@wairon/cli 5.1.1-dev.96 → 5.1.1-dev.97

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.96";
+    WAIRON_VERSION = "5.1.1-dev.97";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     SUPPORTED_ALIASES = ["wai"];
     SCAN_EXCLUDE_DIRS = /* @__PURE__ */ new Set([
@@ -3737,11 +3737,16 @@ var init_specs = __esm({
        */
       guarantees: import_zod8.z.array(GuaranteeSchema).optional(),
       /**
-       * State-effect direction of this method on its component's held state. Required on a
-       * durable Store's contract methods so the durability round-trip rule can pair external
-       * writes with hydration read-backs (MISSING_HYDRATION); optional elsewhere.
+       * What this method does to its component's held state: `read` observes it, `write`
+       * modifies an entity's domain fields, and `lifecycle` creates, destroys, or
+       * (un)registers an entity's existence or membership without modifying its fields —
+       * closed under composition (a lifecycle method calls only read and lifecycle methods,
+       * LIFECYCLE_CALLS_WRITE). Required on a durable Store's contract methods so the
+       * durability round-trip rule can pair mutations with hydration read-backs
+       * (MISSING_HYDRATION); a Supervisor may call a data component it does not own only
+       * through read and lifecycle methods (SUPERVISOR_WRITE_SHORTCUT). Optional elsewhere.
        */
-      effect: import_zod8.z.enum(["read", "write"]).optional(),
+      effect: import_zod8.z.enum(["read", "write", "lifecycle"]).optional(),
       /**
        * Typed acknowledgment of a real caller OUTSIDE the modeled narrative graph
        * (runtime timer/hook, external system, sibling subsystem). Unused-detection
@@ -11930,7 +11935,7 @@ function fromOpenApi(document, projectName) {
       const rawGuarantees = op["x-wairon-guarantees"];
       const guarantees = Array.isArray(rawGuarantees) ? rawGuarantees.filter((g) => typeof g === "string" && g.length > 0) : [];
       const rawEffect = op["x-wairon-effect"];
-      const effect = rawEffect === "read" || rawEffect === "write" ? rawEffect : void 0;
+      const effect = rawEffect === "read" || rawEffect === "write" || rawEffect === "lifecycle" ? rawEffect : void 0;
       const rawExt = op["x-wairon-ext"];
       const ext = rawExt && typeof rawExt === "object" && !Array.isArray(rawExt) ? rawExt : void 0;
       methods.push({
@@ -14412,7 +14417,7 @@ function buildImportGraph(index, universe) {
 function buildOwnershipIndex(ctx) {
   const ownedBy2 = /* @__PURE__ */ new Map();
   for (const comp of ctx.components) {
-    if (isRetired(comp) || !isPattern(comp)) continue;
+    if (isRetired(comp) || !(isPattern(comp) || comp.componentType === "Supervisor")) continue;
     for (const memberId of comp.owns) {
       const member = ctx.componentMap.get(memberId);
       if (!member || isPattern(member)) continue;
@@ -15874,10 +15879,10 @@ var init_lint_allows = __esm({
     lintAllowsRule = {
       name: "lint-allows",
       judges: "design",
-      description: "Per-spec lint suppressions (lint.allow) must name real issue codes and actually suppress a finding \u2014 unknown codes and stale allows are flagged. An allow covers exactly the occurrence it names: a finding that reports a site is silenced only by an allow whose `at` is that site, a finding that reports none only by an allow that names none, and an aggregating finding only by an allow whose `covers` lists every unit it reports \u2014 a unit nobody listed is named back as new instead of inheriting a decision taken about its neighbours. So a coarse allow left on a rule that names sites, and an allow whose site the run no longer reports, are both UNUSED_LINT_ALLOW, and the finding names the sites that did fire. Allows silence warnings and notices; errors always surface.",
+      description: "Per-spec lint suppressions (lint.allow) must name real issue codes and actually suppress a finding \u2014 unknown codes and stale allows are flagged. An allow covers exactly the occurrence it names: a finding that reports a site is silenced only by an allow whose `at` is that site, a finding that reports none only by an allow that names none, and an aggregating finding only by an allow whose `covers` lists every unit it reports \u2014 a unit nobody listed is named back as new instead of inheriting a decision taken about its neighbours. So a coarse allow left on a rule that names sites, and an allow whose site the run no longer reports, are both UNUSED_LINT_ALLOW, and the finding names the sites that did fire. Allows silence warnings and notices; errors always surface \u2014 so an allow naming a code that is an error on its spec (it fired there as one, or its resolved severity is error) covers nothing, and the finding says plainly that an error cannot be allowed rather than that the code never fired.",
       codes: [
         { code: "UNKNOWN_LINT_ALLOW_CODE", defaultSeverity: "warning", summary: "lint.allow names an issue code no registered rule emits" },
-        { code: "UNUSED_LINT_ALLOW", defaultSeverity: "warning", summary: "lint.allow entry matched no finding this run \u2014 the code never fired, or it fired at sites this allow does not name" }
+        { code: "UNUSED_LINT_ALLOW", defaultSeverity: "warning", summary: "lint.allow entry covers nothing this run \u2014 the code never fired, it fired at sites this allow does not name, or it is an error, which no allow can cover" }
       ],
       check(ctx) {
         for (const a of ctx.lintAllows) {
@@ -15890,9 +15895,20 @@ var init_lint_allows = __esm({
             );
             continue;
           }
-          if (a.used) continue;
           const reported = ctx.sitesReported(a.specId, a.code);
           const at = a.at ? ` at "${a.at}"` : "";
+          const fired = reported.unsited || reported.sites.length > 0;
+          const isError = reported.errored || !fired && ctx.severityOf(a.code, a.specId) === "error";
+          if (isError) {
+            ctx.addIssue(
+              "warning",
+              "UNUSED_LINT_ALLOW",
+              `Spec "${a.specId}" allows "${a.code}"${at} (reason: ${a.reason}), but "${a.code}" is an error${fired ? " and fired here as one" : ""}, and an error cannot be allowed \u2014 lint.allow silences warnings and notices only. Fix what the finding names, or remove the allow (a project may re-tune the code's severity in rules.sddRuleSeverity).`,
+              a.specId
+            );
+            continue;
+          }
+          if (a.used) continue;
           let why;
           if (a.at && reported.unsited && reported.sites.length === 0) {
             why = `findings of "${a.code}" on this spec name no site at all, so this allow must not name one \u2014 drop the \`at\``;
@@ -17589,23 +17605,53 @@ var init_data_block_dependencies = __esm({
 });
 
 // src/core/rules/doctrine/entrypoint-dependencies.ts
+function maintainedRegistries(ctx) {
+  const maintained = /* @__PURE__ */ new Map();
+  const add2 = (supervisorId, registryId) => {
+    let set = maintained.get(supervisorId);
+    if (!set) maintained.set(supervisorId, set = /* @__PURE__ */ new Set());
+    set.add(registryId);
+  };
+  for (const comp of ctx.components) {
+    if (comp.componentType !== "Supervisor" || isRetired(comp)) continue;
+    for (const memberId of comp.owns) {
+      if (ctx.componentMap.get(memberId)?.componentType === "Registry") add2(comp.id, memberId);
+    }
+  }
+  for (const impl of ctx.implementations) {
+    const contract = ctx.interfaceMap.get(impl.contract);
+    const supervisor = contract ? ctx.componentMap.get(contract.component) : void 0;
+    if (!supervisor || supervisor.componentType !== "Supervisor" || isRetired(supervisor)) continue;
+    for (const implMethod of impl.methods) {
+      for (const step of implMethod.narrative) {
+        if (step.type !== "call" || !step.targetComponent || !step.targetMethod) continue;
+        if (ctx.componentMap.get(step.targetComponent)?.componentType !== "Registry") continue;
+        const called = ctx.interfaceMethodsOf(step.targetComponent).find((m) => m.name === step.targetMethod);
+        if (called?.effect === "lifecycle") add2(supervisor.id, step.targetComponent);
+      }
+    }
+  }
+  return new Map([...maintained].map(([id, set]) => [id, [...set]]));
+}
 var entrypointDepsRule;
 var init_entrypoint_dependencies = __esm({
   "src/core/rules/doctrine/entrypoint-dependencies.ts"() {
     "use strict";
+    init_models();
     init_stereotype_terms();
     entrypointDepsRule = {
       name: "entrypoint-dependencies",
       judges: "design",
-      description: "Judges the edges at the system's entry points and its process layer. Portals and Observers are top-level entry points and subscribers, so nothing may depend on them \u2014 and that is the edge's one finding, which is why no other matrix rule judges it. Downward, a Portal dispatches to Orchestrators and may READ through Indexes and Repository facades but never reaches Store/Registry/Query or an Adapter, while an Observer forwards to one Orchestrator or Supervisor over a message-bus Adapter. A View stays a passive presenter. A Supervisor reaches data only through workflows, and a component depending on a live Actor must also depend on a Supervisor that supervises it.",
+      description: "Judges the edges at the system's entry points and its process layer. Portals and Observers are top-level entry points and subscribers, so nothing may depend on them \u2014 and that is the edge's one finding, which is why no other matrix rule judges it. Downward, a Portal dispatches to Orchestrators and may READ through Indexes and Repository facades but never reaches Store/Registry/Query or an Adapter, while an Observer forwards to one Orchestrator or Supervisor over a message-bus Adapter. A View stays a passive presenter. A Supervisor stays out of presentation; what it may do to the data it reaches is judged per call (supervisor-shared-data), and what it owns as its supervision state by the ownership rules. A component depending on a live Actor reaches it through the Actor's supervision: by depending on a Supervisor that supervises it, or on a Registry such a Supervisor maintains (owns, or calls with lifecycle-effect methods) \u2014 the lookup hop callers really take.",
       codes: [
         { code: "ARCHITECTURE_VIOLATION_PORTAL_DEP", defaultSeverity: "error", summary: "Component depending on a Portal/Observer" },
         { code: "ARCHITECTURE_VIOLATION_PORTAL_FORBIDDEN_DEP", defaultSeverity: "error", summary: "Portal/Observer reaching the data layer directly" },
         { code: "ARCHITECTURE_VIOLATION_VIEW_DEP", defaultSeverity: "error", summary: "View depending on persistence layers or on logic that is not pure" },
-        { code: "ARCHITECTURE_VIOLATION_SUPERVISOR_DEP", defaultSeverity: "error", summary: "Supervisor depending on anything but Actors, Orchestrators, Adapters or other Supervisors \u2014 it reaches data only through workflows" },
-        { code: "ACTOR_REACHED_WITHOUT_SUPERVISOR", defaultSeverity: "error", summary: "Component depending on a live Actor it does not supervise, without also depending on a Supervisor that supervises it \u2014 a live Actor is reached by id through its Supervisor" }
+        { code: "ARCHITECTURE_VIOLATION_SUPERVISOR_DEP", defaultSeverity: "error", summary: "Supervisor depending on a presentation block (View, FeatureComponent, RouterComponent) \u2014 a Supervisor manages live processes; the data it reaches is judged per call by supervisor-shared-data" },
+        { code: "ACTOR_REACHED_WITHOUT_SUPERVISOR", defaultSeverity: "error", summary: "Component depending on a live Actor it does not supervise, reaching it neither through a Supervisor that supervises it nor through a Registry such a Supervisor maintains \u2014 model the real lookup hop" }
       ],
       check(ctx) {
+        const lookups = maintainedRegistries(ctx);
         for (const edge of ctx.dependencyEdges().matrix) {
           const comp = edge.from;
           const depComp = edge.to;
@@ -17641,27 +17687,32 @@ var init_entrypoint_dependencies = __esm({
               edge.draftContext
             );
           }
-          if (comp.componentType === "Supervisor" && ["Store", "Registry", "Repository", "Index", "Query", "View", "FeatureComponent", "RouterComponent"].includes(depComp.componentType)) {
+          if (comp.componentType === "Supervisor" && ["View", "FeatureComponent", "RouterComponent"].includes(depComp.componentType)) {
             ctx.addIssue(
               "error",
               "ARCHITECTURE_VIOLATION_SUPERVISOR_DEP",
-              `Architectural violation: Supervisor "${comp.id}" cannot depend on ${stereotypeOf(depComp)} "${depComp.id}". A Supervisor reaches data only through workflows \u2014 depend on the Orchestrator, Actor or Adapter that does that work instead.` + storeHint,
+              `Architectural violation: Supervisor "${comp.id}" cannot depend on ${stereotypeOf(depComp)} "${depComp.id}". A Supervisor manages live processes and stays out of presentation \u2014 the UI reaches the system through its Portals and workflows, never through a Supervisor's dependencies.`,
               comp.id,
               edge.draftContext
             );
           }
           if (depComp.componentType === "Actor" && comp.componentType !== "Supervisor") {
-            const reachedThroughSupervisor = comp.dependsOn.some((id) => {
-              const supervisor = ctx.componentMap.get(id);
-              return supervisor?.componentType === "Supervisor" && supervisor.dependsOn.includes(depComp.id);
-            });
-            if (!reachedThroughSupervisor) {
-              const supervisors = ctx.components.filter((c) => c.componentType === "Supervisor" && c.dependsOn.includes(depComp.id)).map((c) => `"${c.id}"`);
-              const remedy = supervisors.length > 0 ? `also depend on ${supervisors.length === 1 ? "its Supervisor" : "one of its Supervisors"} (${supervisors.join(", ")})` : `no Supervisor depends on "${depComp.id}" yet, so give the Actor a Supervisor that depends on it and depend on that Supervisor`;
+            const supervisors = ctx.components.filter((c) => c.componentType === "Supervisor" && c.dependsOn.includes(depComp.id));
+            const registries = supervisors.flatMap((s) => (lookups.get(s.id) ?? []).map((registry) => ({ registry, supervisor: s.id })));
+            const reached = supervisors.some((s) => comp.dependsOn.includes(s.id)) || registries.some((r) => comp.dependsOn.includes(r.registry));
+            if (!reached) {
+              let remedy;
+              if (registries.length > 0) {
+                remedy = `depend on ${registries.length === 1 ? "the Registry" : "one of the Registries"} its Supervisor maintains (${registries.map((r) => `"${r.registry}", kept by "${r.supervisor}"`).join("; ")}) and look the Actor up by id there`;
+              } else if (supervisors.length > 0) {
+                remedy = `${supervisors.length === 1 ? "its Supervisor" : "its Supervisors"} (${supervisors.map((s) => `"${s.id}"`).join(", ")}) maintain no Registry of its live handles yet: model that lookup as a Registry the Supervisor keeps through lifecycle-effect methods (registering and unregistering a live handle), and depend on that Registry`;
+              } else {
+                remedy = `no Supervisor depends on "${depComp.id}" yet: give it a Supervisor that depends on it and maintains a Registry of its live handles through lifecycle-effect methods, and depend on that Registry`;
+              }
               ctx.addIssue(
                 "error",
                 "ACTOR_REACHED_WITHOUT_SUPERVISOR",
-                `Architectural violation: ${stereotypeOf(comp)} "${comp.id}" depends on the live Actor "${depComp.id}" without a Supervisor that supervises it. A live Actor is reached by id through a Supervisor that supervises it \u2014 ${remedy}.`,
+                `Architectural violation: ${stereotypeOf(comp)} "${comp.id}" depends on the live Actor "${depComp.id}" without reaching it through its supervision. A live Actor is found by id through a Registry its Supervisor maintains, or messaged through that Supervisor \u2014 ${remedy}.`,
                 comp.id,
                 edge.draftContext
               );
@@ -17681,9 +17732,9 @@ var init_portal_write_shortcut = __esm({
     portalWriteShortcutRule = {
       name: "portal-write-shortcut",
       judges: "design",
-      description: "A Portal narrative call step or dispatch-table binding that reaches a write-effect method on a Repository or Index directly is the write shortcut: the Portal\u2192data-facade edge is licensed for reads only, and a write routes through an Orchestrator that owns the workflow. A dispatch step reaches its server only through a table binding, so judging every binding judges each dispatch step that takes it, once, where the route is declared. Methods that carry no effect tag are not judged.",
+      description: "A Portal narrative call step or dispatch-table binding that reaches a write- or lifecycle-effect method on a Repository or Index directly is the write shortcut: the Portal\u2192data-facade edge is licensed for reads only, and a mutation \u2014 a write, or a lifecycle change to what exists \u2014 routes through an Orchestrator that owns the workflow. A dispatch step reaches its server only through a table binding, so judging every binding judges each dispatch step that takes it, once, where the route is declared. Methods that carry no effect tag are not judged.",
       codes: [
-        { code: "PORTAL_WRITE_SHORTCUT", defaultSeverity: "error", summary: "Portal narrative call or dispatch-table binding reaches a write-effect method on a Repository/Index directly \u2014 reads may shortcut, writes route through an Orchestrator (judged on effect-tagged facade methods; untagged methods are not yet judged)" }
+        { code: "PORTAL_WRITE_SHORTCUT", defaultSeverity: "error", summary: "Portal narrative call or dispatch-table binding reaches a write- or lifecycle-effect method on a Repository/Index directly \u2014 reads may shortcut, mutations route through an Orchestrator (judged on effect-tagged facade methods; untagged methods are not yet judged)" }
       ],
       check(ctx) {
         for (const impl of ctx.implementations) {
@@ -17697,11 +17748,11 @@ var init_portal_write_shortcut = __esm({
               const target = ctx.componentMap.get(step.targetComponent);
               if (!target || target.componentType !== "Repository" && target.componentType !== "Index") continue;
               const targetMethod = ctx.interfaceMethodsOf(target.id).find((m) => m.name === step.targetMethod);
-              if (targetMethod?.effect !== "write") continue;
+              if (targetMethod?.effect !== "write" && targetMethod?.effect !== "lifecycle") continue;
               ctx.addIssue(
                 "error",
                 "PORTAL_WRITE_SHORTCUT",
-                `Portal "${component.id}": step ${step.stepNumber} of "${implMethod.name}" calls write-effect method ${target.id}.${step.targetMethod} directly. The Portal\u2192${target.componentType} shortcut is licensed for READS only \u2014 route the write through an Orchestrator that owns the workflow.`,
+                `Portal "${component.id}": step ${step.stepNumber} of "${implMethod.name}" calls ${targetMethod.effect}-effect method ${target.id}.${step.targetMethod} directly. The Portal\u2192${target.componentType} shortcut is licensed for READS only \u2014 route the ${targetMethod.effect === "write" ? "write" : "lifecycle change"} through an Orchestrator that owns the workflow.`,
                 impl.id,
                 isDraftCtx || ctx.isComponentDraft(target.id)
               );
@@ -17715,11 +17766,11 @@ var init_portal_write_shortcut = __esm({
             const target = ctx.componentMap.get(binding.component);
             if (!target || target.componentType !== "Repository" && target.componentType !== "Index") continue;
             const targetMethod = ctx.interfaceMethodsOf(target.id).find((m) => m.name === binding.method);
-            if (targetMethod?.effect !== "write") continue;
+            if (targetMethod?.effect !== "write" && targetMethod?.effect !== "lifecycle") continue;
             ctx.addIssue(
               "error",
               "PORTAL_WRITE_SHORTCUT",
-              `Portal "${comp.id}": dispatch binding "${binding.capability}" routes to write-effect method ${target.id}.${binding.method} directly. The Portal\u2192${target.componentType} shortcut is licensed for READS only \u2014 route the write through an Orchestrator that owns the workflow.`,
+              `Portal "${comp.id}": dispatch binding "${binding.capability}" routes to ${targetMethod.effect}-effect method ${target.id}.${binding.method} directly. The Portal\u2192${target.componentType} shortcut is licensed for READS only \u2014 route the ${targetMethod.effect === "write" ? "write" : "lifecycle change"} through an Orchestrator that owns the workflow.`,
               comp.id,
               isDraftCtx || ctx.isComponentDraft(target.id)
             );
@@ -17730,6 +17781,91 @@ var init_portal_write_shortcut = __esm({
   }
 });
 
+// src/core/rules/doctrine/supervisor-shared-data.ts
+var DATA_COMPONENTS, supervisorSharedDataRule;
+var init_supervisor_shared_data = __esm({
+  "src/core/rules/doctrine/supervisor-shared-data.ts"() {
+    "use strict";
+    init_models();
+    DATA_COMPONENTS = /* @__PURE__ */ new Set(["Store", "Registry", "Repository", "Index", "Query"]);
+    supervisorSharedDataRule = {
+      name: "supervisor-shared-data",
+      judges: "design",
+      description: "A Supervisor keeps its own supervision state (the Stores and Registries it owns) with full read and write, but data it does not own is shared: a Supervisor narrative call step that reaches a method of a Store, Registry, Repository, Index or Query the Supervisor does not own is legal only when that method declares effect read or lifecycle. A write \u2014 or a method that declares no effect \u2014 goes through a workflow: the Supervisor depends on the Orchestrator that does it. A read on behalf of a request still passes; in practice the paired write is what forces the workflow out, and the read moves with it.",
+      codes: [
+        { code: "SUPERVISOR_WRITE_SHORTCUT", defaultSeverity: "error", summary: "Supervisor narrative call reaches a method of a data component it does not own whose declared effect is neither read nor lifecycle \u2014 writes to shared data route through an Orchestrator" }
+      ],
+      check(ctx) {
+        const ownership = ctx.ownershipIndex();
+        for (const impl of ctx.implementations) {
+          const contract = ctx.interfaceMap.get(impl.contract);
+          const supervisor = contract ? ctx.componentMap.get(contract.component) : void 0;
+          if (!supervisor || supervisor.componentType !== "Supervisor" || isRetired(supervisor)) continue;
+          const isDraftCtx = ctx.isImplementationDraft(impl);
+          for (const implMethod of impl.methods) {
+            for (const step of implMethod.narrative) {
+              if (step.type !== "call" || !step.targetComponent || !step.targetMethod) continue;
+              const target = ctx.componentMap.get(step.targetComponent);
+              if (!target || !DATA_COMPONENTS.has(target.componentType)) continue;
+              if (ownership.ownerOf(target.id) === supervisor.id) continue;
+              const called = ctx.interfaceMethodsOf(target.id).find((m) => m.name === step.targetMethod);
+              if (!called || called.effect === "read" || called.effect === "lifecycle") continue;
+              const what = called.effect === "write" ? "a write-effect method" : "a method that declares no effect";
+              const untaggedHint = called.effect === "write" ? "" : ` If ${target.id}.${called.name} only reads, or only changes what exists, declare its effect (read or lifecycle).`;
+              ctx.addIssue(
+                "error",
+                "SUPERVISOR_WRITE_SHORTCUT",
+                `Supervisor "${supervisor.id}": step ${step.stepNumber} of "${implMethod.name}" calls ${target.id}.${called.name}, ${what} on ${target.componentType} "${target.id}", which the Supervisor does not own. A Supervisor reads shared data and changes what exists in it (read and lifecycle effects); a write to its fields goes through a workflow \u2014 depend on the Orchestrator that does it and call that instead.${untaggedHint}`,
+                impl.id,
+                isDraftCtx || ctx.isComponentDraft(target.id)
+              );
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/core/rules/doctrine/lifecycle-effect-closure.ts
+var lifecycleEffectClosureRule;
+var init_lifecycle_effect_closure = __esm({
+  "src/core/rules/doctrine/lifecycle-effect-closure.ts"() {
+    "use strict";
+    lifecycleEffectClosureRule = {
+      name: "lifecycle-effect-closure",
+      judges: "design",
+      description: "A lifecycle-effect method may create, destroy, or (un)register an entity's existence or membership, never modify its domain fields \u2014 and the effect is closed under composition: its narrative may call only read- and lifecycle-effect methods besides its construction and local steps. A call step to a write-effect method from a lifecycle-effect method is a declaration error: the method is a write, or the write belongs to a workflow beside it. Called methods that declare no effect are not judged.",
+      codes: [
+        { code: "LIFECYCLE_CALLS_WRITE", defaultSeverity: "error", summary: "Lifecycle-effect method whose narrative calls a write-effect method \u2014 the lifecycle effect is closed under composition" }
+      ],
+      check(ctx) {
+        for (const impl of ctx.implementations) {
+          const contract = ctx.interfaceMap.get(impl.contract);
+          if (!contract) continue;
+          const declared = ctx.interfaceMethodsOf(contract.component);
+          const isDraftCtx = ctx.isImplementationDraft(impl);
+          for (const implMethod of impl.methods) {
+            if (declared.find((m) => m.name === implMethod.name)?.effect !== "lifecycle") continue;
+            for (const step of implMethod.narrative) {
+              if (step.type !== "call" || !step.targetComponent || !step.targetMethod) continue;
+              const called = ctx.interfaceMethodsOf(step.targetComponent).find((m) => m.name === step.targetMethod);
+              if (called?.effect !== "write") continue;
+              ctx.addIssue(
+                "error",
+                "LIFECYCLE_CALLS_WRITE",
+                `"${contract.component}.${implMethod.name}" declares effect lifecycle, but step ${step.stepNumber} calls write-effect method ${step.targetComponent}.${step.targetMethod}. A lifecycle method creates, destroys or (un)registers what exists and never modifies domain fields, and the effect is closed under composition \u2014 it may call only read and lifecycle methods. Declare the method a write, or move the write to a workflow beside it.`,
+                impl.id,
+                isDraftCtx
+              );
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
 // src/core/rules/doctrine/pattern-membership.ts
 var patternMembershipRule;
 var init_pattern_membership = __esm({
@@ -17739,24 +17875,25 @@ var init_pattern_membership = __esm({
     patternMembershipRule = {
       name: "pattern-membership",
       judges: "design",
-      description: "Only patterns (Repository/FeatureComponent/RouterComponent) own member blocks, and every pattern owns at least one. Each claim must name a component that exists and is itself a building block \u2014 patterns compose at the subsystem (L1) level, never by owning one another \u2014 and a block has exactly one owner, the first pattern to claim it.",
+      description: "Only patterns (Repository/FeatureComponent/RouterComponent) own member blocks, and every pattern owns at least one. The one building block that may own is a Supervisor, which owns its supervision state and may own nothing at all; what it may own is pattern-containment's question. Each claim must name a component that exists and is itself a building block \u2014 patterns compose at the subsystem (L1) level, never by owning one another \u2014 and a block has exactly one owner, the first pattern or Supervisor to claim it.",
       codes: [
         { code: "EMPTY_PATTERN", defaultSeverity: "error", summary: "Pattern with no owned member blocks" },
-        { code: "BLOCK_OWNS_MEMBERS", defaultSeverity: "error", summary: "Building block using owns" },
+        { code: "BLOCK_OWNS_MEMBERS", defaultSeverity: "error", summary: "Building block other than a Supervisor using owns" },
         { code: "INVALID_OWNED_MEMBER", defaultSeverity: "error", summary: "owns names a non-existent component" },
         { code: "PATTERN_OWNS_PATTERN", defaultSeverity: "error", summary: "Pattern owning another pattern" },
-        { code: "SHARED_OWNED_MEMBER", defaultSeverity: "error", summary: "Block owned by two patterns" }
+        { code: "SHARED_OWNED_MEMBER", defaultSeverity: "error", summary: "Block owned by two owners (patterns or Supervisors)" }
       ],
       check(ctx) {
         for (const comp of ctx.components) {
           if (isRetired(comp)) continue;
           const isDraftCtx = ctx.isComponentDraft(comp.id);
           const pattern = isPattern(comp);
+          const supervisor = comp.componentType === "Supervisor";
           if (pattern && comp.owns.length === 0) {
             ctx.addIssue("error", "EMPTY_PATTERN", `Pattern "${comp.id}" (${comp.componentType}) must own member blocks via "owns".`, comp.id, isDraftCtx);
           }
-          if (!pattern && comp.owns.length > 0) {
-            ctx.addIssue("error", "BLOCK_OWNS_MEMBERS", `Building block "${comp.id}" (${comp.componentType}) cannot own members; only patterns (${Array.from(PATTERN_TYPES).join("/")}) use "owns".`, comp.id, isDraftCtx);
+          if (!pattern && !supervisor && comp.owns.length > 0) {
+            ctx.addIssue("error", "BLOCK_OWNS_MEMBERS", `Building block "${comp.id}" (${comp.componentType}) cannot own members; only patterns (${Array.from(PATTERN_TYPES).join("/")}) use "owns", and a Supervisor for its supervision state.`, comp.id, isDraftCtx);
           }
         }
         const ownership = ctx.ownershipIndex();
@@ -17764,15 +17901,18 @@ var init_pattern_membership = __esm({
           if (isRetired(comp)) continue;
           const isDraftCtx = ctx.isComponentDraft(comp.id);
           const pattern = isPattern(comp);
+          const supervisor = comp.componentType === "Supervisor";
           for (const memberId of comp.owns) {
             const member = ctx.componentMap.get(memberId);
             if (!member) {
               ctx.addIssue("error", "INVALID_OWNED_MEMBER", `Component "${comp.id}" owns "${memberId}" which does not exist.`, comp.id, isDraftCtx);
               continue;
             }
-            if (!pattern) continue;
+            if (!pattern && !supervisor) continue;
             if (isPattern(member)) {
-              ctx.addIssue("error", "PATTERN_OWNS_PATTERN", `Pattern "${comp.id}" owns "${memberId}", which is itself a pattern. Patterns own only building blocks \u2014 compose patterns at the subsystem (L1) level.`, comp.id, isDraftCtx);
+              if (pattern) {
+                ctx.addIssue("error", "PATTERN_OWNS_PATTERN", `Pattern "${comp.id}" owns "${memberId}", which is itself a pattern. Patterns own only building blocks \u2014 compose patterns at the subsystem (L1) level.`, comp.id, isDraftCtx);
+              }
               continue;
             }
             const firstOwner = ownership.ownerOf(memberId);
@@ -17787,19 +17927,21 @@ var init_pattern_membership = __esm({
 });
 
 // src/core/rules/doctrine/pattern-containment.ts
-var REPOSITORY_MEMBERS, patternContainmentRule;
+var REPOSITORY_MEMBERS, SUPERVISION_STATE, patternContainmentRule;
 var init_pattern_containment = __esm({
   "src/core/rules/doctrine/pattern-containment.ts"() {
     "use strict";
     init_models();
     REPOSITORY_MEMBERS = /* @__PURE__ */ new Set(["Store", "Registry", "Index", "Query", "Adapter"]);
+    SUPERVISION_STATE = /* @__PURE__ */ new Set(["Store", "Registry"]);
     patternContainmentRule = {
       name: "pattern-containment",
       judges: "design",
-      description: "Holds each pattern to the containment its definition prescribes. A Repository may own only Store, Registry, Index, Query and (optionally) Adapter, judged member by member. A FeatureComponent owns exactly one Orchestrator (the logic side) and one or more Views (its faces \u2014 list, detail, form \u2014 sharing the one logic component), and nothing else. A RouterComponent owns exactly one Portal as its facade and at least one other child to route to. A counting pattern that still owns a retired member is not judged until that member is migrated: its counts change with the migration, and STEREOTYPE_RETIRED is the one finding.",
+      description: "Holds each owner to the containment its definition prescribes. A Repository may own only Store, Registry, Index, Query and (optionally) Adapter, judged member by member. A Supervisor may own only its supervision state \u2014 Stores and Registries that are its own, one hop \u2014 judged member by member too. A FeatureComponent owns exactly one Orchestrator (the logic side) and one or more Views (its faces \u2014 list, detail, form \u2014 sharing the one logic component), and nothing else. A RouterComponent owns exactly one Portal as its facade and at least one other child to route to. A counting pattern that still owns a retired member is not judged until that member is migrated: its counts change with the migration, and STEREOTYPE_RETIRED is the one finding.",
       codes: [
         { code: "REPOSITORY_CONTAINMENT", defaultSeverity: "error", summary: "Repository owning a non Store/Registry/Index/Query/Adapter member" },
         { code: "FEATURE_COMPONENT_CONTAINMENT", defaultSeverity: "error", summary: "FeatureComponent not owning exactly one Orchestrator + one or more Views" },
+        { code: "SUPERVISOR_CONTAINMENT", defaultSeverity: "error", summary: "Supervisor owning anything but a Store or Registry \u2014 a Supervisor owns only its supervision state" },
         { code: "ROUTER_COMPONENT_CONTAINMENT", defaultSeverity: "error", summary: "RouterComponent not owning exactly one Portal facade, or owning no children to route to" }
       ],
       check(ctx) {
@@ -17850,6 +17992,15 @@ var init_pattern_containment = __esm({
             }
           }
         }
+        for (const comp of ctx.components) {
+          if (comp.componentType !== "Supervisor" || isRetired(comp)) continue;
+          const isDraftCtx = ctx.isComponentDraft(comp.id);
+          for (const memberId of comp.owns) {
+            const member = ctx.componentMap.get(memberId);
+            if (!member || isRetired(member) || SUPERVISION_STATE.has(member.componentType)) continue;
+            ctx.addIssue("error", "SUPERVISOR_CONTAINMENT", `Supervisor "${comp.id}" owns "${memberId}" of type ${member.componentType}; a Supervisor owns only its supervision state \u2014 Stores and Registries that are its own. Depend on "${memberId}" as a collaborator instead.`, comp.id, isDraftCtx);
+          }
+        }
       }
     };
   }
@@ -17863,7 +18014,7 @@ var init_unowned_blocks = __esm({
     unownedBlocksRule = {
       name: "unowned-blocks",
       judges: "design",
-      description: `Judges the data blocks no pattern owns. A Store may stand alone deliberately \u2014 the sanctioned lightweight form for genuinely simple state, acknowledged with a lint.allow \u2014 while the recommended shape stays a Repository; what must never happen is folding the state into a consuming component, where no spec, diagram or conformance check can see it again. A Registry standing alone with no Store to write to is either mistyped (the "file-backed Registry" idiom, a fused persistent store that belongs typed Store) or orphaned. A Query has no standalone form at all: it computes reads over its own Repository's Store.`,
+      description: `Judges the data blocks no owner (a pattern, or a Supervisor keeping its supervision state) owns. A Store may stand alone deliberately \u2014 the sanctioned lightweight form for genuinely simple state, acknowledged with a lint.allow \u2014 while the recommended shape stays a Repository; what must never happen is folding the state into a consuming component, where no spec, diagram or conformance check can see it again. A Registry standing alone with no Store to write to is either mistyped (the "file-backed Registry" idiom, a fused persistent store that belongs typed Store) or orphaned. A Query has no standalone form at all: it computes reads over its own Repository's Store.`,
       codes: [
         { code: "UNOWNED_STORE", defaultSeverity: "warning", summary: "Store not owned by any pattern \u2014 recommended shape is a Repository; a deliberate standalone Store needs a lint.allow" },
         { code: "REGISTRY_WITHOUT_STORE", defaultSeverity: "warning", summary: "Standalone Registry with no Store to write to \u2014 either mistyped (a fused file-backed store belongs typed Store) or orphaned" },
@@ -17916,9 +18067,10 @@ var init_member_visibility = __esm({
     memberVisibilityRule = {
       name: "member-visibility",
       judges: "design",
-      description: "A component may depend on a block within its own group (it is the owning pattern, or a sibling member of the same pattern), on any pattern facade, or on a standalone block \u2014 never on a block privately owned by ANOTHER pattern, which must be reached through that pattern's facade. A retired depending component is skipped, as everywhere in this family.",
+      description: "A component may depend on a block within its own group (it is the owner, or a sibling member of the same owner), on any pattern facade, or on a standalone block \u2014 never on a block privately owned by ANOTHER pattern, which must be reached through that pattern's facade. A Store or Registry a Supervisor owns is that Supervisor's supervision state and nobody else depends on it: a component that does is the intruder, and the finding is reported on it, naming the Supervisor and the state. A retired depending component is skipped, as everywhere in this family.",
       codes: [
-        { code: "VISIBILITY_VIOLATION", defaultSeverity: "error", summary: "Dependency on a block privately owned by another pattern" }
+        { code: "VISIBILITY_VIOLATION", defaultSeverity: "error", summary: "Dependency on a block privately owned by another pattern" },
+        { code: "SUPERVISION_STATE_INTRUSION", defaultSeverity: "error", summary: "Dependency on a Store or Registry a Supervisor owns as its supervision state \u2014 reported on the intruder, naming the Supervisor and the state" }
       ],
       check(ctx) {
         const ownership = ctx.ownershipIndex();
@@ -17929,7 +18081,12 @@ var init_member_visibility = __esm({
             if (!owner) continue;
             if (owner === comp.id) continue;
             if (ownership.ownerOf(comp.id) === owner) continue;
-            ctx.addIssue("error", "VISIBILITY_VIOLATION", `Component "${comp.id}" depends on "${depId}", which is privately owned by pattern "${owner}". Depend on the facade "${owner}" instead.`, comp.id, ctx.isComponentDraft(comp.id) || ctx.isComponentDraft(depId));
+            const isDraftCtx = ctx.isComponentDraft(comp.id) || ctx.isComponentDraft(depId);
+            if (ctx.componentMap.get(owner)?.componentType === "Supervisor") {
+              ctx.addIssue("error", "SUPERVISION_STATE_INTRUSION", `"${comp.id}" depends on "${depId}", which Supervisor "${owner}" owns as its supervision state. Supervision state is private to its Supervisor \u2014 nobody else depends on it. If "${comp.id}" needs this data it is shared data: move "${depId}" out of "${owner}"'s owns into a data component both depend on (the Supervisor keeping it through read and lifecycle calls), or reach what "${comp.id}" needs through "${owner}".`, comp.id, isDraftCtx);
+              continue;
+            }
+            ctx.addIssue("error", "VISIBILITY_VIOLATION", `Component "${comp.id}" depends on "${depId}", which is privately owned by pattern "${owner}". Depend on the facade "${owner}" instead.`, comp.id, isDraftCtx);
           }
         }
       }
@@ -19216,9 +19373,9 @@ var init_durability_round_trip = __esm({
       // Stage 8: its verdict needs the whole system's specs, so a part judged alone skips it.
       needsWholeTree: true,
       judges: "design",
-      description: "A durable Store (persisted RAM projection) must carry effect-tagged contract methods, and its writes require a hydration read-back reachable from a lifecycle init entrypoint. read-through is exempt (every read IS the read-back), as are ram-projection (rebuilt not restored) and cache (evictable, loss-safe). The flagship semantic check is opt-out by declaration, never silently absent \u2014 the declaration itself is enforced by durability-declaration.",
+      description: "A durable Store (persisted RAM projection) must carry effect-tagged contract methods, and its mutations \u2014 write-effect methods, and lifecycle-effect methods, which change what exists \u2014 require a hydration read-back reachable from a lifecycle init entrypoint. read-through is exempt (every read IS the read-back), as are ram-projection (rebuilt not restored) and cache (evictable, loss-safe). The flagship semantic check is opt-out by declaration, never silently absent \u2014 the declaration itself is enforced by durability-declaration.",
       codes: [
-        { code: "MISSING_EFFECT_TAG", defaultSeverity: "warning", summary: "Durable Store contract method lacks an effect: read | write tag" },
+        { code: "MISSING_EFFECT_TAG", defaultSeverity: "warning", summary: "Durable Store contract method lacks an effect: read | write | lifecycle tag" },
         { code: "MISSING_HYDRATION", defaultSeverity: "error", summary: "Durable Store is written but no read-back is reachable from any lifecycle init entrypoint" }
       ],
       check(ctx) {
@@ -19246,7 +19403,7 @@ var init_durability_round_trip = __esm({
               isDraftCtx
             );
           }
-          const writes = methods.filter((method2) => method2.effect === "write");
+          const writes = methods.filter((method2) => method2.effect === "write" || method2.effect === "lifecycle");
           const reads = methods.filter((method2) => method2.effect === "read");
           if (writes.length === 0) continue;
           const hydrated = initReach !== null && reads.some((method2) => initReach.reachesMethod(comp.id, method2.name));
@@ -22795,6 +22952,8 @@ var init_repository = __esm({
     init_data_block_dependencies();
     init_entrypoint_dependencies();
     init_portal_write_shortcut();
+    init_supervisor_shared_data();
+    init_lifecycle_effect_closure();
     init_pattern_membership();
     init_pattern_containment();
     init_unowned_blocks();
@@ -22936,6 +23095,10 @@ var init_repository = __esm({
       dataBlockDepsRule,
       entrypointDepsRule,
       portalWriteShortcutRule,
+      // The process layer's data reach and the lifecycle effect's closure, both
+      // read from narratives against the callee's declared effect.
+      supervisorSharedDataRule,
+      lifecycleEffectClosureRule,
       // Patterns in four questions: who may own and what a claim must name,
       // what each pattern must contain, which data blocks are left standing
       // alone, and who may see a private member.
@@ -24565,7 +24728,16 @@ function buildRuleContext(opts) {
   const sitesSeen = /* @__PURE__ */ new Map();
   const sitesReported = (specId, code) => {
     const seen = sitesSeen.get(`${specId}\0${code}`);
-    return { sites: [...seen?.sites ?? []], unsited: seen?.unsited ?? false };
+    return { sites: [...seen?.sites ?? []], unsited: seen?.unsited ?? false, errored: seen?.errored ?? false };
+  };
+  const codeDefaults = new Map(opts.issueCodeSeverities ?? []);
+  for (const a of opts.extensions?.assertions ?? []) {
+    if (!codeDefaults.has(a.fullCode)) codeDefaults.set(a.fullCode, a.severity);
+  }
+  const severityOf = (code, specId) => {
+    const defaultSeverity = codeDefaults.get(code);
+    if (!defaultSeverity) return void 0;
+    return getRuleSeverity(code, defaultSeverity, false, subsystemOfSpec.get(specId));
   };
   for (const s of subsystems) collectAllows(s.id, s.lint);
   for (const c of components) collectAllows(c.id, c.lint);
@@ -24608,9 +24780,10 @@ function buildRuleContext(opts) {
     if (specId) {
       const key = `${specId}\0${code}`;
       let seen = sitesSeen.get(key);
-      if (!seen) sitesSeen.set(key, seen = { sites: /* @__PURE__ */ new Set(), unsited: false });
+      if (!seen) sitesSeen.set(key, seen = { sites: /* @__PURE__ */ new Set(), unsited: false, errored: false });
       if (parts) seen.sites.add(parts.at);
       else seen.unsited = true;
+      if (severity === "error") seen.errored = true;
     }
     let allowClaimed = false;
     if (specId) {
@@ -24727,6 +24900,7 @@ function buildRuleContext(opts) {
     roundTripIssues: opts.roundTripIssues,
     lintAllows: lintAllows2,
     sitesReported,
+    severityOf,
     knownIssueCodes: opts.knownIssueCodes,
     carriedFindings,
     carryableIssueCodes: opts.carryableIssueCodes ?? /* @__PURE__ */ new Set(),
@@ -25313,6 +25487,7 @@ function runOwnersGate(rulesOrOptions, projectType = "backend") {
     const carryableCodes = new Set(
       knownIssueCodes().filter((rc) => rc.carryable).map((rc) => rc.code)
     );
+    const codeSeverities = new Map(knownIssueCodes().map((rc) => [rc.code, rc.defaultSeverity]));
     const family = graph();
     const memberTables = family.nodes.filter((n) => n.namespace !== "").map((n) => resolveProjectExports(n.namespace));
     const producers = new Set(family.references.filter((r) => r.consumer === "").map((r) => r.producer));
@@ -25355,6 +25530,7 @@ function runOwnersGate(rulesOrOptions, projectType = "backend") {
       codeModel,
       roundTripIssues,
       knownIssueCodes: knownCodes,
+      issueCodeSeverities: codeSeverities,
       carryableIssueCodes: carryableCodes,
       issues
     });
@@ -45518,7 +45694,7 @@ ${renderChangeReport(report3)}`,
     ),
     params: import_zod11.z.array(methodParamItem).optional().describe("Structured parameters \u2014 authoritative for type checking, and the signature text is derived from them. Strongly preferred."),
     guarantees: import_zod11.z.array(import_zod11.z.string().min(1)).optional().describe("Semantic guarantees the method promises (combinable); any guarantee a narrative step asserts must be declared here. Builtin tokens: idempotent | atomic | transactional | exactly-once; extension packs may declare more (any other token is UNKNOWN_GUARANTEE)"),
-    effect: import_zod11.z.enum(["read", "write"]).optional().describe("State-effect direction on the component's held state \u2014 required on a durable Store's contract methods so the durability round-trip rule can pair writes with hydration read-backs"),
+    effect: import_zod11.z.enum(["read", "write", "lifecycle"]).optional().describe("What the method does to the component's held state: read observes it; write modifies an entity's domain fields; lifecycle creates, destroys, or (un)registers an entity's existence or membership without modifying its fields, and calls only read and lifecycle methods (LIFECYCLE_CALLS_WRITE). Required on a durable Store's contract methods so the durability round-trip rule can pair mutations with hydration read-backs; a Supervisor may call a data component it does not own only through read and lifecycle methods (SUPERVISOR_WRITE_SHORTCUT)"),
     invokedBy: import_zod11.z.object({
       kind: import_zod11.z.enum(["runtime", "external", "sibling-subsystem"]).describe("Who owns the out-of-graph invocation: runtime (timer/signal/shutdown hook), external (a system outside this project), sibling-subsystem (a modeled sibling whose edge is not narrated here)"),
       caller: import_zod11.z.string().optional().describe("WHO invokes it and when, as reviewable prose \u2014 missing or placeholder-thin prose is INVOKED_BY_UNDESCRIBED")