with the same id" }
@@ -18923,6 +19091,7 @@ function resolveComponentClass(t, ctx) {
 }
 var invariantBackingRule = {
   name: "invariant-backing",
+  judges: "design",
   description: 'The invariant registry: entities may declare domain invariants (type.invariants), anchored through their componentClass. Every write-effect contract method of the owning component must carry a narrative step asserting each invariant (step.assertsInvariants: "<type-id>.<invariant-id>") \u2014 the same declared-and-backed shape as semantic guarantees. This is an HONEST lint over declarations: a green run means every write path visibly claims the invariant, never that the narrative or code actually enforces it. An invariant with no resolvable owner or no declared write path is unanchored, and nothing further is claimed about it.',
   codes: [
     { code: "INVARIANT_UNANCHORED", defaultSeverity: "warning", summary: "An entity declares invariants but has no componentClass, its componentClass does not resolve, or the owning component declares no write-effect contract methods" },
@@ -18981,6 +19150,7 @@ var invariantBackingRule = {
 // src/core/rules/wiring/invariant-references.ts
 var invariantReferencesRule = {
   name: "invariant-references",
+  judges: "design",
   description: "Every invariant a narrative step asserts (step.assertsInvariants) must resolve to a declared entity invariant: the reference splits at its last dot into a type reference and an invariant id, and some entity matching that type reference must declare that id. A reference nothing declares is an error \u2014 the step claims a property that exists nowhere.",
   codes: [
     { code: "UNKNOWN_INVARIANT_REF", defaultSeverity: "error", summary: "A narrative step asserts an invariant that no entity declares" }
@@ -19041,6 +19211,7 @@ function collectEnds(ctx) {
 }
 var eventTopologyRule = {
   name: "event-topology",
+  judges: "design",
   description: "Bipartite completeness of the declared pub/sub graph: every topic a component emits (emits declarations, MessageBus publish endpoints) must have at least one subscriber (subscribesTo declarations, MessageBus subscribe endpoints), and every subscription must have at least one source. Pairing is by exact topic name, and a topic is reported once per component however many declarations bind it there. Trees that declare no event edges see nothing \u2014 the rule costs request/response systems zero noise. Warnings + lint.allow: a topic produced for (or consumed from) an EXTERNAL system is a legitimate, declarable exception.",
   codes: [
     { code: "UNCONSUMED_TOPIC", defaultSeverity: "warning", summary: "Topic is emitted but nothing in the tree subscribes to it" },
@@ -19078,6 +19249,7 @@ var eventTopologyRule = {
 var quoteList = (names) => names.map((n) => `"${n}"`).join(", ");
 var sourceFileLinkageRule = {
   name: "source-file-linkage",
+  judges: "code",
   description: "Code\u2194spec Level 1: every source file an implementation names \u2014 its own sourcePath and each method's \u2014 must resolve to a real, readable file inside the project root, and an implementation that names no file at all, or leaves a contract method without one, is linked to no code. A file that escapes the root, is missing or cannot be analyzed is reported once and blocks only the methods realized in it. A run in which TypeScript/JavaScript files were analyzed below exact grade reports that once (CONFORMANCE_DEGRADED), since dependency conformance then skips them. Implementations under chained subsystems (projectPath) validate standalone in their own project run and are skipped here.",
   codes: [
     { code: "MISSING_SOURCE_PATH", defaultSeverity: "warning", summary: "An implementation names no source file at all, or a contract method is left without one \u2014 structural conformance cannot link it to code" },
@@ -19188,6 +19360,7 @@ function bodyReachable(code, file, symbol) {
 }
 var methodRealizationRule = {
   name: "method-realization",
+  judges: "code",
   description: "Code\u2194spec Level 1: every L3 contract method must be realized in its own source file (the method's sourcePath, else the implementation's) at its conformance tier \u2014 declared | anchored | off; Portals default to anchored, everything else to declared, and a per-method `symbol` maps an intent-language name onto the code name. A method realized by a DECLARATION owes a function BODY as well: at exact grade one must be reachable under the symbol, here or through the imports and republications this file forwards it by, so a signature, an ambient or interface declaration or a plain value binding stops reading as an implementation (METHOD_BODY_NOT_FOUND). Findings carry the analysis grade (exact AST | pattern table | generic scan) so weaker analysis is visible. Methods whose file escapes the root, is missing or could not be analyzed are left to source-file-linkage, and implementations under chained subsystems (projectPath) validate standalone in their own project run.",
   codes: [
     { code: "UNREALIZED_METHOD", defaultSeverity: "warning", summary: "An L3 contract method has no anchor in its own source file (the method's sourcePath, else the implementation's) at the required conformance tier" },
@@ -19248,6 +19421,7 @@ var methodRealizationRule = {
 // src/core/rules/conformance/finding-realization.ts
 var findingRealizationRule = {
   name: "finding-realization",
+  judges: "code",
   description: "Code\u2194spec Level 1: every finding code an L3 contract method declares must be anchored in the method's own source file (the method's sourcePath, else the implementation's) \u2014 as a string literal or, at exact grade, a property-access name, so a code reported through a constants object counts. Below exact grade any identifier or word counts, and the grade rides on the finding. Respects the conformance dial (off skips), leaves unresolvable files to source-file-linkage, and skips implementations under chained subsystems (projectPath), which validate standalone in their own project run.",
   codes: [
     { code: "UNREALIZED_FINDING", defaultSeverity: "warning", summary: "A finding code a contract method declares appears in the method's source file neither as a string literal nor as a property-access name (below exact grade, any identifier counts)" }
@@ -19373,6 +19547,7 @@ function describeMiss(m) {
 }
 var callConformanceRule = {
   name: "call-conformance",
+  judges: "code",
   description: "Code\u2194spec Level 3: the CLAIMED call \u2194 realized call relation, judged both ways against the method's own source file (its sourcePath, else the implementation's), at exact analysis grade only. A method claims a call two ways and they face one check: a narrative `call` step, and an entry of the declared `calls` a narrative-less method reaches its collaborators through. They assert the same thing, and the step number is no part of the claim \u2014 this check never reads order, so it is only how a finding points at one. Forward: every claim must be realized by a call whose callee RESOLVES TO one of the target method's own source files \u2014 the target's contract name or a per-method `symbol` override, closed transitively over the named helpers the realized function calls, and resolved against every file the call CAN have reached: a `this.<field>.<method>()` receiver followed through the field's DECLARED TYPE, a `new Class(...).<method>()` receiver through the module its CLASS NAME came from, and a plain `<name>.<method>()` receiver through the type the file ANNOTATES that name with \u2014 a parameter's, or an annotated variable's, which is how a module that wires its collaborators as closures writes every one of its calls. A matching call whose origin a pure model cannot resolve is reported apart as CALL_ORIGIN_UNRESOLVED, which NAMES the shape it could not follow and asks for nothing \u2014 a coverage hole in the reader, reported for the reason CONFORMANCE_DEGRADED is: a silently degraded gate is worse than a degraded one. A finding names a landing only from the PROVEN tier so that widening what a call reached can accept a claim but never accuse one, and a target that names no file of its own falls back to name membership. Converse: a call that resolves to a modelled method of ANOTHER component in the SAME file crosses a component boundary while looking local, so the method must claim it \u2014 in a step or in `calls` (UNDECLARED_COLOCATED_CALL) \u2014 judged on the proven tier alone, and a same-file private helper is no modelled method and is never reported. A method that claims nothing at all is judged in neither direction: what it leaves unsaid is UNUSED_*'s subject. Order, arguments and conditions stay unverified, dispatch steps (runtime-table routed) are no claim about a call site, a malformed declared reference is MALFORMED_DECLARED_CALL's finding and names no target here, the conformance dial (off) skips, and weaker analysis grades never guess.",
   codes: [
     { code: "CALL_STEP_UNREALIZED", defaultSeverity: "warning", summary: "Narrative call step or declared call realized by no call that resolves to the target method's own source file \u2014 the call is absent, or it lands in another module", carryable: true },
@@ -19498,6 +19673,7 @@ var callConformanceRule = {
 var isStatelessLogic = (component) => isLogic(component) && !holdsState(component);
 var hiddenStateRule = {
   name: "hidden-state",
+  judges: "code",
   description: "The fields-vs-Store criterion, statically approximated: module-scope mutable bindings (let/var) in a source file mapped EXCLUSIVELY to logic that holds no state (a component whose type isLogic() and not holdsState(): an Orchestrator, or a Specialist until it is retired) are flagged as hidden held state. A component maps every file its implementations and their methods name. State a logic component keeps for itself is invisible to the spec, the canvas, and every persistence rule: promote it to a Store (durability: cache for loss-safe memo state), or lint.allow with the reason it is genuinely wiring or ephemeral. Supervisor and Actor files may hold runtime state. Exact analysis grade only; files also mapped to data or boundary components are exempt (N:1 collapse); const-bound container mutation is beyond this check and the finding says so.",
   codes: [
     { code: "HIDDEN_STATE", defaultSeverity: "warning", summary: "Module-scope mutable binding in a file mapped only to stateless logic (Orchestrators) \u2014 held state hiding outside a Store, Supervisor or Actor" }
@@ -19548,6 +19724,7 @@ var hiddenStateRule = {
 // src/core/rules/conformance/dependency-conformance.ts
 var dependencyConformanceRule = {
   name: "dependency-conformance",
+  judges: "code",
   description: "Code\u2194spec Level 2: runtime import edges between component-mapped source files (a component maps to every file its implementations and their methods name) must be justified by declared relations \u2014 a direct dependsOn/owns pair, a shared component, membership in a depended-on pattern, or (across subsystems) a declared edge to the target subsystem's published surface (UNDECLARED_DEPENDENCY). Conversely, a declared dependsOn/owns edge between components realized in different files should be visible as an import between any file of the source and any file of the target (UNREALIZED_DEPENDENCY \u2014 DI indirection can defeat this, hence warning). Only exact-grade analyzed files participate; type-only imports are exempt; chained subprojects validate standalone.",
   codes: [
     { code: "UNDECLARED_DEPENDENCY", defaultSeverity: "warning", summary: "A runtime import between component-mapped files has no declared dependsOn/owns (or published-surface) justification" },
@@ -19654,6 +19831,7 @@ var dependencyConformanceRule = {
 // src/core/rules/conformance/portal-imports.ts
 var portalImportsRule = {
   name: "portal-imports",
+  judges: "code",
   description: "A runtime import that crosses a subsystem boundary must land on a file that realizes one of the target subsystem's PUBLISHED components \u2014 its portal file. dependency-conformance asks whether the hop is declared; this asks where it lands. An import that reaches past the portal into a concrete module can use anything that module exports, published or not, so the portal stops being the boundary and names no contract ever promised leak across it \u2014 which is how a surface grows that nobody designed. In-process it is cosmetic at runtime; it is not cosmetic for the contract. Only exact-grade component-mapped files participate; type-only imports are exempt; chained subprojects validate standalone.",
   codes: [
     {
@@ -19708,6 +19886,7 @@ var portalImportsRule = {
 // src/core/rules/conformance/integration-sim-declaration.ts
 var integrationSimDeclarationRule = {
   name: "integration-sim-declaration",
+  judges: "code",
   description: "Once a subsystem has adopted integration sims (its first declared L4 simPath), every OTHER complete, non-leaf implementation of that subsystem must declare one too: its unit suite proves contract shape against mocks, not that the wired components run together. A leaf component's unit suite IS its sim, and a subsystem that has adopted nothing is never flooded.",
   codes: [
     { code: "MISSING_INTEGRATION_SIM", defaultSeverity: "warning", summary: "Complete non-leaf implementation in a sim-adopting subsystem declares no simPath" }
@@ -19744,6 +19923,7 @@ var integrationSimDeclarationRule = {
 // src/core/rules/conformance/integration-sim-file.ts
 var integrationSimFileRule = {
   name: "integration-sim-file",
+  judges: "code",
   description: "A declared L4 simPath must resolve to a readable, committed file inside the project root \u2014 the integration harness is a re-runnable file, not a claim. Execution stays CI's job.",
   codes: [
     { code: "SIM_FILE_MISSING", defaultSeverity: "warning", summary: "Declared simPath resolves to no file inside the project root" }
@@ -19773,6 +19953,7 @@ var integrationSimFileRule = {
 // src/core/rules/conformance/integration-sim-wiring.ts
 var integrationSimWiringRule = {
   name: "integration-sim-wiring",
+  judges: "code",
   description: "A committed integration harness's import graph \u2014 closed transitively over the analyzed module set, exact grade only \u2014 must reach at least one of the component's own source modules (its implementation's or a method's) and at least one source module of each direct dependsOn/owns component (technology-boundary dependencies exempt: their contract-faithful fakes are sanctioned). Execution is CI's job \u2014 this proves wiring, never that the sim passes.",
   codes: [
     { code: "UNWIRED_INTEGRATION_SIM", defaultSeverity: "warning", summary: "Sim file does not import the real modules it claims to wire" }
@@ -19830,6 +20011,7 @@ var integrationSimWiringRule = {
 // src/core/rules/conformance/integration-sim-coverage.ts
 var integrationSimCoverageRule = {
   name: "integration-sim-coverage",
+  judges: "code",
   description: "Once a committed integration harness carries sim:<component-id>. anchors, that component claims path coverage: every narrated method's happy path and every labeled throw step needs its exact sim:<component>.<method>[:<label>] string-literal anchor. Anchors prove the path is NAMED \u2014 assertion quality and execution stay CI's job.",
   codes: [
     { code: "SIM_PATH_UNCOVERED", defaultSeverity: "warning", summary: "A narrative path has no sim:<component>.<method>[:<label>] anchor in the component's coverage-opted harness" }
@@ -19903,6 +20085,7 @@ function ownerOf2(type, file) {
 }
 var typeRealizationRule = {
   name: "type-realization",
+  judges: "code",
   description: "Code\u2194spec Level 1 for the data model: a type that names a sourcePath is claiming code, so every file it names \u2014 its own and each method's \u2014 must resolve to a real, readable file inside the project root, its file must PUBLISH its declaration (an exported name at exact grade, the declaration tier below it, under its `symbol` when the code-level name differs from the type's name \u2014 and a pure re-export barrel publishes nothing of its own, so a claim on one is never realized), and each of its pure methods must appear in its own file (the method's sourcePath, else the type's) at the declaration tier, under the method's `symbol`, else the method's name. A type that names no sourcePath claims nothing and is never reported. Findings carry the analysis grade (exact AST | pattern table | generic scan) so weaker analysis is visible, a file that escapes the root, is missing or could not be analyzed is reported once and blocks only what it would have realized, and types under chained subsystems (projectPath) validate standalone in their own project run.",
   codes: [
     { code: "UNREALIZED_TYPE", defaultSeverity: "warning", summary: "A type names a sourcePath but its declaration is nowhere in that file \u2014 the claim points at code that does not hold it" },
@@ -19971,6 +20154,7 @@ function absence(optional) {
 }
 var typeShapeRule = {
   name: "type-shape",
+  judges: "code",
   description: "Code-to-contract for the DATA: a type spec's `fields` are compared, name by name, against the shape its `sourcePath` actually declares. `typeRealization` asks whether a type EXISTS in code; nothing asked whether it is the shape the spec claims, so a type spec could describe two fields of a six-field record \u2014 and call the two that are optional required \u2014 straight through a lock and a CI gate, while the ERD, the agent briefs and every implementer read it as truth. That is the worst of the code-to-spec gaps, because a wrong signature eventually breaks at a call site and a type spec that lies is only ever read by humans and agents. Two origins answer at exact grade: a DECLARED shape, whose members the file lists, and a DERIVED one, an alias followed one hop to the object literal its schema is built from, where the keys are the members. A shape that extends another is judged on what it shows and never on what it omits, since its inherited members are not in this file to count.",
   codes: [
     {
@@ -20104,6 +20288,7 @@ function agreed(judgements, reading) {
 }
 var paramConformanceRule = {
   name: "param-conformance",
+  judges: "code",
   description: "Code-to-contract for the SIGNATURE, the last of the three readings a spec-driven gate never made: a contract declares `params`, and nothing ever compared them to the parameters of the function that realizes the method. A contract could promise an argument the code does not take, take one the contract never mentions \u2014 including a secret \u2014 or name the same argument two different things, and the brief handed to an implementer would carry the contract's version. Parameters are matched by POSITION against the tail of the realization's list, and the declared type is what tells a rename from a dropped argument: `seed(config: HostConfig)` realized as `bootstrapInstance(cfg: HostConfig)` is one parameter under two names, which anything matching on names alone reads as a parameter the code lost. What a realization takes BEFORE the contract's own parameters is wiring, and it is declared on the implementation as `injectedParams` rather than inferred, because an inferred prefix cannot be told from a renamed first argument. A method the named file only CALLS is left to `methodRealization`, which already reports that the body is not here.",
   codes: [
     {
@@ -20238,6 +20423,7 @@ function answers(route, endpoint) {
 }
 var routeCoverageRule = {
   name: "route-coverage",
+  judges: "code",
   description: "Code-to-contract for the ROUTES: does every route a router actually answers have a contract endpoint, and does every contract endpoint have a route that answers it? A portal's endpoints are what its contract promises; the router is what the code serves; nothing compared the two, so a route with no contract \u2014 including a write \u2014 could run for months without a single rule noticing. The listener's mount names the router function (its `via`), and the routes are read out of that function's guards; the path segment the router never checks is the one the mount's prefix guarantees. One idiom is read \u2014 a method comparison with comparisons on the path's split segments \u2014 and a mounted router that yields no route in it is reported as unread, never passed: a check that cannot see a router must say so rather than stay quiet.",
   codes: [
     {
@@ -20340,6 +20526,7 @@ var routeCoverageRule = {
 // src/core/rules/conformance/unclaimed-source.ts
 var unclaimedSourceRule = {
   name: "unclaimed-source",
+  judges: "code",
   description: "Code\u2194spec Level 1, asked the other way round: every source file under the project's declared source roots must be named by some spec \u2014 an implementation's sourcePath, a method's, a simPath, or a type's \u2014 or be carried in the frozen `rules.conformance.unclaimed` list. A pure re-export barrel declares nothing of its own and only republishes other modules, so it has no code to claim and is exempt (exact grade only: a weaker grade cannot tell a barrel from a file it failed to parse). Declaring no source roots leaves the check silent, which is what makes it opt-in; the unclaimed list is a one-way debt register, so an entry the walk no longer finds unclaimed must be deleted and the list can only shrink.",
   codes: [
     { code: "UNCLAIMED_SOURCE_FILE", defaultSeverity: "warning", summary: "A source file under a declared source root that no spec names and the frozen unclaimed list does not carry \u2014 code nobody designed" },
@@ -20387,6 +20574,7 @@ var unclaimedSourceRule = {
 var NOTHING_PROMISED = /* @__PURE__ */ new Set();
 var exportConformanceRule = {
   name: "export-conformance",
+  judges: "code",
   description: "Code-to-contract for the SURFACE: does this file publish anything the components it realizes never promised, that another component then takes? The rest of the conformance set reads contract-to-code \u2014 it asks whether the code holds what a spec claims \u2014 so a file could export whatever it liked under a component's name and nothing looked. That is one half of the same hole as a contract promising a parameter it never passes. A method's `exportedVia` names the export a consumer imports to REACH it \u2014 the value that composes it, which `symbol` cannot name because `symbol` names the function inside \u2014 and a listener's mount names the router entry it calls to hand a portal its requests; both are declared publication, and a declared handle the file does not actually export is itself a finding, so naming one can never become a free-text suppression. Both questions are asked only of a file read at exact grade, and a taker counts only when its own import specifier resolves to the file it is accused of taking from: below that nothing separates an export from a mention, or a shared word from a shared module.",
   codes: [
     {
@@ -20545,6 +20733,7 @@ var exportConformanceRule = {
 // src/core/rules/conformance/carried-debt.ts
 var carriedDebtRule = {
   name: "carried-debt",
+  judges: "code",
   description: "The conformance debt register (`rules.conformance.carried`) holds the code\u2194spec findings this tree carries as declared, classified debt \u2014 `unclaimed`'s one-way shape, for findings about code a spec does name. It is not a second lint.allow: an allow says a finding is wrong here by design, an entry here says the finding is right and unpaid, and each entry states which of the three kinds it is (drift: spec and code disagree; undecided: the fix waits on a modelling decision nobody has taken; unreadable: the analysis cannot follow the shape the code is written in) and why. Only a code a rule declares CARRYABLE may appear, and naming any other is an error, so the register can never widen into general-purpose suppression. An entry carries a finding only when it lists EVERY unit that finding reports, so an aggregating finding cannot grow behind it; an entry that matched nothing, that duplicates another, that names a spec the tree does not hold, or that lists a unit no longer reported is STALE_CARRIED_FINDING, so the register only shrinks. The audit is silent in a run that could not have fired the findings at all: one that built no code model, the specs outside a scoped run, and a code the project switched off. Nothing can check a reason for TRUTH \u2014 a stale entry is one that stopped applying, never one that still applies for a reason that has become false \u2014 so a reason group may declare its own classification provisional (`revisit`: what would settle it), and every run counts those findings beside the kind totals.",
   codes: [
     { code: "UNCARRYABLE_FINDING", defaultSeverity: "error", summary: "The conformance debt register names an issue code no rule emits, or one no rule declares carryable \u2014 the register holds measured code\u2194spec debt, never a design rule somebody wants quiet" },
@@ -20656,6 +20845,7 @@ function routingTableComponents(ctx) {
 }
 var methodCohesionRule = {
   name: "method-cohesion",
+  judges: "design",
   description: "An Orchestrator's methods share collaborators; when they split into groups that call no component in common, the component holds more than one responsibility. Reported only where two or more groups each hold two or more methods, so a single specialized method is not a finding \u2014 and never on a pure forwarder, whose every narrated method is a single hand-off and whose responsibility therefore lives in what it forwards to.",
   codes: [
     { code: "INCOHESIVE_METHODS", defaultSeverity: "warning", summary: "Orchestrator's methods form two or more groups of two or more that share no called component" }
@@ -20700,6 +20890,7 @@ var methodCohesionRule = {
 var DEFAULT_GOD_COMPONENT_THRESHOLD = 8;
 var couplingRule = {
   name: "coupling-health",
+  judges: "design",
   description: "Two subsystems depending on each other is a real architectural commitment (deployment affinity, backpressure, scaling coupling). It is allowed but must be acknowledged with a trustedLinks declaration on either side, stating the reason (e.g. a latency fast lane that bypasses the bus). A trustedLink on the SOURCE subsystem additionally licenses its direct edges into the peer without the client-Adapter shim; the published-Portal target requirement stays either way. Also flags components whose dependsOn fan-out suggests a god component.",
   codes: [
     { code: "MUTUAL_SUBSYSTEM_DEPENDENCY", defaultSeverity: "warning", summary: "Subsystems depend on each other without a declared trusted link" },
@@ -20828,6 +21019,7 @@ var LANGUAGE_MARKERS = {
 };
 var signatureLanguageBuiltinsRule = {
   name: "signature-language-builtins",
+  judges: "design",
   description: "Contracts must speak the declared target language: builtin types that unambiguously belong to another language family are flagged in method signatures (e.g. `usize` in a TypeScript system, `Promise` in a Rust one). Set targetLanguage on the system (L0) or override per subsystem (L1).",
   codes: [
     { code: "LANGUAGE_FOREIGN_BUILTIN", defaultSeverity: "warning", summary: "Signature uses a builtin from a different language family" }
@@ -20903,6 +21095,7 @@ function constructLabel(construct) {
 }
 var narrativeLanguageConstructsRule = {
   name: "narrative-language-constructs",
+  judges: "design",
   description: "Narratives must describe flows the declared target language can express: steps using constructs the language lacks (e.g. exceptions in Rust/Go, do-while in Python) are flagged with the idiomatic alternative. Set targetLanguage on the system (L0) or override per subsystem (L1).",
   codes: [
     { code: "LANGUAGE_FOREIGN_FLOW", defaultSeverity: "warning", summary: "Narrative flow step uses a construct the target language does not have" }
@@ -20946,6 +21139,7 @@ var narrativeLanguageConstructsRule = {
 var DATA_LAYER = /* @__PURE__ */ new Set(["Adapter", "Store", "Registry", "Index"]);
 var technologyBindingRule = {
   name: "technology-binding",
+  judges: "design",
   description: "Only data-layer stereotypes (Adapter/Store/Registry/Index) should bind a technology directly: an L4 that declares `technologies` on logic has no swap seam. No hardcoded vendor lists \u2014 only declared tokens are policed, so the rule never fires on a tree that doesn't opt in.",
   codes: [
     { code: "TECH_ON_LOGIC_COMPONENT", defaultSeverity: "warning", summary: "Technology bound by a non-data-layer stereotype" }
@@ -20991,6 +21185,7 @@ function contractIdentifiers(m) {
 }
 var technologyRule = {
   name: "technology-boundaries",
+  judges: "design",
   description: "Technology stays behind its owning boundary: an L4 that declares `technologies` (e.g. [mysql]) makes its component's ownership tree the technology's home. References outside that tree are leakage, and L3 contract identifiers must stay intent-language \u2014 the contract is the swap seam, so the vendor name is wrong even on the owning component's own interface.",
   codes: [
     { code: "TECH_LEAKAGE", defaultSeverity: "warning", summary: "Technology referenced outside its owning boundary" },
@@ -21208,6 +21403,7 @@ function getBaseId(id) {
 var isAllUppercase = (s) => /^[A-Z0-9_]+$/.test(s);
 var namingRule = {
   name: "naming-conventions",
+  judges: "design",
   description: "Enforces naming conventions (casing styles or regular expressions) for subsystem, component, interface, type (differentiating entities and value-objects), method, variables/parameters, fields, and constants names/IDs, plus stereotype-specific naming patterns.",
   codes: [
     { code: "NAMING_CONVENTION_VIOLATION", defaultSeverity: "warning", summary: "Item name or ID does not match the configured casing pattern or regex" },
@@ -21366,6 +21562,7 @@ function checkDescription(ctx, desc, required, minLength, specId, typeName, isDr
 }
 var complexityRule = {
   name: "complexity-and-metadata",
+  judges: "design",
   description: "Enforces metadata documentation completeness (checking if descriptions are missing or too short) and structural complexity caps (limits on methods per interface, parameters per method, dependencies per component, and components per subsystem) configured globally or in architectural profiles. A narrative's own length and shape are judged by narrative-complexity.",
   codes: [
     { code: "MISSING_DESCRIPTION", defaultSeverity: "warning", summary: "Required description field is missing or empty" },
@@ -21507,6 +21704,7 @@ var DEFAULT_WARN_ABOVE = "moderate";
 var DEFAULT_MAX_STEPS = 25;
 var narrativeComplexityRule = {
   name: "narrative-complexity",
+  judges: "design",
   description: "Judges a narrative on two independent axes: the cognitive band its shape earns, from branching and nesting, and the number of steps it lists. A flat list of registrations is long but linear; a deeply nested guard is short but severe. Each axis warns above its configured level, and reports an error only where a maximum is configured.",
   codes: [
     { code: "NARRATIVE_COMPLEXITY", defaultSeverity: "warning", summary: "Narrative's cognitive band is above the configured level (default: above moderate)" },
@@ -21620,6 +21818,7 @@ function withoutWord(methodWords, dropIndex) {
 }
 var namingDisciplineRule = {
   name: "naming-discipline",
+  judges: "design",
   description: "A name says what a thing is and never repeats itself: a component's head noun names its own block, generic role words say nothing, a method does not repeat its component's head noun, and a component with one method is not merely that method's name. Adapters and Portals are exempt from the repetition check, because a forwarder's method mirrors the command or route it exposes.",
   codes: [
     { code: "MISLEADING_BLOCK_WORD", defaultSeverity: "warning", summary: "Component's head noun names a building block that is not its componentType" },
@@ -23730,9 +23929,27 @@ function measure(candidate) {
 
 // src/core/rules/gate-identity.ts
 var crypto3 = __toESM(require("crypto"));
-var GATE_ALGORITHM = "sha256+content+doctrine+inputs";
+var GATE_ALGORITHM = "sha256+content+doctrine+inputs+members";
+var byKey = (items, key) => [...items].sort((a, b) => compareOrdinal(key(a), key(b)));
+function ruleIdentities(rules) {
+  return byKey(
+    rules.map((r) => ({
+      name: r.name,
+      codes: byKey(r.codes.map((c) => ({ code: c.code, severity: c.defaultSeverity })), (c) => c.code)
+    })),
+    (r) => r.name
+  );
+}
+function codeJudgedCodes(builtinRules) {
+  return new Set(builtinRules.filter(judgesCode).flatMap((r) => r.codes.map((c) => c.code)));
+}
+function designRulesConfig(rules, codeCodes) {
+  if (!rules) return null;
+  const { conformance: _codeTuning, sddRuleSeverity, ...rest } = rules;
+  const severities = Object.fromEntries(Object.entries(sddRuleSeverity ?? {}).filter(([code]) => !codeCodes.has(code)));
+  return { ...rest, ...Object.keys(severities).length > 0 ? { sddRuleSeverity: severities } : {} };
+}
 function doctrineIdentity(doctrine2, builtinRules, gate) {
-  const byKey = (items, key) => [...items].sort((a, b) => compareOrdinal(key(a), key(b)));
   return {
     /**
      * The BUILTIN rule set, by identity rather than by wairon version.
@@ -23749,20 +23966,23 @@ function doctrineIdentity(doctrine2, builtinRules, gate) {
      * in the wairon version would catch it at the cost of churning every lock on
      * every release — the trade this projection deliberately declines.
      */
-    builtinRules: byKey(
-      builtinRules.map((r) => ({
-        name: r.name,
-        codes: byKey(r.codes.map((c) => ({ code: c.code, severity: c.defaultSeverity })), (c) => c.code)
-      })),
-      (r) => r.name
-    ),
+    //
+    // Only the rules that judge DESIGN: a code analyzer that gains a code or a
+    // stricter check must never stale an approval (analyzer-upgrade-keeps-approval).
+    builtinRules: ruleIdentities(builtinRules.filter((r) => !judgesCode(r))),
     /**
-     * Which profile GOVERNS, and the project's own rule tuning. Both decide
-     * verdicts — a projectType switch changes the doctrine family outright, and
-     * `rules` carries severity overrides, complexity caps, and designDepth.
+     * Which profile GOVERNS, and the project's own design rule tuning. Both
+     * decide verdicts — a projectType switch changes the doctrine family
+     * outright, and `rules` carries design severity overrides, complexity caps
+     * and designDepth. Its code-conformance tuning is the analyzer's.
      */
     projectType: gate.projectType ?? null,
-    rulesConfig: gate.rules ?? null,
+    rulesConfig: designRulesConfig(gate.rules, codeJudgedCodes(builtinRules)),
+    /**
+     * What the project requires of the projects it contains (stage 5): a
+     * changed requirement stales the requiring project's lock.
+     */
+    composition: gate.composition ?? null,
     packs: byKey(
       doctrine2.packs.map((p) => ({ name: p.name, version: p.version ?? null, scope: p.scope })),
       (p) => `${p.name}@${p.version ?? ""}#${p.scope}`
@@ -23783,11 +24003,12 @@ function doctrineIdentity(doctrine2, builtinRules, gate) {
     )
   };
 }
-function computeGateIdentity(content, doctrine2, builtinRules, inputs, gate) {
+function computeGateIdentity(content, doctrine2, builtinRules, inputs, gate, members) {
   const payload = {
     content: content.digest,
     doctrine: doctrineIdentity(doctrine2, builtinRules, gate),
-    inputs: [...inputs].sort()
+    inputs: [...inputs].sort(compareOrdinal),
+    members: byKey(Object.entries(members), ([alias]) => alias).map(([alias, subject]) => ({ alias, subject }))
   };
   const digest2 = crypto3.createHash("sha256").update(canonicalize(payload)).digest("hex");
   return { algorithm: GATE_ALGORITHM, digest: digest2 };
@@ -23898,6 +24119,9 @@ function memberOwning(owners, memberKeys, key) {
   return best;
 }
 function validateProject(rulesOrOptions, projectType = "backend") {
+  return runOwnersGate(rulesOrOptions, projectType).result;
+}
+function runOwnersGate(rulesOrOptions, projectType = "backend") {
   let rules = rulesOrOptions;
   let scopeSubsystem;
   let extensions;
@@ -23948,7 +24172,7 @@ function validateProject(rulesOrOptions, projectType = "backend") {
     if (!system) {
       const pending = extensions.errors.length > 0 || extensions.selectionFailures.length > 0 ? " Extension packs were not checked yet either, and at least one problem is already known there \u2014 re-run once the L0 exists." : " Extension-pack configuration is not checked until the L0 exists.";
       issues.push(issue("error", "MISSING_SYSTEM_SPEC", `L0 System specification (.system.yaml) is missing.${pending}`));
-      return { valid: false, issues };
+      return { result: { valid: false, issues }, codeModel };
     }
     if (scopeSubsystem) {
       const scopeMatches = subsystems.some(
@@ -23966,7 +24190,7 @@ function validateProject(rulesOrOptions, projectType = "backend") {
             scopeSubsystem
           )
         );
-        return { valid: false, issues };
+        return { result: { valid: false, issues }, codeModel };
       }
     }
     for (const err of extensions.errors) {
@@ -24028,9 +24252,12 @@ function validateProject(rulesOrOptions, projectType = "backend") {
     const count = pinnedExternals.length;
     const hint = count > 0 ? `${count} external${count === 1 ? " was" : "s were"} judged against ${count === 1 ? "its pin" : "their pins"} alone; \`wairon validate --family\` composes ${count === 1 ? "it" : "them"} against the live producer${count === 1 ? "" : "s"}.` : void 0;
     return {
-      valid: issues.every((i) => i.severity !== "error"),
-      issues,
-      ...hint ? { hint } : {}
+      result: {
+        valid: issues.every((i) => i.severity !== "error"),
+        issues,
+        ...hint ? { hint } : {}
+      },
+      codeModel
     };
   } finally {
     statusBearing.forEach((s, i) => {
@@ -24075,17 +24302,36 @@ function builtinProjectKinds() {
   return [...PROJECT_KINDS];
 }
 function computeGateStateId() {
-  const content = computeStateId();
+  scanAllSpecs({ recursive: true });
+  const content = computeOwnStateId();
   const extensions = loadProjectExtensions();
   let gate = {};
   try {
     const config = loadProjectConfig();
-    if (config) gate = { projectType: config.projectType, rules: config.rules };
+    if (config) gate = { projectType: config.projectType, rules: config.rules, composition: config.composition ?? null };
   } catch {
   }
   const inputs = consumedContractInputs();
+  const members = directMemberSubjects();
   registerBuiltinRules();
-  return computeGateIdentity(content, extensions, ruleSequence(), inputs, gate);
+  return computeGateIdentity(content, extensions, ruleSequence(), inputs, gate, members);
+}
+var NEVER_SUBJECT = "never";
+function directMemberSubjects() {
+  const family = graph();
+  const subjects = {};
+  for (const node of family.nodes) {
+    if (node.parent !== "" || node.mountAlias === void 0) continue;
+    const record = approvalRecord(node.directory);
+    subjects[node.mountAlias] = record ? `${record.stateId.algorithm}:${record.stateId.digest}` : NEVER_SUBJECT;
+  }
+  for (const problem of family.problems) {
+    if (problem.kind === "member-absent" && problem.projects[0] === "" && problem.id) subjects[problem.id] = NEVER_SUBJECT;
+  }
+  return subjects;
+}
+function familyApprovals(depth) {
+  return projectApprovals(depth);
 }
 
 // src/core/diagram.ts
@@ -24429,8 +24675,8 @@ function generateSequenceDiagram(componentId, methodName, options) {
     const steps = [...methodImpl.narrative].sort((a, b) => a.stepNumber - b.stepNumber);
     for (const step of steps) {
       for (const par of parallelArms) {
-        const sep7 = par.sepByStep.get(step.stepNumber);
-        if (sep7 !== void 0) lines.push(`  and ${escapeLabel(sep7)}`);
+        const sep8 = par.sepByStep.get(step.stepNumber);
+        if (sep8 !== void 0) lines.push(`  and ${escapeLabel(sep8)}`);
       }
       switch (step.type) {
         case "local":
@@ -25005,10 +25251,10 @@ function settle(owner, level, candidates, problems) {
       detail: `"${name}" is bound to ${targets.length} different targets (${targets.join(", ")}) by ${explicit.length ? "explicit entries" : "wildcard re-exports"}; it is left out of the table`
     });
   }
-  const byKey = /* @__PURE__ */ new Map();
-  for (const e of entries) byKey.set(nameKey(e.publicName), [...byKey.get(nameKey(e.publicName)) ?? [], e]);
+  const byKey2 = /* @__PURE__ */ new Map();
+  for (const e of entries) byKey2.set(nameKey(e.publicName), [...byKey2.get(nameKey(e.publicName)) ?? [], e]);
   const clashing = /* @__PURE__ */ new Set();
-  for (const group of byKey.values()) {
+  for (const group of byKey2.values()) {
     const targets = [...new Set(group.map((e) => exportTargetKey(e)))];
     if (group.length < 2 || targets.length < 2) continue;
     group.forEach((e) => clashing.add(e));
@@ -25473,9 +25719,6 @@ function inspectChainedRoots(rootDir = getProjectRoot()) {
   walk2(root, "", /* @__PURE__ */ new Set([chainDirKey(root)]), 0);
   return inspection;
 }
-function listChainedRoots(rootDir = getProjectRoot()) {
-  return inspectChainedRoots(rootDir).roots;
-}
 function mapSpecReferences(kind, spec, map) {
   switch (kind) {
     case "subsystem": {
@@ -25734,10 +25977,10 @@ function keyedSystem(system, key, subsystems) {
   };
 }
 function resolveFamilyTables(raws) {
-  const byKey = new Map(raws.map((r) => [r.record.namespace, r]));
+  const byKey2 = new Map(raws.map((r) => [r.record.namespace, r]));
   const done = /* @__PURE__ */ new Set();
   const resolving = /* @__PURE__ */ new Set();
-  const resolve26 = (raw) => {
+  const resolve27 = (raw) => {
     const key = raw.record.namespace;
     if (done.has(key)) return raw.record.exports;
     if (resolving.has(key)) return null;
@@ -25751,8 +25994,8 @@ function resolveFamilyTables(raws) {
         const source = e.from ?? e.subsystem;
         const producerKey = source !== void 0 ? raw.record.aliases.get(source) : void 0;
         if (producerKey === void 0 || producerTables.has(producerKey)) continue;
-        const producer = byKey.get(producerKey);
-        producerTables.set(producerKey, producer ? resolve26(producer) : null);
+        const producer = byKey2.get(producerKey);
+        producerTables.set(producerKey, producer ? resolve27(producer) : null);
         audienceOf.set(producerKey, "project");
       }
       raw.record.subsystemExports = subsystemTables;
@@ -25768,7 +26011,7 @@ function resolveFamilyTables(raws) {
       resolving.delete(key);
     }
   };
-  raws.forEach((raw) => resolve26(raw));
+  raws.forEach((raw) => resolve27(raw));
 }
 function bindAuthored(raw, raws, readables, authored) {
   const key = raw.record.namespace;
@@ -29384,9 +29627,7 @@ function consumedSurfaceInputsAt(rootDir) {
   return keys;
 }
 function consumedContractInputs() {
-  const root = getProjectRoot();
-  const roots = [root, ...listChainedRoots(root).map((rel2) => path19.join(root, rel2))];
-  return roots.flatMap(consumedSurfaceInputsAt);
+  return consumedSurfaceInputsAt(getProjectRoot());
 }
 function readLockState(current2) {
   const record = readLockRecord();
@@ -31071,6 +31312,16 @@ function buildVariantGuidance(comps, allComponents, variantsById) {
   return composeVariantGuidance(comps, allComponents, variantsById);
 }
 function resolveAgentTopology() {
+  return resolveLayer(true);
+}
+function memberAgentIds(alias, memberDir) {
+  try {
+    return runWithProjectRoot(memberDir, () => resolveLayer(false).map((r) => `${alias}::${r.id}`));
+  } catch {
+    return [];
+  }
+}
+function resolveLayer(delegate) {
   projectFilesCache.clear();
   const system = loadSystemSpec();
   if (!system) return [];
@@ -31126,6 +31377,8 @@ function resolveAgentTopology() {
         writePaths: [mountSpecPath],
         tags: ["owner", "subproject", "delegate", "sdd"],
         dependencies: [],
+        // The member's own agents BY REFERENCE, never copied into this layer.
+        ...delegate ? { delegatesTo: memberAgentIds(sub.id, path26.resolve(getProjectRoot(), sub.projectPath)) } : {},
         status: "active",
         targets: activeTargets,
         createdAt: sub.createdAt,
@@ -31267,6 +31520,11 @@ var UnknownAgentError = class extends WaironError {
   }
 };
 function composeAgentBrief(agentId) {
+  const hop = memberHop(agentId);
+  if (hop) {
+    const brief = runWithProjectRoot(hop.directory, () => composeAgentBrief(hop.rest));
+    return throughMount(brief, hop.alias, hop.relative);
+  }
   const records = resolveAgentTopology();
   const record = records.find((r) => r.id === agentId);
   if (!record) {
@@ -31311,6 +31569,25 @@ ${guidance.trim()}
     budget
   };
 }
+function memberHop(agentId) {
+  const at = agentId.indexOf("::");
+  if (at < 0) return null;
+  const alias = agentId.slice(0, at);
+  const member = graph().nodes.find((n) => n.parent === "" && n.mountAlias === alias);
+  if (!member) return null;
+  const relative12 = path26.relative(getProjectRoot(), member.directory).split(path26.sep).join("/");
+  return { alias, rest: agentId.slice(at + 2), directory: member.directory, relative: relative12 };
+}
+function throughMount(brief, alias, relative12) {
+  const under = (p) => path26.posix.join(relative12, p);
+  return {
+    ...brief,
+    agentId: `${alias}::${brief.agentId}`,
+    ownedPaths: brief.ownedPaths.map(under),
+    ...brief.readPaths ? { readPaths: brief.readPaths.map(under) } : {},
+    root: brief.root ? under(brief.root) : relative12
+  };
+}
 function loadRegistry() {
   assertProjectInitialized();
   if (!pathExists(AI_PATHS.specsSystem())) return createEmptyRegistry();
@@ -31904,48 +32181,22 @@ function settledSpecPaths(root = getProjectRoot()) {
   const diff = diffAgainstApproval(root);
   return diff ? new Set(diff.unchangedPaths) : null;
 }
-function pinOf(stateId) {
-  return `${stateId.algorithm}:${stateId.digest}`;
-}
-function currentChildPins(mounts, root = getProjectRoot()) {
-  const pins = {};
-  for (const mount of mounts) {
-    if (!mount.projectPath || mount.id.includes("::")) continue;
-    const child = readLockRecordAt(path32.resolve(root, mount.projectPath));
-    if (child) pins[mount.id] = pinOf(child.stateId);
-  }
-  return pins;
-}
-function movedChildren(mounts, root = getProjectRoot()) {
-  const pinned = approvalRecord(root)?.children;
-  if (!pinned) return [];
-  const now = currentChildPins(mounts, root);
-  const moved = [];
-  for (const [id, was] of Object.entries(pinned)) {
-    const current2 = now[id] ?? null;
-    if (current2 !== was) moved.push({ id, pinned: was, now: current2 });
-  }
-  return moved;
-}
-function memberMounts(root = getProjectRoot()) {
-  return graph().nodes.filter((n) => n.parent === "" && n.mountAlias !== void 0).map((n) => ({ id: n.mountAlias, projectPath: path32.relative(root, n.directory).split(path32.sep).join("/") }));
-}
-function approvalVerdict() {
+function approvalVerdict(approvals) {
   const quiet = { text: "", drifted: false };
   try {
     const approval = approvalRecord();
     if (!approval) return quiet;
     const by = describeApprover(approval.lockedBy);
-    const moved = movedChildren(memberMounts());
-    const childNote = moved.length ? `
-${moved.length} chained child project(s) moved since approval: ${moved.map((m) => m.id).join(", ")}.` : "";
+    const notes = memberNotes(approvals ?? []);
+    const pinDrift = notes.drift;
+    const childNote = notes.text;
     const diff = diffAgainstApproval();
     if (!diff) {
       return {
         text: `
 Approved: ${approval.lockedAt} by ${by} \u2014 this lock predates per-spec approval, so drift is only visible at whole-tree level. Re-lock to record it.${childNote}
 `,
-        drifted: moved.length > 0
+        drifted: pinDrift
       };
     }
     if (diffSize(diff) === 0) {
@@ -31953,7 +32204,7 @@ Approved: ${approval.lockedAt} by ${by} \u2014 this lock predates per-spec appro
         text: `
 Approved: ${approval.lockedAt} by ${by} \u2014 no spec has changed since.${childNote}
 `,
-        drifted: moved.length > 0
+        drifted: pinDrift
       };
     }
     const parts = [];
@@ -31976,6 +32227,28 @@ ${headline} \u2014 approved ${approval.lockedAt} by ${by}:
     return quiet;
   }
 }
+var GATE_UPGRADE_NOTE = "the gate identity gained inputs in stage 5 (members' composition subjects, `composition`; code conformance moved beside the claim)";
+function memberNotes(approvals) {
+  const own = approvals.find((a) => a.key === "");
+  const direct = approvals.filter((a) => a.parent === "");
+  const moved = direct.filter((a) => a.pinned === "moved");
+  const unapproved = direct.filter((a) => a.state !== "approved");
+  const lines = [];
+  if (own?.upgraded) {
+    lines.push(`This approval was taken under an earlier gate identity \u2014 ${GATE_UPGRADE_NOTE}. Re-lock once.`);
+  }
+  if (moved.length) {
+    lines.push(`${moved.length} member pin(s) moved since approval: ${moved.map((a) => a.alias ?? a.key).join(", ")} \u2014 re-lock to approve them.`);
+  }
+  if (unapproved.length) {
+    lines.push(`Member(s) not approved at their own root: ${unapproved.map((a) => `${a.alias ?? a.key} (${a.state}${a.upgraded ? ", re-lock once" : ""})`).join(", ")}.`);
+  }
+  return {
+    text: lines.map((l) => `
+${l}`).join(""),
+    drift: !!own?.upgraded || moved.length > 0
+  };
+}
 
 // src/core/approver.ts
 var import_child_process = require("child_process");
@@ -32309,6 +32582,11 @@ function syncContextFiles() {
 
 // src/core/status.ts
 var path34 = __toESM(require("path"));
+function approvalTag(entry) {
+  if (!entry) return "";
+  const state = entry.upgraded ? `${entry.state}, re-lock once` : entry.state;
+  return entry.pinned ? ` [${state} \xB7 pin ${entry.pinned}]` : ` [${state}]`;
+}
 var asWritten = (text3) => text3;
 function fillDecor(decor) {
   return {
@@ -32469,12 +32747,21 @@ function getStatusReport(options = {}, decor) {
       const isLast = ownSubs.length + j === total - 1;
       const form = member.mountForm === "mount" ? mark.draft(" [mount form]") : "";
       const label2 = `[Project] ${member.mountAlias ?? member.namespace} (${member.id ?? "no id"})`;
-      output += `${mark.structure(indent + (isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 "))}${mark.layer("project", label2)}${form}
+      const approval = approvalTag(options.approvals?.find((a) => a.key === member.namespace));
+      output += `${mark.structure(indent + (isLast ? "\u2514\u2500\u2500 " : "\u251C\u2500\u2500 "))}${mark.layer("project", label2)}${form}${approval}
 `;
       renderProject(member.namespace, indent + (isLast ? "    " : "\u2502   "));
     });
   };
   renderProject("", "");
+  for (const absent of (options.approvals ?? []).filter((a) => a.key !== "" && !family.nodes.some((n) => n.namespace === a.key))) {
+    output += `${mark.structure("    ")}${mark.missing(`[Project] ${absent.alias ?? absent.key} (no project on disk)`)}${approvalTag(absent)}
+`;
+  }
+  const own = options.approvals?.find((a) => a.key === "");
+  const hasMembers = (options.approvals ?? []).some((a) => a.key !== "");
+  if (own && (own.state !== "never" || hasMembers)) output += `${mark.layer("system", "Approval:")} this project is ${own.state}${own.upgraded ? " (locked under the pre-stage-5 gate identity \u2014 re-lock once)" : ""}
+`;
   return { text: output, failed: false };
 }
 
@@ -32787,7 +33074,7 @@ function readResource(resourceId) {
 var import_mcp = require("@modelcontextprotocol/sdk/server/mcp.js");
 var import_stdio = require("@modelcontextprotocol/sdk/server/stdio.js");
 var import_zod11 = require("zod");
-var import_types4 = require("@modelcontextprotocol/sdk/types.js");
+var import_types5 = require("@modelcontextprotocol/sdk/types.js");
 var path37 = __toESM(require("path"));
 var crypto5 = __toESM(require("crypto"));
 
@@ -33854,7 +34141,7 @@ function renderAgentBriefMarkdown(brief) {
 }
 function registerSkillResources(server, listChanged) {
   server.server.registerCapabilities({ resources: listChanged ? { listChanged: true } : {} });
-  server.server.setRequestHandler(import_types4.ListResourcesRequestSchema, () => ({
+  server.server.setRequestHandler(import_types5.ListResourcesRequestSchema, () => ({
     resources: [
       ...listResources().map((d) => ({
         uri: d.resourceUri,
@@ -33865,14 +34152,14 @@ function registerSkillResources(server, listChanged) {
       ...listAgentBriefResources()
     ]
   }));
-  server.server.setRequestHandler(import_types4.ReadResourceRequestSchema, (request) => {
+  server.server.setRequestHandler(import_types5.ReadResourceRequestSchema, (request) => {
     const uri = request.params.uri;
     if (uri.startsWith(AGENT_BRIEF_SCHEME)) {
       try {
         const brief = composeAgentBrief(uri.slice(AGENT_BRIEF_SCHEME.length));
         return { contents: [{ uri, mimeType: SKILL_RESOURCE_MIME, text: renderAgentBriefMarkdown(brief) }] };
       } catch (e) {
-        throw new import_types4.McpError(import_types4.ErrorCode.InvalidParams, e instanceof Error ? e.message : String(e));
+        throw new import_types5.McpError(import_types5.ErrorCode.InvalidParams, e instanceof Error ? e.message : String(e));
       }
     }
     try {
@@ -33880,20 +34167,20 @@ function registerSkillResources(server, listChanged) {
       return { contents: [{ uri, mimeType: SKILL_RESOURCE_MIME, text: content }] };
     } catch (e) {
       const message = e instanceof Error ? e.message : String(e);
-      throw new import_types4.McpError(import_types4.ErrorCode.InvalidParams, message);
+      throw new import_types5.McpError(import_types5.ErrorCode.InvalidParams, message);
     }
   });
 }
 function registerSkillPrompts(server, listChanged) {
   server.server.registerCapabilities({ prompts: listChanged ? { listChanged: true } : {} });
-  server.server.setRequestHandler(import_types4.ListPromptsRequestSchema, () => ({
+  server.server.setRequestHandler(import_types5.ListPromptsRequestSchema, () => ({
     prompts: listResources().map((d) => ({
       name: d.id,
       title: d.name,
       description: d.description
     }))
   }));
-  server.server.setRequestHandler(import_types4.GetPromptRequestSchema, (request) => {
+  server.server.setRequestHandler(import_types5.GetPromptRequestSchema, (request) => {
     const name = request.params.name;
     try {
       const content = readResource(name);
@@ -33902,7 +34189,7 @@ function registerSkillPrompts(server, listChanged) {
         messages: [{ role: "user", content: { type: "text", text: content } }]
       };
     } catch (e) {
-      throw new import_types4.McpError(import_types4.ErrorCode.InvalidParams, e instanceof Error ? e.message : String(e));
+      throw new import_types5.McpError(import_types5.ErrorCode.InvalidParams, e instanceof Error ? e.message : String(e));
     }
   });
 }
@@ -34910,12 +35197,19 @@ ${testsBlock}` : ""}`, deletion);
     },
     ({ subsystem, recursive }) => {
       try {
+        let approvals;
+        try {
+          approvals = familyApprovals(recursive === false ? 0 : void 0);
+        } catch {
+          approvals = void 0;
+        }
         const report = getStatusReport({
           subsystem,
-          recursive: recursive ?? true
+          recursive: recursive ?? true,
+          approvals
         });
         const family = statusFamilyContext();
-        const verdict = approvalVerdict();
+        const verdict = approvalVerdict(approvals);
         return text2(`${family}${report.text}${verdict.text}`);
       } catch (e) {
         return errText(String(e));
@@ -35253,6 +35547,7 @@ function loadProjectConfig3() {
   complexityLevel,
   composeAgentBrief,
   composeRuleSequence,
+  computeOwnStateId,
   computeStateId,
   computeStateIdAt,
   conceptNoun,
@@ -35263,7 +35558,6 @@ function loadProjectConfig3() {
   createEmptyTopologyConfig,
   createMember,
   createProjectConfig,
-  currentChildPins,
   currentRootBinding,
   declareExternal,
   declaredExternals,
@@ -35343,6 +35637,7 @@ function loadProjectConfig3() {
   isProjectInitialized,
   isProvidedBy,
   isRetired,
+  judgesCode,
   keyIn,
   landReference,
   listDirectChainedSubprojects,
@@ -35385,7 +35680,6 @@ function loadProjectConfig3() {
   moveMember,
   moveMethods,
   moveMountToMembers,
-  movedChildren,
   nameKey,
   narrativeStepForeignFields,
   normalizeReferences,