@ybotok/loam 0.1.0-beta.3 → 0.2.0-alpha.13

package/dist/core/c4/splice/delta-blocks.js

@@ -0,0 +1,126 @@
+/**
+ * What a delta may declare that the landscape merge cannot carry.
+ *
+ * `planLandscapeMerge` splices out of the delta's `model { }` block and nothing
+ * else. That is correct — the living landscape is a model plus the views its own
+ * authors chose — but it used to be SILENT: a delta declaring `deployment { }`
+ * or a `dynamic view` archived at exit 0, reported `+N element(s), +M
+ * relationship(s)` exactly as usual, and the block was simply gone. The merge's
+ * own parse net cannot catch it either, because a landscape missing a deployment
+ * model is perfectly legal — there is nothing to fail on. Nobody finds out until
+ * somebody goes looking for a diagram that was archived months ago.
+ *
+ * So the loss is made a refusal, which is the same doctrine as the merge's other
+ * mechanical refusals (an unlocatable declaration, two statements on one line):
+ * the input cannot be spliced as authored, `--approve` deliberately does not
+ * override it — that flag overrides loam's JUDGMENT about coherence, never its
+ * ability to carry an axis — and nothing is written.
+ *
+ * ## Why views are graded and not simply banned
+ *
+ * `loam new` scaffolds a `views { view <feat> { include * } }` block into every
+ * delta.likec4 (commands/new/templates.ts), so refusing the block outright would
+ * refuse loam's own scaffold on its first archive. It is there to be RENDERED
+ * while the feature is in flight, and it is meant not to travel.
+ *
+ * The line drawn here is recoverability, and it is the only line that survives
+ * the scaffold:
+ *
+ *  - A static `view` is a rendering OF the model. Once the merge lands, the
+ *    whole model is in landscape.likec4, so the author can restate the view
+ *    there at any time from information that still exists. Dropping it loses a
+ *    convenience.
+ *  - A `dynamic view`'s ordered steps, and a `deployment { }` block's topology,
+ *    exist in NO other document the fleet keeps. When the merge drops those,
+ *    the information is gone. That is what gets refused. Rule 26 sharpens the
+ *    stakes rather than the rule: a `dynamic view`'s steps are now something
+ *    loam READS, so dropping one silently would discard checked content, not
+ *    merely a convenience.
+ *
+ * A residual is accepted knowingly: a delta carrying a SECOND static view still
+ * loses it without a word. Refusing that would mean telling an author with two
+ * preview views to delete one, which is a false refusal on a harmless file, and
+ * the loss there is recoverable by the argument above.
+ *
+ * ## The dynamic-view refusal is unchanged; its ADVICE moved
+ *
+ * A `dynamic view` still cannot ride inside `delta.likec4`, and the reason is
+ * mechanical rather than a policy about where flows belong: this document
+ * re-declares the landscape's own identifiers to anchor its new edges and
+ * carries its own `specification` block because LikeC4 parses it standalone, so
+ * it cannot be staged beside the map in one project — a duplicate specification
+ * is an error blamed on both files, and a re-declared element is a duplicate id.
+ * What changed is where the refusal sends the author. It used to say
+ * `architecture/landscape.likec4`, which was the only honest answer while the
+ * axis had no feature-delta path: a flow could not ship with the change that
+ * made it true. `features/<FEAT>/usecases/<name>.likec4` is that path
+ * (`core/usecases/delta/flows.ts`), and it is a views-only document — which is
+ * exactly why it stages beside the map when this one cannot.
+ */
+import { maskSource, topLevelBlocks } from "../source-mask.js";
+import { LandscapeSpliceError } from "./contract.js";
+/**
+ * Top-level blocks a delta can declare. `specification` and `model` are absent
+ * on purpose: the specification is re-declared in every delta because LikeC4
+ * parses each one standalone, and the model is the thing being spliced.
+ */
+const TOP_LEVEL_BLOCK = /\b(deployment|global|views)\s*\{/g;
+/** A `dynamic view` / `deployment view` inside a views block — the irrecoverable kinds. */
+const AUTHORED_VIEW = /\b(dynamic|deployment)\s+view\b/;
+function refuse(block, detail, home) {
+    throw new LandscapeSpliceError(`delta.likec4 declares ${detail}, and the landscape merge splices only what is inside \`model { }\` — ` +
+        `archiving would drop it silently, so nothing was written. Move the ${block} into ` +
+        `${home} and re-run the archive.`);
+}
+/** Where the living documents keep what this delta cannot carry. */
+const LANDSCAPE_HOME = "architecture/landscape.likec4, where the living documents keep it,";
+/** Where a FEATURE keeps TOPOLOGY — the third whole-file slot, added with the deployment axis. */
+const DEPLOYMENT_HOME = "features/<FEAT>/deployment/<name>.likec4 — a document of its own, which `loam archive` copies into " +
+    "architecture/ and `loam unarchive` takes back; say `extend` in it to add to a region the living map " +
+    "already declares —";
+/** Where a FEATURE keeps a flow — a slot of its own, not the living tree. See the header. */
+const FLOW_HOME = "features/<FEAT>/usecases/<name>.likec4 — a views-only document of its own, which `loam archive` copies into " +
+    "architecture/usecases/ and `loam unarchive` takes back —";
+/**
+ * Refuse a delta whose non-model blocks the merge would discard.
+ *
+ * Runs over MASKED source, so a `deployment {` written inside a comment or a
+ * description string cannot trigger it — the same masking discipline
+ * `scanModel` splices under, and for the same reason: this refuses an archive,
+ * and a refusal a comment can provoke is worse than the silence it replaced.
+ *
+ * Only a block at depth 0 is a top-level declaration (`topLevelBlocks`), and
+ * `deployment` at depth 1 is an ordinary `specification { deploymentNode … }`
+ * or a view predicate.
+ */
+export function assertMergeableDelta(deltaText) {
+    const { code } = maskSource(deltaText);
+    for (const { match: m, body: inner } of topLevelBlocks(code, TOP_LEVEL_BLOCK)) {
+        const block = m[1];
+        if (block !== "views") {
+            refuse(`\`${block} { }\` block`, `a top-level \`${block} { }\` block`, 
+            // The refusal is unchanged and always will be — this document
+            // re-declares the landscape's identifiers and carries its own
+            // `specification`, so it cannot be staged beside the map in one project.
+            // What changed is where it sends the author: a feature introducing
+            // topology WITH the change that makes it true now has a slot of its
+            // own, and pointing at the living landscape was the advice that made
+            // the axis's headline case a two-pull-request job. `global { }` has no
+            // such slot and keeps the living home.
+            block === "deployment" ? DEPLOYMENT_HOME : LANDSCAPE_HOME);
+        }
+        const authored = AUTHORED_VIEW.exec(inner);
+        if (authored !== null) {
+            const kind = authored[1];
+            refuse(`\`${kind} view\``, `a \`${kind} view\` in its \`views { }\` block — a view of that kind describes ordering or topology ` +
+                `recorded in no other document, unlike the static preview view \`loam new\` scaffolds`, 
+            // A deployment view is topology and belongs in the living map; a dynamic
+            // view is a flow, and a flow now has a feature slot of its own. Sending
+            // an author to the living landscape for one they are introducing WITH
+            // this change was the advice that made the axis's headline case a
+            // two-pull-request job.
+            kind === "dynamic" ? FLOW_HOME : DEPLOYMENT_HOME);
+        }
+    }
+}
+//# sourceMappingURL=delta-blocks.js.map

package/dist/core/c4/splice/delta-blocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delta-blocks.js","sourceRoot":"","sources":["../../../../src/core/c4/splice/delta-blocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAErD;;;;GAIG;AACH,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D,2FAA2F;AAC3F,MAAM,aAAa,GAAG,iCAAiC,CAAC;AAExD,SAAS,MAAM,CAAC,KAAa,EAAE,MAAc,EAAE,IAAY;IACzD,MAAM,IAAI,oBAAoB,CAC5B,yBAAyB,MAAM,wEAAwE;QACrG,sEAAsE,KAAK,QAAQ;QACnF,GAAG,IAAI,0BAA0B,CACpC,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,cAAc,GAAG,oEAAoE,CAAC;AAE5F,kGAAkG;AAClG,MAAM,eAAe,GACnB,qGAAqG;IACrG,sGAAsG;IACtG,oBAAoB,CAAC;AAEvB,6FAA6F;AAC7F,MAAM,SAAS,GACb,8GAA8G;IAC9G,0DAA0D,CAAC;AAE7D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,MAAM,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACvC,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,cAAc,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;QAC9E,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACpB,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,MAAM,CACJ,KAAK,KAAK,cAAc,EACxB,iBAAiB,KAAK,cAAc;YACpC,8DAA8D;YAC9D,8DAA8D;YAC9D,yEAAyE;YACzE,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,uEAAuE;YACvE,uCAAuC;YACvC,KAAK,KAAK,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,cAAc,CAC1D,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;YAC1B,MAAM,CACJ,KAAK,IAAI,SAAS,EAClB,OAAO,IAAI,0FAA0F;gBACnG,sFAAsF;YACxF,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,kEAAkE;YAClE,wBAAwB;YACxB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CACjD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * What a delta may declare that the landscape merge cannot carry.\n *\n * `planLandscapeMerge` splices out of the delta's `model { }` block and nothing\n * else. That is correct — the living landscape is a model plus the views its own\n * authors chose — but it used to be SILENT: a delta declaring `deployment { }`\n * or a `dynamic view` archived at exit 0, reported `+N element(s), +M\n * relationship(s)` exactly as usual, and the block was simply gone. The merge's\n * own parse net cannot catch it either, because a landscape missing a deployment\n * model is perfectly legal — there is nothing to fail on. Nobody finds out until\n * somebody goes looking for a diagram that was archived months ago.\n *\n * So the loss is made a refusal, which is the same doctrine as the merge's other\n * mechanical refusals (an unlocatable declaration, two statements on one line):\n * the input cannot be spliced as authored, `--approve` deliberately does not\n * override it — that flag overrides loam's JUDGMENT about coherence, never its\n * ability to carry an axis — and nothing is written.\n *\n * ## Why views are graded and not simply banned\n *\n * `loam new` scaffolds a `views { view <feat> { include * } }` block into every\n * delta.likec4 (commands/new/templates.ts), so refusing the block outright would\n * refuse loam's own scaffold on its first archive. It is there to be RENDERED\n * while the feature is in flight, and it is meant not to travel.\n *\n * The line drawn here is recoverability, and it is the only line that survives\n * the scaffold:\n *\n *  - A static `view` is a rendering OF the model. Once the merge lands, the\n *    whole model is in landscape.likec4, so the author can restate the view\n *    there at any time from information that still exists. Dropping it loses a\n *    convenience.\n *  - A `dynamic view`'s ordered steps, and a `deployment { }` block's topology,\n *    exist in NO other document the fleet keeps. When the merge drops those,\n *    the information is gone. That is what gets refused. Rule 26 sharpens the\n *    stakes rather than the rule: a `dynamic view`'s steps are now something\n *    loam READS, so dropping one silently would discard checked content, not\n *    merely a convenience.\n *\n * A residual is accepted knowingly: a delta carrying a SECOND static view still\n * loses it without a word. Refusing that would mean telling an author with two\n * preview views to delete one, which is a false refusal on a harmless file, and\n * the loss there is recoverable by the argument above.\n *\n * ## The dynamic-view refusal is unchanged; its ADVICE moved\n *\n * A `dynamic view` still cannot ride inside `delta.likec4`, and the reason is\n * mechanical rather than a policy about where flows belong: this document\n * re-declares the landscape's own identifiers to anchor its new edges and\n * carries its own `specification` block because LikeC4 parses it standalone, so\n * it cannot be staged beside the map in one project — a duplicate specification\n * is an error blamed on both files, and a re-declared element is a duplicate id.\n * What changed is where the refusal sends the author. It used to say\n * `architecture/landscape.likec4`, which was the only honest answer while the\n * axis had no feature-delta path: a flow could not ship with the change that\n * made it true. `features/<FEAT>/usecases/<name>.likec4` is that path\n * (`core/usecases/delta/flows.ts`), and it is a views-only document — which is\n * exactly why it stages beside the map when this one cannot.\n */\nimport { maskSource, topLevelBlocks } from \"../source-mask.js\";\nimport { LandscapeSpliceError } from \"./contract.js\";\n\n/**\n * Top-level blocks a delta can declare. `specification` and `model` are absent\n * on purpose: the specification is re-declared in every delta because LikeC4\n * parses each one standalone, and the model is the thing being spliced.\n */\nconst TOP_LEVEL_BLOCK = /\\b(deployment|global|views)\\s*\\{/g;\n\n/** A `dynamic view` / `deployment view` inside a views block — the irrecoverable kinds. */\nconst AUTHORED_VIEW = /\\b(dynamic|deployment)\\s+view\\b/;\n\nfunction refuse(block: string, detail: string, home: string): never {\n  throw new LandscapeSpliceError(\n    `delta.likec4 declares ${detail}, and the landscape merge splices only what is inside \\`model { }\\` — ` +\n      `archiving would drop it silently, so nothing was written. Move the ${block} into ` +\n      `${home} and re-run the archive.`,\n  );\n}\n\n/** Where the living documents keep what this delta cannot carry. */\nconst LANDSCAPE_HOME = \"architecture/landscape.likec4, where the living documents keep it,\";\n\n/** Where a FEATURE keeps TOPOLOGY — the third whole-file slot, added with the deployment axis. */\nconst DEPLOYMENT_HOME =\n  \"features/<FEAT>/deployment/<name>.likec4 — a document of its own, which `loam archive` copies into \" +\n  \"architecture/ and `loam unarchive` takes back; say `extend` in it to add to a region the living map \" +\n  \"already declares —\";\n\n/** Where a FEATURE keeps a flow — a slot of its own, not the living tree. See the header. */\nconst FLOW_HOME =\n  \"features/<FEAT>/usecases/<name>.likec4 — a views-only document of its own, which `loam archive` copies into \" +\n  \"architecture/usecases/ and `loam unarchive` takes back —\";\n\n/**\n * Refuse a delta whose non-model blocks the merge would discard.\n *\n * Runs over MASKED source, so a `deployment {` written inside a comment or a\n * description string cannot trigger it — the same masking discipline\n * `scanModel` splices under, and for the same reason: this refuses an archive,\n * and a refusal a comment can provoke is worse than the silence it replaced.\n *\n * Only a block at depth 0 is a top-level declaration (`topLevelBlocks`), and\n * `deployment` at depth 1 is an ordinary `specification { deploymentNode … }`\n * or a view predicate.\n */\nexport function assertMergeableDelta(deltaText: string): void {\n  const { code } = maskSource(deltaText);\n  for (const { match: m, body: inner } of topLevelBlocks(code, TOP_LEVEL_BLOCK)) {\n    const block = m[1]!;\n    if (block !== \"views\") {\n      refuse(\n        `\\`${block} { }\\` block`,\n        `a top-level \\`${block} { }\\` block`,\n        // The refusal is unchanged and always will be — this document\n        // re-declares the landscape's identifiers and carries its own\n        // `specification`, so it cannot be staged beside the map in one project.\n        // What changed is where it sends the author: a feature introducing\n        // topology WITH the change that makes it true now has a slot of its\n        // own, and pointing at the living landscape was the advice that made\n        // the axis's headline case a two-pull-request job. `global { }` has no\n        // such slot and keeps the living home.\n        block === \"deployment\" ? DEPLOYMENT_HOME : LANDSCAPE_HOME,\n      );\n    }\n    const authored = AUTHORED_VIEW.exec(inner);\n    if (authored !== null) {\n      const kind = authored[1]!;\n      refuse(\n        `\\`${kind} view\\``,\n        `a \\`${kind} view\\` in its \\`views { }\\` block — a view of that kind describes ordering or topology ` +\n          `recorded in no other document, unlike the static preview view \\`loam new\\` scaffolds`,\n        // A deployment view is topology and belongs in the living map; a dynamic\n        // view is a flow, and a flow now has a feature slot of its own. Sending\n        // an author to the living landscape for one they are introducing WITH\n        // this change was the advice that made the axis's headline case a\n        // two-pull-request job.\n        kind === \"dynamic\" ? FLOW_HOME : DEPLOYMENT_HOME,\n      );\n    }\n  }\n}\n"]}

package/dist/core/c4/splice/identity/declared.js

@@ -0,0 +1,87 @@
+/**
+ * What the fleet's extending models ALREADY declare — the half of the archive's
+ * existence check that does not live on the map.
+ *
+ * The check has two joins: by id, and by TITLE for a delta that spells an
+ * element under its own identifier rather than the map's. Only the id half ever
+ * learned about the models the merge now writes into, so a container a service
+ * already draws under a different id was spliced in beside itself and the
+ * service silently grew two boxes with one name — while the SAME delta against
+ * the same title ON THE MAP adds nothing (review of E1). One rule, two
+ * documents, two answers.
+ *
+ * THE MODEL HALF IS SCOPED TO ITS SERVICE, and the map's is deliberately not.
+ * The map's global title index is the id-less fallback for documents written
+ * before `metadata { service }` existed, and it carries a hazard its own
+ * comment states: two services' boxes sharing a title join to each other unless
+ * both sides are bound. A service's interior is exactly where that would bite —
+ * every extending model in a fleet names a container 'api' — so a model's
+ * declaration joins by title only against an addition resolving to the SAME
+ * explicitly bound service. Either side unbound means no title join at all: an
+ * addition landing beside a namesake is a duplicate the author can see, and a
+ * wrongly skipped one is a container that quietly never arrived.
+ *
+ * The reader is the SCAN and not a parse, for the reason the caller states: ids
+ * are exact inside the fqn namespace the map and its models share, and parsing
+ * every model here would cost one LikeC4 workspace per service to answer a
+ * question about text. Two kinds of declaration therefore carry no title, and
+ * neither loses anything: one whose head names no title (LikeC4 titles it after
+ * its own name, and a model's default and a delta's differ exactly when their
+ * ids do — which the id join already covers) and one writing its title as a
+ * body property.
+ */
+import { ancestorIds } from "../../../kernel/ids/fqn/ancestors.js";
+/**
+ * Index the scanned models.
+ *
+ * `bindEls` is the corpus the service binding resolves against — the living
+ * map's elements plus the delta's, the same one routing uses, because a model's
+ * declaration is bound by an ancestor the MAP owns and a delta's addition by an
+ * ancestor either document may.
+ */
+export function modelDeclarations(scans, bindEls) {
+    const bound = new Map();
+    for (const e of bindEls)
+        if (e.service !== undefined)
+            bound.set(e.id, e.service);
+    // An EXPLICIT binding on the id or an ancestor, and nothing else.
+    // `serviceResolver`'s last rung answers with the element's own title or its
+    // raw id — the rung its own comment calls the one that lies — and here that
+    // would file two unbound services' containers under invented names and then
+    // let those names join.
+    const serviceOf = (id) => {
+        for (const candidate of ancestorIds(id)) {
+            const service = bound.get(candidate);
+            if (service !== undefined)
+                return service;
+        }
+        return undefined;
+    };
+    const ids = [];
+    const titles = new Set();
+    for (const { scan } of scans) {
+        for (const e of scan?.elements ?? []) {
+            // An `extend` frame declares nothing: it reopens an element the map owns.
+            if (e.extend === true)
+                continue;
+            ids.push(e.id);
+            if (e.title === undefined)
+                continue;
+            const service = serviceOf(e.id);
+            if (service !== undefined)
+                titles.add(titleKey(service, e.title));
+        }
+    }
+    return {
+        ids,
+        declaresTitle: (id, title) => {
+            const service = serviceOf(id);
+            return service !== undefined && titles.has(titleKey(service, title));
+        },
+    };
+}
+/** Length-prefixed: a service id and a title cannot spell another pair's key. */
+function titleKey(service, title) {
+    return `${service.length}:${service}${title}`;
+}
+//# sourceMappingURL=declared.js.map

package/dist/core/c4/splice/identity/declared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/declared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAenE;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAmD,EACnD,OAAwB;IAExB,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACjF,kEAAkE;IAClE,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,wBAAwB;IACxB,MAAM,SAAS,GAAG,CAAC,EAAU,EAA+B,EAAE;QAC5D,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;QAC5C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;YACrC,0EAA0E;YAC1E,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;gBAAE,SAAS;YAChC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACpC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG;QACH,aAAa,EAAE,CAAC,EAAE,EAAE,KAAK,EAAW,EAAE;YACpC,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC9B,OAAO,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,QAAQ,CAAC,OAAwB,EAAE,KAAa;IACvD,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;AAChD,CAAC","sourcesContent":["/**\n * What the fleet's extending models ALREADY declare — the half of the archive's\n * existence check that does not live on the map.\n *\n * The check has two joins: by id, and by TITLE for a delta that spells an\n * element under its own identifier rather than the map's. Only the id half ever\n * learned about the models the merge now writes into, so a container a service\n * already draws under a different id was spliced in beside itself and the\n * service silently grew two boxes with one name — while the SAME delta against\n * the same title ON THE MAP adds nothing (review of E1). One rule, two\n * documents, two answers.\n *\n * THE MODEL HALF IS SCOPED TO ITS SERVICE, and the map's is deliberately not.\n * The map's global title index is the id-less fallback for documents written\n * before `metadata { service }` existed, and it carries a hazard its own\n * comment states: two services' boxes sharing a title join to each other unless\n * both sides are bound. A service's interior is exactly where that would bite —\n * every extending model in a fleet names a container 'api' — so a model's\n * declaration joins by title only against an addition resolving to the SAME\n * explicitly bound service. Either side unbound means no title join at all: an\n * addition landing beside a namesake is a duplicate the author can see, and a\n * wrongly skipped one is a container that quietly never arrived.\n *\n * The reader is the SCAN and not a parse, for the reason the caller states: ids\n * are exact inside the fqn namespace the map and its models share, and parsing\n * every model here would cost one LikeC4 workspace per service to answer a\n * question about text. Two kinds of declaration therefore carry no title, and\n * neither loses anything: one whose head names no title (LikeC4 titles it after\n * its own name, and a model's default and a delta's differ exactly when their\n * ids do — which the id join already covers) and one writing its title as a\n * body property.\n */\nimport { ancestorIds } from \"../../../kernel/ids/fqn/ancestors.js\";\nimport type { DeclaredService } from \"../../../kernel/ids/service.js\";\nimport type { Elem } from \"../../likec4.js\";\nimport type { ScannedModel } from \"../../source-scan.js\";\n\nexport interface ModelDeclarations {\n  /** Every id an extending model declares — the id join's share, and exact. */\n  ids: string[];\n  /**\n   * True when some model already declares an element titled `title` inside the\n   * service `id` resolves to. False whenever either side is unbound.\n   */\n  declaresTitle: (id: string, title: string) => boolean;\n}\n\n/**\n * Index the scanned models.\n *\n * `bindEls` is the corpus the service binding resolves against — the living\n * map's elements plus the delta's, the same one routing uses, because a model's\n * declaration is bound by an ancestor the MAP owns and a delta's addition by an\n * ancestor either document may.\n */\nexport function modelDeclarations(\n  scans: ReadonlyArray<{ scan: ScannedModel | null }>,\n  bindEls: readonly Elem[],\n): ModelDeclarations {\n  const bound = new Map<string, DeclaredService>();\n  for (const e of bindEls) if (e.service !== undefined) bound.set(e.id, e.service);\n  // An EXPLICIT binding on the id or an ancestor, and nothing else.\n  // `serviceResolver`'s last rung answers with the element's own title or its\n  // raw id — the rung its own comment calls the one that lies — and here that\n  // would file two unbound services' containers under invented names and then\n  // let those names join.\n  const serviceOf = (id: string): DeclaredService | undefined => {\n    for (const candidate of ancestorIds(id)) {\n      const service = bound.get(candidate);\n      if (service !== undefined) return service;\n    }\n    return undefined;\n  };\n  const ids: string[] = [];\n  const titles = new Set<string>();\n  for (const { scan } of scans) {\n    for (const e of scan?.elements ?? []) {\n      // An `extend` frame declares nothing: it reopens an element the map owns.\n      if (e.extend === true) continue;\n      ids.push(e.id);\n      if (e.title === undefined) continue;\n      const service = serviceOf(e.id);\n      if (service !== undefined) titles.add(titleKey(service, e.title));\n    }\n  }\n  return {\n    ids,\n    declaresTitle: (id, title): boolean => {\n      const service = serviceOf(id);\n      return service !== undefined && titles.has(titleKey(service, title));\n    },\n  };\n}\n\n/** Length-prefixed: a service id and a title cannot spell another pair's key. */\nfunction titleKey(service: DeclaredService, title: string): string {\n  return `${service.length}:${service}${title}`;\n}\n"]}

package/dist/core/c4/splice/identity/edges.js

@@ -0,0 +1,73 @@
+/**
+ * Which AUTHORED STATEMENT a parsed addition was written as — the key that
+ * matches a `Rel` back to its bytes in delta.likec4, so the splice carries the
+ * declaration verbatim instead of re-serializing it.
+ *
+ * Stricter than `relKey` below on purpose, and asking a different question:
+ * `relKey` decides whether the living document already HAS this edge, across
+ * two id namespaces, so it joins on titles; this one runs inside ONE document
+ * where ids are exact, and it must tell apart two statements the merge would
+ * otherwise hand each other's bytes. Both endpoints, the title, all three spine
+ * keys and the tags, because a pool entry shared by two additions gives the
+ * second one the first one's authored source.
+ *
+ * The tags are a SET, and a parsed `Rel`'s are not the ones written in the
+ * statement: since LikeC4 1.59.0 a relationship kind can carry tags
+ * (`relationship publishes { #async }`), and the parse hands every edge of the
+ * kind its kind's tags, deduplicated against the statement's own (measured at
+ * the 1.59.2 pin). A scanned statement carries only what is written in it, so
+ * `scannedStatementKey` adds its kind's tags before keying — keyed as written,
+ * every edge of a tagged kind found no statement, and archive refused a delta
+ * `validate --feature` and `status` had called ready (`merge-failed`, or
+ * `usecase.flow-invalid` when the feature had flows; 2026-10).
+ */
+export function relStatementKey(r) {
+    const spine = [r.op ?? "", r.publishes ?? "", r.consumes ?? ""];
+    return JSON.stringify([r.source, r.target, r.title ?? "", ...spine, [...new Set(r.tags)].sort()]);
+}
+/**
+ * A scanned statement's `relStatementKey`, with the tags its kind gives it —
+ * what the parse of the same statement carries. `kindTags` is the document's
+ * `specification.relationshipKindTags` (`../../parsed/specification.ts`); a
+ * document whose kinds carry no tags keys exactly as `relStatementKey` does.
+ */
+export function scannedStatementKey(s, kindTags) {
+    const inherited = s.kind === undefined ? [] : (kindTags[s.kind] ?? []);
+    return relStatementKey({ ...s, tags: [...s.tags, ...inherited] });
+}
+/**
+ * The order of loam-inserted relationships that share a landing region:
+ * (source title, target title, the three spine keys, title) as one comparable
+ * string. Titles, not ids — the namespaces differ. The same edge must sort
+ * identically as today's addition and as a statement in the next archive's
+ * scan, so every field is one BOTH `Rel` and `ScannedRel` carry.
+ */
+export function relSortKey(els, r) {
+    const spine = [r.op ?? "", r.publishes ?? "", r.consumes ?? ""];
+    return JSON.stringify([titleOf(els, r.source), titleOf(els, r.target), ...spine, r.title ?? ""]);
+}
+/**
+ * What makes two edges the same edge. Endpoints are compared by TITLE, which is
+ * stable across the delta's and the landscape's id namespaces.
+ *
+ * An edge carrying a SPINE KEY — `op`, `publishes` or `consumes` — IS that call
+ * or that message, whatever it is titled: retitling it must not merge a second
+ * copy. An edge with none has only its title. Separate namespaces, because they
+ * are separate things: an op-less edge titled `authorizePayment` is not the edge
+ * whose operationId is authorizePayment, and keying on `op ?? title` quietly
+ * merged only one of them.
+ *
+ * ALL THREE keys, not just `op`. While the other two were out, a delta edge differing from a
+ * living one only by `metadata { publishes 'x' }` hashed the same, counted as already present,
+ * and was dropped — `+0 relationship(s)` at exit 0 over a binding that never reached the map.
+ */
+export function relKey(els, r) {
+    const src = titleOf(els, r.source);
+    const tgt = titleOf(els, r.target);
+    const spine = [r.op ?? "", r.publishes ?? "", r.consumes ?? ""];
+    return JSON.stringify(spine.some((v) => v !== "") ? ["spine", src, tgt, ...spine] : ["title", src, tgt, r.title ?? ""]);
+}
+export function titleOf(elements, id) {
+    return elements.find((e) => e.id === id)?.title ?? id;
+}
+//# sourceMappingURL=edges.js.map

package/dist/core/c4/splice/identity/edges.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edges.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/edges.ts"],"names":[],"mappings":"AAwBA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,eAAe,CAAC,CAAmB;IACjD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACpG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,CAAa,EAAE,QAAkB;IACnE,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,eAAe,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,GAAW,EACX,CAAyG;IAEzG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,CAAM;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,EAAU;IAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;AACxD,CAAC","sourcesContent":["/**\n * How the landscape merge decides that two relationships are the SAME EDGE,\n * and in what order equal ones are written.\n *\n * A subject of its own, and not a corner of placement: everything in\n * `../placement.ts` answers *where in the text* a statement goes, in byte\n * offsets, while everything here answers *which statement this is*, as a\n * comparable string. The merge asks the identity question first and the\n * placement question second, and getting the first one wrong is the failure\n * mode that is silent — a delta edge that hashes the same as a living one is\n * counted as already present and dropped at exit 0, with `+0 relationship(s)`\n * printed over a binding that never reached the map.\n *\n * Both keys are built from fields BOTH `Rel` and `ScannedRel` carry, because\n * the same edge must key identically as today's addition and as a statement in\n * the next archive's scan of the file it was written into. A field only one of\n * them has would make the merge disagree with itself one archive later. The one\n * field the two read differently — the tags, which the parse inherits from the\n * relationship's kind — is reconciled on the scanned side (`scannedStatementKey`).\n */\nimport type { Elem, Rel } from \"../../likec4.js\";\nimport type { ScannedRel } from \"../../source-scan.js\";\nimport type { KindTags } from \"../contract.js\";\n\n/**\n * Which AUTHORED STATEMENT a parsed addition was written as — the key that\n * matches a `Rel` back to its bytes in delta.likec4, so the splice carries the\n * declaration verbatim instead of re-serializing it.\n *\n * Stricter than `relKey` below on purpose, and asking a different question:\n * `relKey` decides whether the living document already HAS this edge, across\n * two id namespaces, so it joins on titles; this one runs inside ONE document\n * where ids are exact, and it must tell apart two statements the merge would\n * otherwise hand each other's bytes. Both endpoints, the title, all three spine\n * keys and the tags, because a pool entry shared by two additions gives the\n * second one the first one's authored source.\n *\n * The tags are a SET, and a parsed `Rel`'s are not the ones written in the\n * statement: since LikeC4 1.59.0 a relationship kind can carry tags\n * (`relationship publishes { #async }`), and the parse hands every edge of the\n * kind its kind's tags, deduplicated against the statement's own (measured at\n * the 1.59.2 pin). A scanned statement carries only what is written in it, so\n * `scannedStatementKey` adds its kind's tags before keying — keyed as written,\n * every edge of a tagged kind found no statement, and archive refused a delta\n * `validate --feature` and `status` had called ready (`merge-failed`, or\n * `usecase.flow-invalid` when the feature had flows; 2026-10).\n */\nexport function relStatementKey(r: Rel | ScannedRel): string {\n  const spine = [r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\"];\n  return JSON.stringify([r.source, r.target, r.title ?? \"\", ...spine, [...new Set(r.tags)].sort()]);\n}\n\n/**\n * A scanned statement's `relStatementKey`, with the tags its kind gives it —\n * what the parse of the same statement carries. `kindTags` is the document's\n * `specification.relationshipKindTags` (`../../parsed/specification.ts`); a\n * document whose kinds carry no tags keys exactly as `relStatementKey` does.\n */\nexport function scannedStatementKey(s: ScannedRel, kindTags: KindTags): string {\n  const inherited = s.kind === undefined ? [] : (kindTags[s.kind] ?? []);\n  return relStatementKey({ ...s, tags: [...s.tags, ...inherited] });\n}\n\n/**\n * The order of loam-inserted relationships that share a landing region:\n * (source title, target title, the three spine keys, title) as one comparable\n * string. Titles, not ids — the namespaces differ. The same edge must sort\n * identically as today's addition and as a statement in the next archive's\n * scan, so every field is one BOTH `Rel` and `ScannedRel` carry.\n */\nexport function relSortKey(\n  els: Elem[],\n  r: { source: string; target: string; title?: string; op?: string; publishes?: string; consumes?: string },\n): string {\n  const spine = [r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\"];\n  return JSON.stringify([titleOf(els, r.source), titleOf(els, r.target), ...spine, r.title ?? \"\"]);\n}\n\n/**\n * What makes two edges the same edge. Endpoints are compared by TITLE, which is\n * stable across the delta's and the landscape's id namespaces.\n *\n * An edge carrying a SPINE KEY — `op`, `publishes` or `consumes` — IS that call\n * or that message, whatever it is titled: retitling it must not merge a second\n * copy. An edge with none has only its title. Separate namespaces, because they\n * are separate things: an op-less edge titled `authorizePayment` is not the edge\n * whose operationId is authorizePayment, and keying on `op ?? title` quietly\n * merged only one of them.\n *\n * ALL THREE keys, not just `op`. While the other two were out, a delta edge differing from a\n * living one only by `metadata { publishes 'x' }` hashed the same, counted as already present,\n * and was dropped — `+0 relationship(s)` at exit 0 over a binding that never reached the map.\n */\nexport function relKey(els: Elem[], r: Rel): string {\n  const src = titleOf(els, r.source);\n  const tgt = titleOf(els, r.target);\n  const spine = [r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\"];\n  return JSON.stringify(spine.some((v) => v !== \"\") ? [\"spine\", src, tgt, ...spine] : [\"title\", src, tgt, r.title ?? \"\"]);\n}\n\nexport function titleOf(elements: Elem[], id: string): string {\n  return elements.find((e) => e.id === id)?.title ?? id;\n}\n"]}

package/dist/core/c4/splice/identity/existing.js

@@ -0,0 +1,80 @@
+import { scanModel } from "../../source-scan.js";
+import { modelDeclarations } from "./declared.js";
+import { relKey } from "./edges.js";
+/**
+ * Report (never guess) when a title join would cross two bound services: with
+ * both sides carrying an explicit `metadata { service }` binding and every
+ * binding disagreeing, they are provably DIFFERENT services' boxes sharing a
+ * title ('API', 'Database'). Skipping would silently drop the addition, and any
+ * delta edge into it would then refuse the whole archive at the merge's parse
+ * net with a message about nothing.
+ */
+export function newAdditions(req) {
+    const { livingEls, livingRels, bindEls, deltaElements, candidates, models, borrowed } = req;
+    const modelScans = models.map((model) => ({ scan: scanModel(model.text, borrowed) }));
+    const declared = modelDeclarations(modelScans, bindEls);
+    const haveIds = new Set([...livingEls.map((e) => e.id), ...declared.ids]);
+    // The title join needs the matched element back, not just membership: the
+    // cross-service guard below compares service BINDINGS across the join.
+    const byTitle = new Map();
+    const seeTitle = (el) => {
+        byTitle.set(el.title, [...(byTitle.get(el.title) ?? []), el]);
+    };
+    for (const el of livingEls)
+        seeTitle(el);
+    const els = [];
+    for (const e of candidates.els) {
+        if (haveIds.has(e.id))
+            continue;
+        // The addition's OWN service first, and before the map's global title
+        // index: a box this service's model already draws is existence, whoever
+        // else on the map happens to share the title.
+        if (declared.declaresTitle(e.id, e.title))
+            continue;
+        const sameTitle = byTitle.get(e.title);
+        if (sameTitle !== undefined) {
+            // A title match is the id-less fallback join, and skipping on it is only
+            // safe when the two sides could be the same box.
+            if (e.service !== undefined && sameTitle.every((m) => m.service !== undefined && m.service !== e.service)) {
+                return { els, rels: [], declaredIds: new Set(declared.ids), collision: { addition: e, living: sameTitle[0] } };
+            }
+            // KNOWN (narrowed by the guard above): with EITHER side unbound the title
+            // join stays trusting — the unbound title-fallback is the legal legacy
+            // pattern — so a cross-service collision hiding behind an unbound element
+            // is still silently skipped here. Scoping titles per service is backlog.
+            continue;
+        }
+        haveIds.add(e.id);
+        seeTitle(e);
+        els.push(e);
+    }
+    // An edge already in the landscape consumes one delta edge of the same
+    // identity, which is what keeps re-archiving idempotent.
+    const have = new Map();
+    for (const r of livingRels) {
+        const k = relKey(livingEls, r);
+        have.set(k, (have.get(k) ?? 0) + 1);
+    }
+    // An edge an extending model already draws consumes a delta edge exactly as a
+    // living map edge does — keyed through the DELTA's elements, because the
+    // model spells its endpoints in the map's fqn namespace and the delta must
+    // too for the nesting to resolve at all.
+    for (const { scan } of modelScans) {
+        for (const r of scan?.rels ?? []) {
+            const k = relKey(deltaElements, r);
+            have.set(k, (have.get(k) ?? 0) + 1);
+        }
+    }
+    const rels = [];
+    for (const r of candidates.rels) {
+        const k = relKey(deltaElements, r);
+        const n = have.get(k) ?? 0;
+        if (n > 0) {
+            have.set(k, n - 1);
+            continue;
+        }
+        rels.push(r);
+    }
+    return { els, rels, declaredIds: new Set(declared.ids) };
+}
+//# sourceMappingURL=existing.js.map

package/dist/core/c4/splice/identity/existing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"existing.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/existing.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,SAAS,EAAkB,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAqDpC;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAoB;IAC/C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;IAC5F,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,EAAQ,EAAQ,EAAE;QAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,SAAS;QAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,GAAG,GAAW,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAChC,sEAAsE;QACtE,wEAAwE;QACxE,8CAA8C;QAC9C,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;YAAE,SAAS;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,yEAAyE;YACzE,iDAAiD;YACjD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1G,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC;YAClH,CAAC;YACD,0EAA0E;YAC1E,uEAAuE;YACvE,0EAA0E;YAC1E,yEAAyE;YACzE,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClB,QAAQ,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,8EAA8E;IAC9E,yEAAyE;IACzE,2EAA2E;IAC3E,yCAAyC;IACzC,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAU,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3D,CAAC","sourcesContent":["/**\n * Which of a delta's tagged declarations the living fleet does NOT already have\n * — the third identity question of the archive's C4 merge, beside `./edges.ts`'s\n * \"which statement is this\" and `./owner.ts`'s \"which document owns it\".\n *\n * It moved out of `../landscape-merge.ts` when that file crossed the 400-line\n * limit, and this is the seam it wanted: everything here runs BEFORE a single\n * byte is placed, over parsed views and scans alone, and answers one question\n * that has nothing to do with where anything lands. What is left behind is the\n * splice itself.\n *\n * TWO JOINS, and the asymmetry between them is the whole subject. Ids are exact\n * and are checked against the map AND against every extending model, so\n * re-archiving is idempotent whichever document an addition landed in. Titles\n * are the id-less fallback every repository written before\n * `metadata { service }` relies on: global on the map (with the cross-service\n * collision refused rather than silently skipped) and scoped to one service in\n * the models, for the reason `./declared.ts` states.\n *\n * Relationships are matched by COUNT, not by membership: two edges the model\n * cannot tell apart are still two edges, and dropping the second one silently\n * loses a call the author drew.\n */\nimport type { Elem, Rel } from \"../../likec4.js\";\nimport { scanModel, type ScanKinds } from \"../../source-scan.js\";\nimport type { ExtendingModel } from \"../contract.js\";\nimport { modelDeclarations } from \"./declared.js\";\nimport { relKey } from \"./edges.js\";\n\nexport interface ExistingRequest {\n  /** The living map's parsed elements. */\n  livingEls: Elem[];\n  /** The living map's parsed relationships. */\n  livingRels: Rel[];\n  /**\n   * The corpus a service binding resolves against — the living map's elements\n   * plus the delta's, so a declaration the delta introduces resolves the moment\n   * its bytes would land.\n   */\n  bindEls: Elem[];\n  /** EVERY element the delta declares — edge identity reads past the tagged ones. */\n  deltaElements: Elem[];\n  /** The delta's tagged elements and relationships: the candidate additions. */\n  candidates: { els: Elem[]; rels: Rel[] };\n  /** The fleet's extending models, whose declarations count as existence too. */\n  models: readonly ExtendingModel[];\n  /**\n   * The kinds those models borrow from the map. A model's `kind name`\n   * declaration or `a .kind b` edge the scan cannot see is one this join counts\n   * as missing: the archive spliced a second copy of an edge the model already\n   * drew in the dotted form (2026-10).\n   */\n  borrowed?: ScanKinds;\n}\n\nexport interface Additions {\n  /** The tagged elements no living document already declares. */\n  els: Elem[];\n  /** The tagged relationships no living document already draws. */\n  rels: Rel[];\n  /**\n   * Every id the extending models declare. Routing needs it as well: an\n   * `extend` block's children are map fqns, so a container a model already draws\n   * anchors an addition's id chain in the map's namespace exactly as a living\n   * element does (`./owner.ts`).\n   */\n  declaredIds: Set<string>;\n  /**\n   * A title join the merge must refuse rather than take, present only when one\n   * was found — the caller stops there and nothing is written.\n   *\n   * REPORTED, not thrown, and that is a package rule rather than a style\n   * preference: `LandscapeSpliceError` lives in `../contract.ts`, and importing\n   * it as a VALUE from here would make `splice/` and `splice/identity/` import\n   * each other (`scripts/package-graph.mjs` refuses the cycle). The refusal text\n   * belongs to the merge anyway — it is the one that decides to write.\n   */\n  collision?: { addition: Elem; living: Elem };\n}\n\n/**\n * Report (never guess) when a title join would cross two bound services: with\n * both sides carrying an explicit `metadata { service }` binding and every\n * binding disagreeing, they are provably DIFFERENT services' boxes sharing a\n * title ('API', 'Database'). Skipping would silently drop the addition, and any\n * delta edge into it would then refuse the whole archive at the merge's parse\n * net with a message about nothing.\n */\nexport function newAdditions(req: ExistingRequest): Additions {\n  const { livingEls, livingRels, bindEls, deltaElements, candidates, models, borrowed } = req;\n  const modelScans = models.map((model) => ({ scan: scanModel(model.text, borrowed) }));\n  const declared = modelDeclarations(modelScans, bindEls);\n  const haveIds = new Set([...livingEls.map((e) => e.id), ...declared.ids]);\n  // The title join needs the matched element back, not just membership: the\n  // cross-service guard below compares service BINDINGS across the join.\n  const byTitle = new Map<string, Elem[]>();\n  const seeTitle = (el: Elem): void => {\n    byTitle.set(el.title, [...(byTitle.get(el.title) ?? []), el]);\n  };\n  for (const el of livingEls) seeTitle(el);\n  const els: Elem[] = [];\n  for (const e of candidates.els) {\n    if (haveIds.has(e.id)) continue;\n    // The addition's OWN service first, and before the map's global title\n    // index: a box this service's model already draws is existence, whoever\n    // else on the map happens to share the title.\n    if (declared.declaresTitle(e.id, e.title)) continue;\n    const sameTitle = byTitle.get(e.title);\n    if (sameTitle !== undefined) {\n      // A title match is the id-less fallback join, and skipping on it is only\n      // safe when the two sides could be the same box.\n      if (e.service !== undefined && sameTitle.every((m) => m.service !== undefined && m.service !== e.service)) {\n        return { els, rels: [], declaredIds: new Set(declared.ids), collision: { addition: e, living: sameTitle[0]! } };\n      }\n      // KNOWN (narrowed by the guard above): with EITHER side unbound the title\n      // join stays trusting — the unbound title-fallback is the legal legacy\n      // pattern — so a cross-service collision hiding behind an unbound element\n      // is still silently skipped here. Scoping titles per service is backlog.\n      continue;\n    }\n    haveIds.add(e.id);\n    seeTitle(e);\n    els.push(e);\n  }\n\n  // An edge already in the landscape consumes one delta edge of the same\n  // identity, which is what keeps re-archiving idempotent.\n  const have = new Map<string, number>();\n  for (const r of livingRels) {\n    const k = relKey(livingEls, r);\n    have.set(k, (have.get(k) ?? 0) + 1);\n  }\n  // An edge an extending model already draws consumes a delta edge exactly as a\n  // living map edge does — keyed through the DELTA's elements, because the\n  // model spells its endpoints in the map's fqn namespace and the delta must\n  // too for the nesting to resolve at all.\n  for (const { scan } of modelScans) {\n    for (const r of scan?.rels ?? []) {\n      const k = relKey(deltaElements, r);\n      have.set(k, (have.get(k) ?? 0) + 1);\n    }\n  }\n  const rels: Rel[] = [];\n  for (const r of candidates.rels) {\n    const k = relKey(deltaElements, r);\n    const n = have.get(k) ?? 0;\n    if (n > 0) {\n      have.set(k, n - 1);\n      continue;\n    }\n    rels.push(r);\n  }\n  return { els, rels, declaredIds: new Set(declared.ids) };\n}\n"]}

package/dist/core/c4/splice/identity/interior.js

@@ -0,0 +1,80 @@
+/**
+ * `./owner.ts`'s question one construct up: not "whose interior is this id" but
+ * "does this whole NEW BLOCK hand its interior over" — decided ONCE per block,
+ * and read by BOTH halves of the archive's routing.
+ *
+ * A service the feature INTRODUCES arrives as one tagged element whose authored
+ * bytes already hold its containers. Those containers carry no feature tag of
+ * their own — LikeC4 does not inherit tags — so per-addition routing cannot see
+ * them: they rode onto the map inside their parent, and the service's extending
+ * model could then never declare them, because writing the container the adopt
+ * brief prescribes made the map's copy a duplicate and the service `c4.invalid`
+ * (verification 2026-09-04, refutation of E1). So the box lands on the map
+ * without its interior and the children go into the model's `extend <fqn> { }`
+ * block, which `../model/merge.ts` creates.
+ *
+ * ONE DECISION, NOT TWO, and that is the whole reason this is a module rather
+ * than a closure inside `../landscape-merge.ts`. A child of such a block CAN
+ * carry the feature tag, and then both halves see it: per-addition routing reads
+ * its tag and sends it to the model, while the block decision leaves the same
+ * child's bytes on the map. Each half was right on its own and the merge
+ * declared the child twice — `merge-failed`, exit 1, nothing written, on a delta
+ * neither half was wrong about (re-verification 2026-09-04). `covering` is what
+ * makes the routing defer: a declaration written inside a block is the BLOCK's
+ * to place, whether or not it is tagged.
+ *
+ * A block holding a RELATIONSHIP statement rides whole. Such an edge names its
+ * endpoints by their LOCAL names inside the block, and the model merge anchors a
+ * relationship at the model block's top level — splitting the two apart would
+ * leave the map naming children it no longer declares, and `api -> worker` at a
+ * model's top level resolves to nothing. The edge rides with its block, for the
+ * same reason its siblings do.
+ */
+import { parentIdOf } from "../../../kernel/ids/fqn/ancestors.js";
+export function planInteriors(req) {
+    const { scan, deltaElements, owner, addedEls } = req;
+    const byId = new Map(scan.elements.map((e) => [e.id, e]));
+    const blocks = [];
+    const routed = [];
+    const omit = [];
+    for (const e of addedEls) {
+        // A block is an addition that lands on the MAP (nothing owns its parent)
+        // and whose own interior belongs to a model. An addition routed away is not
+        // a block: its children ride inside its bytes into the same model, which is
+        // `../model/merge.ts`'s own `rides` rule.
+        if (owner(parentIdOf(e.id)) !== undefined)
+            continue;
+        const model = owner(e.id);
+        if (model === undefined)
+            continue;
+        // Not in the scan: the splice loop refuses on its own, with the message that
+        // names the declaration it could not locate.
+        const src = byId.get(e.id);
+        if (src === undefined)
+            continue;
+        const kids = scan.elements.filter((c) => parentIdOf(c.id) === e.id);
+        if (kids.length === 0)
+            continue;
+        const els = kids
+            .map((c) => deltaElements.find((x) => x.id === c.id))
+            .filter((x) => x !== undefined);
+        // A child the parse does not carry is one the model merge could not splice
+        // either (it splices by id), so the whole block rides rather than losing it.
+        const splits = els.length === kids.length && !scan.rels.some((r) => r.start >= src.start && r.end <= src.end);
+        blocks.push({ range: { start: src.start, end: src.end }, fate: splits ? "split" : "whole" });
+        if (!splits)
+            continue;
+        routed.push({ model, els });
+        omit.push(...kids.map((c) => ({ start: c.start, end: c.end })));
+    }
+    return {
+        omit,
+        routed,
+        covering: (at) => blocks.find((b) => inside(at, b.range))?.fate ?? null,
+    };
+}
+/** Strictly inside: the ranges of two declarations nest or are disjoint, never overlap. */
+function inside(at, block) {
+    return at.start >= block.start && at.end <= block.end && (at.start !== block.start || at.end !== block.end);
+}
+//# sourceMappingURL=interior.js.map

package/dist/core/c4/splice/identity/interior.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interior.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/interior.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAuClE,MAAM,UAAU,aAAa,CAAC,GAAoB;IAChD,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAmD,EAAE,CAAC;IAClE,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAkB,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS;YAAE,SAAS;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,6EAA6E;QAC7E,6CAA6C;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,MAAM,GAAG,GAAG,IAAI;aACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACpD,MAAM,CAAC,CAAC,CAAC,EAAa,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAC7C,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9G,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM;QACN,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI;KACxE,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAS,MAAM,CAAC,EAAe,EAAE,KAAkB;IACjD,OAAO,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC;AAC9G,CAAC","sourcesContent":["/**\n * `./owner.ts`'s question one construct up: not \"whose interior is this id\" but\n * \"does this whole NEW BLOCK hand its interior over\" — decided ONCE per block,\n * and read by BOTH halves of the archive's routing.\n *\n * A service the feature INTRODUCES arrives as one tagged element whose authored\n * bytes already hold its containers. Those containers carry no feature tag of\n * their own — LikeC4 does not inherit tags — so per-addition routing cannot see\n * them: they rode onto the map inside their parent, and the service's extending\n * model could then never declare them, because writing the container the adopt\n * brief prescribes made the map's copy a duplicate and the service `c4.invalid`\n * (verification 2026-09-04, refutation of E1). So the box lands on the map\n * without its interior and the children go into the model's `extend <fqn> { }`\n * block, which `../model/merge.ts` creates.\n *\n * ONE DECISION, NOT TWO, and that is the whole reason this is a module rather\n * than a closure inside `../landscape-merge.ts`. A child of such a block CAN\n * carry the feature tag, and then both halves see it: per-addition routing reads\n * its tag and sends it to the model, while the block decision leaves the same\n * child's bytes on the map. Each half was right on its own and the merge\n * declared the child twice — `merge-failed`, exit 1, nothing written, on a delta\n * neither half was wrong about (re-verification 2026-09-04). `covering` is what\n * makes the routing defer: a declaration written inside a block is the BLOCK's\n * to place, whether or not it is tagged.\n *\n * A block holding a RELATIONSHIP statement rides whole. Such an edge names its\n * endpoints by their LOCAL names inside the block, and the model merge anchors a\n * relationship at the model block's top level — splitting the two apart would\n * leave the map naming children it no longer declares, and `api -> worker` at a\n * model's top level resolves to nothing. The edge rides with its block, for the\n * same reason its siblings do.\n */\nimport { parentIdOf } from \"../../../kernel/ids/fqn/ancestors.js\";\nimport type { Elem } from \"../../likec4.js\";\nimport type { ScannedModel } from \"../../source-scan.js\";\nimport type { SourceRange } from \"../authored-source.js\";\nimport type { ExtendingModel } from \"../contract.js\";\n\n/** What one block decided about everything written inside it. */\nexport type BlockFate = \"whole\" | \"split\";\n\nexport interface InteriorRequest {\n  /** The delta's declarations located in source — the bytes every decision is about. */\n  scan: ScannedModel;\n  /** EVERY element the delta declares: a child the parse does not carry cannot be routed. */\n  deltaElements: readonly Elem[];\n  /** Which document owns a given parent id's interior (`./owner.ts`). */\n  owner: (parentId: string) => ExtendingModel | undefined;\n  /** The delta's declarations this merge is adding — where the blocks are found. */\n  addedEls: readonly Elem[];\n}\n\n/** One split block's share: what its service's model takes, and what the map must drop. */\nexport interface RoutedInterior {\n  model: ExtendingModel;\n  els: Elem[];\n}\n\nexport interface Interiors {\n  /** Delta ranges the map's spliced bytes must leave behind — the split blocks' children. */\n  readonly omit: readonly SourceRange[];\n  /** What each split block hands the model that owns it. */\n  readonly routed: readonly RoutedInterior[];\n  /**\n   * The decision of the block a statement is written INSIDE, or null when no\n   * block holds it and ordinary routing applies. A block's own declaration is\n   * not inside itself and answers null.\n   */\n  covering: (at: SourceRange) => BlockFate | null;\n}\n\nexport function planInteriors(req: InteriorRequest): Interiors {\n  const { scan, deltaElements, owner, addedEls } = req;\n  const byId = new Map(scan.elements.map((e) => [e.id, e]));\n  const blocks: Array<{ range: SourceRange; fate: BlockFate }> = [];\n  const routed: RoutedInterior[] = [];\n  const omit: SourceRange[] = [];\n\n  for (const e of addedEls) {\n    // A block is an addition that lands on the MAP (nothing owns its parent)\n    // and whose own interior belongs to a model. An addition routed away is not\n    // a block: its children ride inside its bytes into the same model, which is\n    // `../model/merge.ts`'s own `rides` rule.\n    if (owner(parentIdOf(e.id)) !== undefined) continue;\n    const model = owner(e.id);\n    if (model === undefined) continue;\n    // Not in the scan: the splice loop refuses on its own, with the message that\n    // names the declaration it could not locate.\n    const src = byId.get(e.id);\n    if (src === undefined) continue;\n    const kids = scan.elements.filter((c) => parentIdOf(c.id) === e.id);\n    if (kids.length === 0) continue;\n    const els = kids\n      .map((c) => deltaElements.find((x) => x.id === c.id))\n      .filter((x): x is Elem => x !== undefined);\n    // A child the parse does not carry is one the model merge could not splice\n    // either (it splices by id), so the whole block rides rather than losing it.\n    const splits = els.length === kids.length && !scan.rels.some((r) => r.start >= src.start && r.end <= src.end);\n    blocks.push({ range: { start: src.start, end: src.end }, fate: splits ? \"split\" : \"whole\" });\n    if (!splits) continue;\n    routed.push({ model, els });\n    omit.push(...kids.map((c) => ({ start: c.start, end: c.end })));\n  }\n\n  return {\n    omit,\n    routed,\n    covering: (at) => blocks.find((b) => inside(at, b.range))?.fate ?? null,\n  };\n}\n\n/** Strictly inside: the ranges of two declarations nest or are disjoint, never overlap. */\nfunction inside(at: SourceRange, block: SourceRange): boolean {\n  return at.start >= block.start && at.end <= block.end && (at.start !== block.start || at.end !== block.end);\n}\n"]}

package/dist/core/c4/splice/identity/owner.js

@@ -0,0 +1,50 @@
+/**
+ * Which DOCUMENT owns the home of a new declaration — the other identity
+ * question the archive's C4 merge asks, beside `./edges.ts`'s "which statement
+ * is this".
+ *
+ * A declaration nested under a service's element belongs to that service's
+ * `model.likec4` when the model EXTENDS the fleet map: that is the only
+ * document allowed to declare the service's interior (SCHEMA.md, "the map holds
+ * no service's interior"), and the map's copy becomes a duplicate the moment
+ * the model writes its own — which is exactly what the adopt brief tells a
+ * service to do, and exactly the failure this closes (verification 2026-09-04,
+ * E1).
+ *
+ * The PARENT is what resolves, never the element itself, so the caller hands in
+ * the parent id and this answers "whose interior is that". A service's own
+ * element on the map has a parent that stands for nothing — a grouping box, or
+ * the model root — so it resolves to no service with a model, stays on the map,
+ * and every service-level edge between two of them stays with it. Asking about a
+ * service element's OWN id is the same question one level down, and that is how
+ * the landscape merge learns where a NEW service's interior belongs.
+ *
+ * A service with a STANDALONE model, or none at all, is simply absent from the
+ * list and therefore owns nothing here: the map draws its containers, which is
+ * legal and is what every repository did before the extending shape existed.
+ */
+import { ancestorIds } from "../../../kernel/ids/fqn/ancestors.js";
+import { serviceResolver } from "../../resolve/service.js";
+export function ownerOf(req) {
+    const { bindEls, living, declared, added, models } = req;
+    if (models.length === 0)
+        return () => undefined;
+    const byService = new Map(models.map((m) => [m.service, m]));
+    const resolve = serviceResolver(bindEls);
+    return (parentId) => {
+        if (parentId === "")
+            return undefined;
+        // Walk up until the chain reaches an id the map's namespace already holds.
+        // Everything below that point has to be a declaration this delta ADDS —
+        // a child of a container the same delta introduces, or the new service
+        // element itself — because those ids will exist once the merge lands.
+        for (const a of ancestorIds(parentId)) {
+            if (living.has(a) || declared.has(a))
+                break;
+            if (!added.has(a))
+                return undefined;
+        }
+        return byService.get(resolve(parentId));
+    };
+}
+//# sourceMappingURL=owner.js.map

package/dist/core/c4/splice/identity/owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/owner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAsC3D,MAAM,UAAU,OAAO,CAAC,GAAiB;IACvC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,CAAC,QAAgB,EAA8B,EAAE;QACtD,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,SAAS,CAAC;QACtC,2EAA2E;QAC3E,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,MAAM;YAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;QACtC,CAAC;QACD,OAAO,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Which DOCUMENT owns the home of a new declaration — the other identity\n * question the archive's C4 merge asks, beside `./edges.ts`'s \"which statement\n * is this\".\n *\n * A declaration nested under a service's element belongs to that service's\n * `model.likec4` when the model EXTENDS the fleet map: that is the only\n * document allowed to declare the service's interior (SCHEMA.md, \"the map holds\n * no service's interior\"), and the map's copy becomes a duplicate the moment\n * the model writes its own — which is exactly what the adopt brief tells a\n * service to do, and exactly the failure this closes (verification 2026-09-04,\n * E1).\n *\n * The PARENT is what resolves, never the element itself, so the caller hands in\n * the parent id and this answers \"whose interior is that\". A service's own\n * element on the map has a parent that stands for nothing — a grouping box, or\n * the model root — so it resolves to no service with a model, stays on the map,\n * and every service-level edge between two of them stays with it. Asking about a\n * service element's OWN id is the same question one level down, and that is how\n * the landscape merge learns where a NEW service's interior belongs.\n *\n * A service with a STANDALONE model, or none at all, is simply absent from the\n * list and therefore owns nothing here: the map draws its containers, which is\n * legal and is what every repository did before the extending shape existed.\n */\nimport { ancestorIds } from \"../../../kernel/ids/fqn/ancestors.js\";\nimport type { Elem } from \"../../likec4.js\";\nimport { serviceResolver } from \"../../resolve/service.js\";\nimport type { ExtendingModel } from \"../contract.js\";\n\nexport interface OwnerRequest {\n  /**\n   * The corpus the parent id resolves against — the LIVING map's elements plus\n   * the delta's own, so an element the delta introduces resolves the moment its\n   * bytes would land.\n   */\n  bindEls: Elem[];\n  /**\n   * The ids the LIVING map declares. Reaching one is what proves the id chain is\n   * spelled in the map's own namespace.\n   */\n  living: ReadonlySet<string>;\n  /**\n   * The ids the fleet's extending models declare inside their `extend` blocks.\n   * Those are map fqns too — an `extend` frame reopens an element the map owns —\n   * so a container already drawn in a model anchors the chain exactly as a living\n   * one does, and an edge into a child of it still routes.\n   */\n  declared: ReadonlySet<string>;\n  /**\n   * The ids this merge is ADDING: the delta's declarations that survived the\n   * existence joins. An id that is neither living, declared, nor added is one the\n   * delta spells under its OWN name for an element the map already holds under\n   * another — the legacy title join, which the landscape merge still merges for.\n   * Routing it would open an `extend` block on an fqn the map has never heard of,\n   * and the model's parse net would refuse an archive that used to merge\n   * (verification 2026-09-04, refutation of E1: the guard used to accept any\n   * chain whose ANCESTOR was living, so a title-joined name inside a group the\n   * map declares — `marketplace.orderSvc` under the living `marketplace` — passed\n   * it and every grouped fleet's legacy delta became `merge-failed`).\n   */\n  added: ReadonlySet<string>;\n  models: readonly ExtendingModel[];\n}\n\nexport function ownerOf(req: OwnerRequest): (parentId: string) => ExtendingModel | undefined {\n  const { bindEls, living, declared, added, models } = req;\n  if (models.length === 0) return () => undefined;\n  const byService = new Map(models.map((m) => [m.service, m]));\n  const resolve = serviceResolver(bindEls);\n  return (parentId: string): ExtendingModel | undefined => {\n    if (parentId === \"\") return undefined;\n    // Walk up until the chain reaches an id the map's namespace already holds.\n    // Everything below that point has to be a declaration this delta ADDS —\n    // a child of a container the same delta introduces, or the new service\n    // element itself — because those ids will exist once the merge lands.\n    for (const a of ancestorIds(parentId)) {\n      if (living.has(a) || declared.has(a)) break;\n      if (!added.has(a)) return undefined;\n    }\n    return byService.get(resolve(parentId));\n  };\n}\n"]}