@ybotok/loam 0.2.0-alpha.1 → 0.2.0-alpha.13

package/dist/commands/subsystem/txn/exclude.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exclude.js","sourceRoot":"","sources":["../../../../src/commands/subsystem/txn/exclude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAgB,MAAM,kCAAkC,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,EAAE,SAAS,EAAqB,MAAM,iCAAiC,CAAC;AAgB/E,+FAA+F;AAC/F,MAAM,CAAC,MAAM,UAAU,GAAgB;IACrC,OAAO,EAAE,KAAK;IACd,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,EAAE;IACT,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,IAAI;IACX,UAAU,EAAE,KAAK;CAClB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,QAAkC,EAClC,MAA+C;IAE/C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACjE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,kEAAkE;IAClE,+DAA+D;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE;QACxC,UAAU;QACV,SAAS;QACT,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;KACxD,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IACpF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;IAC1F,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,OAAO,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACtF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3D,2EAA2E;QAC3E,mEAAmE;QACnE,4EAA4E;QAC5E,yEAAyE;QACzE,yDAAyD;QACzD,KAAK,EAAE,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;QACjD,UAAU,EAAE,KAAK;KAClB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,OAAgB,EAAE,OAA0B;IAC9E,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,kBAAkB;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC","sourcesContent":["/**\n * The ROOT `likec4.config.json`'s `exclude` list, as `loam subsystem sync`\n * derives it from the shapes on disk.\n *\n * It sits beside `./views.ts` for that module's reason and by the same seam:\n * both answer \"what should this renderer-only file say, given the tree?\", both\n * are pure derivations one command writes, and keeping them together is what\n * stops the writer and the grader spelling one rule twice. The difference is\n * ownership, and it is stated in `core/c4/service-model/renderer.ts`: every byte\n * of the generated views file is loam's, while this file is the team's and loam\n * maintains exactly the `services/` entries in it. What an entry COVERS is\n * `core/c4/root-project/exclude.ts`'s question, asked of the directory the entry\n * names rather than of its spelling.\n *\n * It is a module rather than three functions in `../sync.ts` because that file\n * reached its line limit carrying them, and this is the phase boundary inside\n * it: `sync.ts` is the lock, the transaction and the report; this is one of the\n * three things it decides to write.\n */\nimport { readFile } from \"node:fs/promises\";\nimport { excludingEntry, parseRootProject, readRootExclude } from \"../../../core/c4/root-project/exclude.js\";\nimport { standaloneExclude } from \"../../../core/c4/service-model/renderer.js\";\nimport { serviceTreePath, type DocsDir } from \"../../../core/kernel/ids/dirs.js\";\nimport { rootProjectPath } from \"../../../core/repo/paths.js\";\nimport type { SurveyedModel } from \"../../../core/repo/tree/render/projects.js\";\nimport type { WalkedService } from \"../../../core/repo/tree/walk.js\";\nimport { planWrite, type PlannedWrite } from \"../../../core/staging/writes.js\";\n\n/** What one sync did to the ROOT project's `exclude` list. */\nexport interface ExcludePlan {\n  /** Whether this run rewrites the list. */\n  updated: boolean;\n  /** The list as it stands after this run — the current one when nothing changed. */\n  entries: string[];\n  added: string[];\n  removed: string[];\n  /** The rewrite, staged with everything else. Null when nothing is owed. */\n  write: PlannedWrite | null;\n  /** The root file exists and loam could not read an `exclude` list out of it — reported, never rewritten. */\n  unreadable: boolean;\n}\n\n/** The answer for a run that has no root file to read, and the shape every other arm fills. */\nexport const NO_EXCLUDE: ExcludePlan = {\n  updated: false,\n  entries: [],\n  added: [],\n  removed: [],\n  write: null,\n  unreadable: false,\n};\n\n/**\n * The root project's `exclude` list, recomputed from the shapes on disk.\n *\n * WHAT MAKES THIS SAFE TO RUN ON EVERY SYNC is the split `standaloneExclude`\n * enforces: the `services/` half of the list is loam's and every other entry is\n * the team's, kept in order. The scaffold's node_modules glob, `features/**`, a\n * team's own `drafts/**` all survive; only the entries that decide whether a\n * model is renderable are derived. A standalone model MUST be excluded (inside\n * the root project every kind it declares is a duplicate blamed on the map as\n * well) and an extending model must NOT be (the root project is the only place\n * it parses), so a service that migrates from one shape to the other has its\n * entry added or dropped on the next sync instead of quietly blanking a project.\n *\n * THE GATE keeps an old repository untouched. A fleet whose models all stand\n * alone and whose root already says `services/**` is already correct, and\n * rewriting it into one entry per service would be a diff with no fact behind\n * it — so the rewrite happens only when at least one model extends the map (the\n * blanket exclusion is then wrong) or some standalone model is not covered at\n * all (the renderer is merging it into the map right now). Comparing the parsed\n * ARRAYS rather than the bytes is the second half of the same rule: a file whose\n * `exclude` already says what this run would write is left exactly as the team\n * formatted it.\n *\n * A root config loam cannot read an `exclude` list out of is REPORTED and never\n * rewritten. Guessing at the JSON a team hand-wrote is how a writer destroys a\n * file it did not understand.\n */\nexport async function planExclude(\n  docsDir: DocsDir,\n  services: readonly WalkedService[],\n  models: readonly SurveyedModel<WalkedService>[],\n): Promise<ExcludePlan> {\n  const current = await readRootExclude(docsDir);\n  if (current === null) return { ...NO_EXCLUDE, unreadable: true };\n  const standalone = models.filter((m) => m.standalone).map((m) => serviceTreePath(m.service));\n  // Both halves of the shape scan travel, not just the standalone one: an entry\n  // is loam's to take back either because loam wrote it (a tree the enumeration\n  // returns) or because it HIDES a model that only parses in the root project,\n  // and only the extending list can answer the second question. Without it a\n  // subsystem-wide `services/platform/**` survived every sync while\n  // `service.model-excluded` named that same sync as the repair.\n  const extending = models.filter((m) => !m.standalone).map((m) => serviceTreePath(m.service));\n  const wanted = standaloneExclude(current, {\n    standalone,\n    extending,\n    enumerated: services.map((svc) => serviceTreePath(svc)),\n  });\n  const uncovered = standalone.some((tree) => excludingEntry(current, tree) === null);\n  if (extending.length === 0 && !uncovered) return { ...NO_EXCLUDE, entries: [...current] };\n  if (current.length === wanted.length && current.every((entry, i) => entry === wanted[i])) {\n    return { ...NO_EXCLUDE, entries: wanted };\n  }\n  const bytes = await rewrittenRootProject(docsDir, wanted);\n  if (bytes === null) return { ...NO_EXCLUDE, entries: [...current], unreadable: true };\n  return {\n    updated: true,\n    entries: wanted,\n    added: wanted.filter((entry) => !current.includes(entry)),\n    removed: current.filter((entry) => !wanted.includes(entry)),\n    // `planWrite` decides create-vs-overwrite from the filesystem, so the root\n    // file — which by definition already exists here — is staged as an\n    // OVERWRITE, and `swapStaged` compares it against its pre-image immediately\n    // before the rename: a team member editing the same file during the sync\n    // stops the commit instead of having their bytes buried.\n    write: planWrite(rootProjectPath(docsDir), bytes),\n    unreadable: false,\n  };\n}\n\n/**\n * The root project file with its `exclude` replaced and NOTHING else touched —\n * every other key kept, in the order the team wrote them, re-serialised as\n * 2-space JSON with a trailing newline (`core/docs.ts`'s own form, so a\n * scaffolded file round-trips byte for byte).\n *\n * Null when the file stopped being a JSON object between `readRootExclude` and\n * here, which is a concurrent edit rather than a state loam may write over.\n */\nasync function rewrittenRootProject(docsDir: DocsDir, exclude: readonly string[]): Promise<string | null> {\n  let text: string;\n  try {\n    text = await readFile(rootProjectPath(docsDir), \"utf8\");\n  } catch {\n    // Unreadable is not \"excludes nothing\": the caller reports it and writes\n    // nothing at all.\n    return null;\n  }\n  // The SAME parse the grader read the list with — `parseRootProject`, which\n  // tolerates the byte-order mark PowerShell's `Out-File` writes. Two parses\n  // would mean a run that read an `exclude` here and then declared the file\n  // unreadable at the write, which is exactly what a BOM produced before\n  // (re-verification 2026-09-04, area C item 3). Re-read rather than carried:\n  // the point of this read is that it happens immediately before the swap.\n  const parsed = parseRootProject(text);\n  if (parsed === null) return null;\n  return `${JSON.stringify({ ...parsed, exclude: [...exclude] }, null, 2)}\\n`;\n}\n"]}

package/dist/commands/subsystem/txn/links.js

@@ -0,0 +1,128 @@
+/**
+ * The link half of `subsystem move` and `rename`: every relative markdown link
+ * the renames would break, re-expressed so it reaches the same file.
+ *
+ * THE DEFECT THIS CLOSES. A move is a directory rename, and a relative link is
+ * a route from one directory to another. `services/orders/spec.md` citing
+ * `../../glossary/order.md` is two directories below the docs root; moved into
+ * `services/commerce/orders/` it is three, and the same text names
+ * `services/glossary/order.md`, which is nothing. The move reported success,
+ * staged the renames in git, and the next `validate --all` failed
+ * `link.unresolved` on every moved document that cited anything outside its
+ * own directory — the "failing between two commits" state the commit window
+ * exists to refuse. The same rename breaks the other direction too: a
+ * capability document or a glossary term citing `services/orders/spec.md`
+ * now points where nothing is.
+ *
+ * SO BOTH DIRECTIONS ARE REWRITTEN, with the one rule archive's merge uses
+ * (`core/links/parse.ts`'s `rebaseLinks`): the target is unchanged, only the
+ * route to it, and a link whose text still reaches its target from the new
+ * place keeps its exact spelling.
+ *
+ * - Every markdown file under a moved directory, whatever its name — a runbook,
+ *   an ADR, a subsystem's own notes: the rename moves them all, so it owes them
+ *   all the same correction. Written at the OLD path, because the transaction
+ *   swaps files before it renames directories (`core/staging/txn/`), so the
+ *   rewritten bytes travel with the rename.
+ * - Every other document in the link corpus (`core/links/corpus.ts`: the fleet's
+ *   own documents, every service's, every in-flight feature's) whose links
+ *   reach INTO a moved directory. Archived features are not in it, for the
+ *   corpus's own reason: their links describe the tree as it was, and nothing
+ *   grades them.
+ *
+ * A document that cannot be decoded is left as it is: rewriting means writing
+ * the whole file back, and `link.unreadable` already names it.
+ */
+import { dirname, resolve } from "node:path";
+import { allAuthoredDocuments, movedMarkdown } from "../../../core/links/corpus.js";
+import { rebaseLinks } from "../../../core/links/parse.js";
+import { FleetContext } from "../../../core/fleet-context.js";
+import { movedUnderVouch, parseFrontmatter } from "../../../core/document/frontmatter.js";
+import { parseRequirements } from "../../../core/document/parse.js";
+import { requirementDigest } from "../../../core/document/spec.js";
+import { repoPath } from "../../../core/envelope/json.js";
+import { featuresDir } from "../../../core/repo/paths.js";
+import { inOrder } from "../../../core/kernel/concurrency.js";
+import { acrossRename, isPathInside } from "../../../core/kernel/path-safety.js";
+import { planWrite, readUtf8 } from "../../../core/staging/writes.js";
+export async function movedLinks(docsDir, moves) {
+    const retarget = (target) => {
+        for (const move of moves) {
+            if (isPathInside(move.from, target))
+                return acrossRename(target, move.from, move.to);
+        }
+        return target;
+    };
+    const out = { writes: [], relinked: [], notices: [] };
+    // The moved documents first, then every other document the corpus names —
+    // one list, deduplicated in order, because the order is what `relinked`
+    // reports and a person reads it top to bottom.
+    const candidates = [];
+    for (const move of moves)
+        candidates.push(...(await movedMarkdown(move.from)));
+    try {
+        const corpus = await allAuthoredDocuments(docsDir, new FleetContext());
+        candidates.push(...corpus.filter((path) => !moves.some((move) => isPathInside(move.from, path))));
+    }
+    catch (err) {
+        // The corpus walk enumerates every service and feature; a tree it cannot
+        // walk is one `validate` will diagnose, and the moved documents are still
+        // corrected. A move is not refused over a question it only asks to be
+        // helpful — but it does not pretend the question was answered either.
+        out.notices.push(`links INTO the moved directories were not checked — the fleet's documents could not be walked (${err instanceof Error ? err.message : String(err)}); ` +
+            "`loam validate --all` names any that broke.");
+    }
+    const seen = new Set();
+    const unique = [];
+    for (const path of candidates) {
+        if (seen.has(resolve(path)))
+            continue;
+        seen.add(resolve(path));
+        unique.push(path);
+    }
+    // Read and rewrite with bounded concurrency — the whole corpus is read
+    // before the commit window can land — and apply in input order (`inOrder`).
+    const rewritten = await inOrder(unique, async (path) => {
+        let text;
+        try {
+            text = await readUtf8(path);
+        }
+        catch {
+            // Absent (the corpus names every slot a service MAY fill — most have no
+            // runbook) or undecodable: either way there are no links to rewrite
+            // that loam could write back, and `link.unreadable` names the second.
+            return null;
+        }
+        const after = retarget(path);
+        const next = rebaseLinks(text, { from: dirname(path), to: dirname(after), retarget });
+        return next === text ? null : { path, after, text, next };
+    });
+    for (const one of rewritten) {
+        if (one === null)
+            continue;
+        const { path, after, text, next } = one;
+        out.writes.push(planWrite(path, next));
+        out.relinked.push(after);
+        const where = repoPath(docsDir, after);
+        if (movedUnderVouch(parseFrontmatter(next), next) && !movedUnderVouch(parseFrontmatter(text), text)) {
+            out.notices.push(`${where} is vouched, and this move rewrote links in it — content.stale follows until its owner re-vouches.`);
+        }
+        // Living documents only: a `Based-On:` pin holds the digest of a LIVING
+        // requirement, so a feature's own delta text moving pins nothing.
+        const pinned = (md) => parseRequirements(md).map(requirementDigest).join(",");
+        if (!isPathInside(featuresDir(docsDir), path) && pinned(next) !== pinned(text)) {
+            out.notices.push(`${where}: links this move rewrote sit inside requirements, so a feature in flight that pins one with Based-On: ` +
+                "reports delta.baseline-stale until `loam rebase` re-pins it.");
+        }
+    }
+    return out;
+}
+/**
+ * The rewritten documents that do NOT ride a rename — the ones a move touches
+ * outside the directories it names, which its uncommitted-work refusal and its
+ * git staging have to be told about by path.
+ */
+export function outside(links, moves) {
+    return links.writes.map((w) => w.path).filter((path) => !moves.some((move) => isPathInside(move.from, path)));
+}
+//# sourceMappingURL=links.js.map

package/dist/commands/subsystem/txn/links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"links.js","sourceRoot":"","sources":["../../../../src/commands/subsystem/txn/links.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAqB,MAAM,iCAAiC,CAAC;AA2BzF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAgB,EAAE,KAA+B;IAChF,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAU,EAAE;QAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,GAAG,GAAe,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAClE,0EAA0E;IAC1E,wEAAwE;IACxE,+CAA+C;IAC/C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,YAAY,EAAE,CAAC,CAAC;QACvE,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACpG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yEAAyE;QACzE,0EAA0E;QAC1E,sEAAsE;QACtE,sEAAsE;QACtE,GAAG,CAAC,OAAO,CAAC,IAAI,CACd,kGAAkG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK;YACrJ,6CAA6C,CAChD,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,uEAAuE;IACvE,4EAA4E;IAC5E,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACrD,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,oEAAoE;YACpE,sEAAsE;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IACH,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,KAAK,IAAI;YAAE,SAAS;QAC3B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;QACxC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACvC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;YACpG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,oGAAoG,CAAC,CAAC;QACjI,CAAC;QACD,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,MAAM,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9F,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,OAAO,CAAC,IAAI,CACd,GAAG,KAAK,yGAAyG;gBAC/G,8DAA8D,CACjE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,KAAiB,EAAE,KAA+B;IACxE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;AAChH,CAAC","sourcesContent":["/**\n * The link half of `subsystem move` and `rename`: every relative markdown link\n * the renames would break, re-expressed so it reaches the same file.\n *\n * THE DEFECT THIS CLOSES. A move is a directory rename, and a relative link is\n * a route from one directory to another. `services/orders/spec.md` citing\n * `../../glossary/order.md` is two directories below the docs root; moved into\n * `services/commerce/orders/` it is three, and the same text names\n * `services/glossary/order.md`, which is nothing. The move reported success,\n * staged the renames in git, and the next `validate --all` failed\n * `link.unresolved` on every moved document that cited anything outside its\n * own directory — the \"failing between two commits\" state the commit window\n * exists to refuse. The same rename breaks the other direction too: a\n * capability document or a glossary term citing `services/orders/spec.md`\n * now points where nothing is.\n *\n * SO BOTH DIRECTIONS ARE REWRITTEN, with the one rule archive's merge uses\n * (`core/links/parse.ts`'s `rebaseLinks`): the target is unchanged, only the\n * route to it, and a link whose text still reaches its target from the new\n * place keeps its exact spelling.\n *\n * - Every markdown file under a moved directory, whatever its name — a runbook,\n *   an ADR, a subsystem's own notes: the rename moves them all, so it owes them\n *   all the same correction. Written at the OLD path, because the transaction\n *   swaps files before it renames directories (`core/staging/txn/`), so the\n *   rewritten bytes travel with the rename.\n * - Every other document in the link corpus (`core/links/corpus.ts`: the fleet's\n *   own documents, every service's, every in-flight feature's) whose links\n *   reach INTO a moved directory. Archived features are not in it, for the\n *   corpus's own reason: their links describe the tree as it was, and nothing\n *   grades them.\n *\n * A document that cannot be decoded is left as it is: rewriting means writing\n * the whole file back, and `link.unreadable` already names it.\n */\nimport { dirname, resolve } from \"node:path\";\nimport { allAuthoredDocuments, movedMarkdown } from \"../../../core/links/corpus.js\";\nimport { rebaseLinks } from \"../../../core/links/parse.js\";\nimport { FleetContext } from \"../../../core/fleet-context.js\";\nimport { movedUnderVouch, parseFrontmatter } from \"../../../core/document/frontmatter.js\";\nimport { parseRequirements } from \"../../../core/document/parse.js\";\nimport { requirementDigest } from \"../../../core/document/spec.js\";\nimport { repoPath } from \"../../../core/envelope/json.js\";\nimport { featuresDir } from \"../../../core/repo/paths.js\";\nimport { inOrder } from \"../../../core/kernel/concurrency.js\";\nimport { acrossRename, isPathInside } from \"../../../core/kernel/path-safety.js\";\nimport { planWrite, readUtf8, type PlannedWrite } from \"../../../core/staging/writes.js\";\nimport type { DocsDir } from \"../../../core/kernel/ids/dirs.js\";\n\n/** One directory rename, absolute paths. */\nexport interface DirectoryMove {\n  from: string;\n  to: string;\n}\n\n/** The link rewrites a set of renames owes, and where each rewritten document will be read from. */\nexport interface MovedLinks {\n  /** Planned at each document's CURRENT path — the swap lands before the rename carries it. */\n  writes: PlannedWrite[];\n  /** Each rewritten document's path once the move has landed, absolute, in the order written. */\n  relinked: string[];\n  /**\n   * The notes a person owes a reading of. A rewritten route is still a\n   * changed byte: under a `content_digest` it is `content.stale` until the\n   * owner re-vouches, and inside a requirement it moves the digest a\n   * `Based-On:` pin holds, so a feature in flight that pins it is\n   * `delta.baseline-stale` until it is rebased. Neither is softened — the\n   * archive merge reports the first the same way (`revouchOwed`) — but both\n   * are said here, by path, rather than discovered by the next gate.\n   */\n  notices: string[];\n}\n\nexport async function movedLinks(docsDir: DocsDir, moves: readonly DirectoryMove[]): Promise<MovedLinks> {\n  const retarget = (target: string): string => {\n    for (const move of moves) {\n      if (isPathInside(move.from, target)) return acrossRename(target, move.from, move.to);\n    }\n    return target;\n  };\n  const out: MovedLinks = { writes: [], relinked: [], notices: [] };\n  // The moved documents first, then every other document the corpus names —\n  // one list, deduplicated in order, because the order is what `relinked`\n  // reports and a person reads it top to bottom.\n  const candidates: string[] = [];\n  for (const move of moves) candidates.push(...(await movedMarkdown(move.from)));\n  try {\n    const corpus = await allAuthoredDocuments(docsDir, new FleetContext());\n    candidates.push(...corpus.filter((path) => !moves.some((move) => isPathInside(move.from, path))));\n  } catch (err) {\n    // The corpus walk enumerates every service and feature; a tree it cannot\n    // walk is one `validate` will diagnose, and the moved documents are still\n    // corrected. A move is not refused over a question it only asks to be\n    // helpful — but it does not pretend the question was answered either.\n    out.notices.push(\n      `links INTO the moved directories were not checked — the fleet's documents could not be walked (${err instanceof Error ? err.message : String(err)}); ` +\n        \"`loam validate --all` names any that broke.\",\n    );\n  }\n  const seen = new Set<string>();\n  const unique: string[] = [];\n  for (const path of candidates) {\n    if (seen.has(resolve(path))) continue;\n    seen.add(resolve(path));\n    unique.push(path);\n  }\n  // Read and rewrite with bounded concurrency — the whole corpus is read\n  // before the commit window can land — and apply in input order (`inOrder`).\n  const rewritten = await inOrder(unique, async (path) => {\n    let text: string;\n    try {\n      text = await readUtf8(path);\n    } catch {\n      // Absent (the corpus names every slot a service MAY fill — most have no\n      // runbook) or undecodable: either way there are no links to rewrite\n      // that loam could write back, and `link.unreadable` names the second.\n      return null;\n    }\n    const after = retarget(path);\n    const next = rebaseLinks(text, { from: dirname(path), to: dirname(after), retarget });\n    return next === text ? null : { path, after, text, next };\n  });\n  for (const one of rewritten) {\n    if (one === null) continue;\n    const { path, after, text, next } = one;\n    out.writes.push(planWrite(path, next));\n    out.relinked.push(after);\n    const where = repoPath(docsDir, after);\n    if (movedUnderVouch(parseFrontmatter(next), next) && !movedUnderVouch(parseFrontmatter(text), text)) {\n      out.notices.push(`${where} is vouched, and this move rewrote links in it — content.stale follows until its owner re-vouches.`);\n    }\n    // Living documents only: a `Based-On:` pin holds the digest of a LIVING\n    // requirement, so a feature's own delta text moving pins nothing.\n    const pinned = (md: string): string => parseRequirements(md).map(requirementDigest).join(\",\");\n    if (!isPathInside(featuresDir(docsDir), path) && pinned(next) !== pinned(text)) {\n      out.notices.push(\n        `${where}: links this move rewrote sit inside requirements, so a feature in flight that pins one with Based-On: ` +\n          \"reports delta.baseline-stale until `loam rebase` re-pins it.\",\n      );\n    }\n  }\n  return out;\n}\n\n/**\n * The rewritten documents that do NOT ride a rename — the ones a move touches\n * outside the directories it names, which its uncommitted-work refusal and its\n * git staging have to be told about by path.\n */\nexport function outside(links: MovedLinks, moves: readonly DirectoryMove[]): string[] {\n  return links.writes.map((w) => w.path).filter((path) => !moves.some((move) => isPathInside(move.from, path)));\n}\n"]}

package/dist/commands/subsystem/txn/report.js

@@ -0,0 +1,174 @@
+/**
+ * What one `loam subsystem sync` SAYS it did — the `--json` envelope and the
+ * human lines, in one place.
+ *
+ * It sits beside `./views.ts` and `./exclude.ts` because it is the third answer
+ * about the same three files, and it moved out of `../sync.ts` for that file's
+ * standing reason: `sync.ts` is the lock, the transaction and the plan, and it
+ * reached the 400-line limit carrying the output too. Composing a report is not
+ * a phase of the commit, so nothing here reads the disk or decides anything — a
+ * caller hands over what happened and this spells it.
+ */
+import { emitJson } from "../../../core/envelope/json.js";
+import { authoredRefusal } from "../../../core/repo/tree/render/service/header.js";
+import { LANDSCAPE_UNREADABLE_NOTE } from "./views.js";
+/** The second generated file's name, spelled once here so the key and the sentence cannot drift. */
+const SERVICE_VIEWS = "architecture/services.likec4";
+export function reportSync(json, out) {
+    // One reason today, and it is exactly the `action` it explains — spelled as a
+    // record so a second cause is an added value rather than a re-read of the
+    // sentence a person sees.
+    const blocked = out.action === "blocked" ? { reason: "landscape-invalid" } : null;
+    if (json) {
+        emitJson({
+            command: "subsystem",
+            path: "architecture/subsystems.likec4",
+            action: out.action,
+            subsystems: out.subsystems,
+            // ADDITIVE, and emitted on every run including the untouched one: a
+            // consumer must be able to read what happened to the second generated file
+            // without branching on whether this run happened to change it. `path` and
+            // `action` keep their frozen meaning — the subsystem file — so nothing
+            // reading them sees a new one.
+            serviceViews: { path: SERVICE_VIEWS, action: out.serviceViews },
+            ...(blocked === null ? {} : { blocked }),
+            ...(out.recovered === null ? {} : { recovered: out.recovered }),
+            projects: {
+                root: out.projects.root,
+                created: out.projects.created,
+                removed: out.projects.removed,
+                current: out.projects.current,
+                // Additive, and emitted in every mode including the untouched one: a
+                // consumer must be able to read what the root project now excludes
+                // without branching on whether this run happened to change it.
+                //
+                // `unreadable` travels with it because `entries: []` alone collapses the
+                // two answers `readRootExclude` insists must stay apart — "the file
+                // excludes nothing" and "loam could not read the file" are opposite
+                // facts about what the renderer will load, and the text view had the
+                // distinction while `--json` did not (verification 2026-09-04, review C).
+                exclude: {
+                    updated: out.projects.exclude.updated,
+                    entries: out.projects.exclude.entries,
+                    added: out.projects.exclude.added,
+                    removed: out.projects.exclude.removed,
+                    unreadable: out.projects.exclude.unreadable,
+                },
+            },
+        });
+        return;
+    }
+    if (out.recovered !== null && out.recovered.outcome !== "consistent") {
+        console.log(`note: recovered an interrupted \`loam ${out.recovered.command}\` commit first (${out.recovered.outcome}).`);
+    }
+    console.log(views(out));
+    serviceViews(out.serviceViews);
+    // Owed on BOTH arms: the run that declined to rewrite an existing file, and
+    // the run that wrote the tolerant shape because there was none to protect.
+    if (out.mapUnreadable)
+        console.log(LANDSCAPE_UNREADABLE_NOTE);
+    projects(out.projects);
+    exclude(out.projects);
+}
+/** The one line about the generated views file. */
+function views(out) {
+    // "nothing to write" is a claim about the WHOLE run, and it is false the moment
+    // any of this verb's FOUR writers landed something beside a current subsystem
+    // views file: the per-service views file, a project file created, one removed,
+    // or the root `exclude` rewritten. The exclude arm was missed when it was
+    // added, so the tail contradicted the very next line of output (verification
+    // 2026-09-04, review C) — and the per-service file is the same trap one file
+    // over, which is why it is in the same expression rather than a second one.
+    const quiet = out.serviceViews === "current" &&
+        out.projects.created.length === 0 &&
+        out.projects.removed.length === 0 &&
+        !out.projects.exclude.updated;
+    const sentence = {
+        current: `architecture/subsystems.likec4 is current (${out.subsystems} subsystem(s))${quiet ? " — nothing to write." : "."}`,
+        created: `wrote architecture/subsystems.likec4 — ${out.subsystems} subsystem view(s).`,
+        updated: `updated architecture/subsystems.likec4 — ${out.subsystems} subsystem view(s).`,
+        removed: `removed architecture/subsystems.likec4 — the tree has no subsystems, so the generated file must be absent.`,
+        blocked: "architecture/subsystems.likec4 left as it is — architecture/ does not parse as one project, so the " +
+            "render's element join is the landscape file's alone (a use-case document that binds an element of its " +
+            "own is not in it), and rewriting the file would take its `include` lines with it.",
+        refused: authoredRefusal("architecture/subsystems.likec4"),
+    };
+    return sentence[out.action];
+}
+/**
+ * The one line about `architecture/services.likec4`, printed on every answer but
+ * `current` — so on the two that left the file alone (`blocked`, `refused`) as
+ * well as the three that changed it. "Nothing happened to it, and here is why"
+ * is exactly the sentence a person needs; only "nothing happened to it because
+ * nothing needed to" is silence worth keeping.
+ *
+ * SILENT WHEN CURRENT, and that is the difference from the subsystem file's line
+ * above: that one is the sentence this command has always ended on and a person
+ * reads it as "the run happened", while a second unconditional line about a file
+ * nothing touched is noise on every run in a fleet that is already in order. The
+ * `--json` key is unconditional for the opposite reason — a consumer branches on
+ * a value, not on a line's presence.
+ *
+ * No view COUNT here, deliberately. The subsystem line counts subsystems because
+ * the tree answers that without reading anything; the per-service file draws
+ * only the services the MAP resolves, and the honest count is the render's, not
+ * the tree's. loam never reads a generated file's content (docs/DESIGN.md rule
+ * 26), so counting the views in it is the one place the count could come from
+ * and the one place it may not.
+ */
+function serviceViews(action) {
+    if (action === "current")
+        return;
+    const sentence = {
+        created: `wrote ${SERVICE_VIEWS} — one overview view per service the fleet map draws.`,
+        updated: `updated ${SERVICE_VIEWS} — one overview view per service the fleet map draws.`,
+        removed: `removed ${SERVICE_VIEWS} — the fleet map draws none of the services under services/, so the generated file must be absent.`,
+        blocked: `${SERVICE_VIEWS} left as it is — architecture/ does not parse as one project, so no service resolves to a ` +
+            "map element and the render would have emptied the file rather than improved it.",
+        refused: authoredRefusal(SERVICE_VIEWS),
+    };
+    console.log(sentence[action]);
+}
+/** The per-service project files this run created and removed. */
+function projects(out) {
+    if (out.created.length > 0) {
+        console.log(`wrote ${out.created.length} services/<…>/likec4.config.json — one LikeC4 project per service model whose ` +
+            "model stands alone (an existing file is yours and is never rewritten; commit the new ones before a " +
+            "`loam subsystem move`, which refuses over untracked paths). With more than one project, " +
+            "likec4 validate at the docs root needs --project <name>; build and export take every project.");
+    }
+    // Named one per line: this is a DELETE of a file a team may have written, and
+    // a count would leave a reader nothing to check against their own diff.
+    for (const path of out.removed)
+        console.log(`removed ${path}`);
+    if (out.removed.length > 0) {
+        console.log("— that model extends the fleet map, and a project file beside it registers a second renderer project " +
+            "rooted at the service directory: `likec4 validate .` then refuses without `--project`, and wherever " +
+            "that project claims the model it loads it alone, where the map's kinds are not, and the fleet project " +
+            "loses the service's interior. This is what `service.likec4-config-stray` names.");
+    }
+    if (!out.root && out.modelled > 0) {
+        console.log("note: no likec4.config.json at the docs root, so no service project files were written — " +
+            "`loam doctor` prints the root file.");
+    }
+}
+/** The root project's `exclude`, and the one state loam refuses to touch. */
+function exclude(out) {
+    const plan = out.exclude;
+    if (plan.updated) {
+        // Named entries rather than a count: this line is the whole record of a
+        // rewrite to a file the team owns, and "updated the exclude list" gives a
+        // reader nothing to check against their own diff.
+        const parts = [
+            ...(plan.added.length > 0 ? [`+${plan.added.join(" +")}`] : []),
+            ...(plan.removed.length > 0 ? [`-${plan.removed.join(" -")}`] : []),
+        ];
+        console.log(`rewrote likec4.config.json's \`exclude\` (${parts.join(" ")}) — the root project excludes exactly the ` +
+            "models that stand alone; a model that extends the fleet map renders from the docs root and must not be excluded.");
+    }
+    if (plan.unreadable) {
+        console.log("note: likec4.config.json at the docs root is not a JSON object with a string `exclude` list, so it was " +
+            "left exactly as it is — loam does not rewrite a project file it cannot read.");
+    }
+}
+//# sourceMappingURL=report.js.map

package/dist/commands/subsystem/txn/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../../src/commands/subsystem/txn/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AAGnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAoBvD,oGAAoG;AACpG,MAAM,aAAa,GAAG,8BAA8B,CAAC;AAiDrD,MAAM,UAAU,UAAU,CAAC,IAAa,EAAE,GAAe;IACvD,8EAA8E;IAC9E,0EAA0E;IAC1E,0BAA0B;IAC1B,MAAM,OAAO,GAAuB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtG,IAAI,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC;YACP,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,gCAAgC;YACtC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,oEAAoE;YACpE,2EAA2E;YAC3E,0EAA0E;YAC1E,uEAAuE;YACvE,+BAA+B;YAC/B,YAAY,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,YAAY,EAAE;YAC/D,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YACxC,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;YAC/D,QAAQ,EAAE;gBACR,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;gBACvB,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;gBAC7B,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;gBAC7B,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;gBAC7B,qEAAqE;gBACrE,mEAAmE;gBACnE,+DAA+D;gBAC/D,EAAE;gBACF,yEAAyE;gBACzE,oEAAoE;gBACpE,oEAAoE;gBACpE,qEAAqE;gBACrE,0EAA0E;gBAC1E,OAAO,EAAE;oBACP,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO;oBACrC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO;oBACrC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK;oBACjC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO;oBACrC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU;iBAC5C;aACF;SACF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CACT,yCAAyC,GAAG,CAAC,SAAS,CAAC,OAAO,oBAAoB,GAAG,CAAC,SAAS,CAAC,OAAO,IAAI,CAC5G,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC/B,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACxB,CAAC;AAED,mDAAmD;AACnD,SAAS,KAAK,CAAC,GAAe;IAC5B,gFAAgF;IAChF,8EAA8E;IAC9E,+EAA+E;IAC/E,0EAA0E;IAC1E,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,MAAM,KAAK,GACT,GAAG,CAAC,YAAY,KAAK,SAAS;QAC9B,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QACjC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;IAChC,MAAM,QAAQ,GAA+B;QAC3C,OAAO,EAAE,8CAA8C,GAAG,CAAC,UAAU,iBAAiB,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,EAAE;QAC5H,OAAO,EAAE,0CAA0C,GAAG,CAAC,UAAU,qBAAqB;QACtF,OAAO,EAAE,4CAA4C,GAAG,CAAC,UAAU,qBAAqB;QACxF,OAAO,EAAE,4GAA4G;QACrH,OAAO,EACL,qGAAqG;YACrG,wGAAwG;YACxG,mFAAmF;QACrF,OAAO,EAAE,eAAe,CAAC,gCAAgC,CAAC;KAC3D,CAAC;IACF,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,YAAY,CAAC,MAAkB;IACtC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,MAAM,QAAQ,GAAmD;QAC/D,OAAO,EAAE,SAAS,aAAa,uDAAuD;QACtF,OAAO,EAAE,WAAW,aAAa,uDAAuD;QACxF,OAAO,EAAE,WAAW,aAAa,oGAAoG;QACrI,OAAO,EACL,GAAG,aAAa,4FAA4F;YAC5G,iFAAiF;QACnF,OAAO,EAAE,eAAe,CAAC,aAAa,CAAC;KACxC,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,kEAAkE;AAClE,SAAS,QAAQ,CAAC,GAAmB;IACnC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CACT,SAAS,GAAG,CAAC,OAAO,CAAC,MAAM,gFAAgF;YACzG,qGAAqG;YACrG,0FAA0F;YAC1F,+FAA+F,CAClG,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,wEAAwE;IACxE,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC/D,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CACT,uGAAuG;YACrG,sGAAsG;YACtG,wGAAwG;YACxG,iFAAiF,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CACT,2FAA2F;YACzF,qCAAqC,CACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,OAAO,CAAC,GAAmB;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC;IACzB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,wEAAwE;QACxE,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,KAAK,GAAG;YACZ,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC;QACF,OAAO,CAAC,GAAG,CACT,6CAA6C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,4CAA4C;YACtG,kHAAkH,CACrH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CACT,yGAAyG;YACvG,8EAA8E,CACjF,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/**\n * What one `loam subsystem sync` SAYS it did — the `--json` envelope and the\n * human lines, in one place.\n *\n * It sits beside `./views.ts` and `./exclude.ts` because it is the third answer\n * about the same three files, and it moved out of `../sync.ts` for that file's\n * standing reason: `sync.ts` is the lock, the transaction and the plan, and it\n * reached the 400-line limit carrying the output too. Composing a report is not\n * a phase of the commit, so nothing here reads the disk or decides anything — a\n * caller hands over what happened and this spells it.\n */\nimport { emitJson } from \"../../../core/envelope/json.js\";\nimport { authoredRefusal } from \"../../../core/repo/tree/render/service/header.js\";\nimport type { CommitRecovery } from \"../../../core/staging/interrupted.js\";\nimport type { ExcludePlan } from \"./exclude.js\";\nimport { LANDSCAPE_UNREADABLE_NOTE } from \"./views.js\";\n\n/**\n * What one sync did to the views file — and ONLY that file; the projects report\n * separately.\n *\n * `blocked` is the fifth answer: the map cannot be read, a generated file\n * already exists, and this run left it exactly as it is. The tolerant render\n * used to run anyway and rewrote a good file down to title and description\n * (verification 2026-09-04, W5). The project half is unaffected and still runs —\n * neither the per-service files nor the root `exclude` depend on the map.\n *\n * `refused` is the sixth, and it is about OWNERSHIP rather than about the map:\n * the file standing at a path loam generates does not open with loam's mark, so\n * it is somebody's authored document and this command will not take it. It is\n * the only action that also sets a non-zero exit code (`../sync.ts` says why),\n * because unlike `blocked` it is not a state any later run clears on its own.\n */\nexport type SyncAction = \"current\" | \"created\" | \"updated\" | \"removed\" | \"blocked\" | \"refused\";\n\n/** The second generated file's name, spelled once here so the key and the sentence cannot drift. */\nconst SERVICE_VIEWS = \"architecture/services.likec4\";\n\n/** Why a run answered `blocked`. One reason today; a key rather than a bare string so a second one is additive. */\ninterface SyncBlocked {\n  reason: \"landscape-invalid\";\n}\n\n/** The additive `projects` payload key, and what the text lines are composed from. */\nexport interface ProjectsReport {\n  root: boolean;\n  /** POSIX paths relative to the DOCS ROOT, written this run, sorted by path. */\n  created: string[];\n  /**\n   * POSIX paths relative to the DOCS ROOT, DELETED this run, sorted by path — a\n   * `likec4.config.json` beside a model that extends the map. `[]` rather than\n   * absent on a run that removed none, so a consumer reads the key.\n   *\n   * SORTED BY PATH rather than by service id, which is the order the survey\n   * hands them over in: `../sync.ts` sorts both arrays where it spells them, so\n   * the `--json` list and the `removed <path>` lines below can never disagree.\n   */\n  removed: string[];\n  current: number;\n  modelled: number;\n  exclude: ExcludePlan;\n}\n\n/** Everything one run has to say, as the caller knows it. */\nexport interface SyncReport {\n  /** `architecture/subsystems.likec4` — and nothing else; the `--json` `action` key is exactly this. */\n  action: SyncAction;\n  /**\n   * `architecture/services.likec4` — the per-service overviews.\n   *\n   * A field of its own rather than a folded `action`, for the reason the shared\n   * finding code carries the path: the two files drift for different reasons and\n   * a reader told only that \"the generated views changed\" would have to diff the\n   * repo to find out which one. `blocked` reaches it exactly as it reaches the\n   * other, and for a sharper reason — with no readable map no service resolves,\n   * so the tolerant render is the empty file rather than a poorer one.\n   */\n  serviceViews: SyncAction;\n  subsystems: number;\n  recovered: CommitRecovery | null;\n  projects: ProjectsReport;\n  /** The map could not be read at all — the note is owed whether or not a file was protected. */\n  mapUnreadable: boolean;\n}\n\nexport function reportSync(json: boolean, out: SyncReport): void {\n  // One reason today, and it is exactly the `action` it explains — spelled as a\n  // record so a second cause is an added value rather than a re-read of the\n  // sentence a person sees.\n  const blocked: SyncBlocked | null = out.action === \"blocked\" ? { reason: \"landscape-invalid\" } : null;\n  if (json) {\n    emitJson({\n      command: \"subsystem\",\n      path: \"architecture/subsystems.likec4\",\n      action: out.action,\n      subsystems: out.subsystems,\n      // ADDITIVE, and emitted on every run including the untouched one: a\n      // consumer must be able to read what happened to the second generated file\n      // without branching on whether this run happened to change it. `path` and\n      // `action` keep their frozen meaning — the subsystem file — so nothing\n      // reading them sees a new one.\n      serviceViews: { path: SERVICE_VIEWS, action: out.serviceViews },\n      ...(blocked === null ? {} : { blocked }),\n      ...(out.recovered === null ? {} : { recovered: out.recovered }),\n      projects: {\n        root: out.projects.root,\n        created: out.projects.created,\n        removed: out.projects.removed,\n        current: out.projects.current,\n        // Additive, and emitted in every mode including the untouched one: a\n        // consumer must be able to read what the root project now excludes\n        // without branching on whether this run happened to change it.\n        //\n        // `unreadable` travels with it because `entries: []` alone collapses the\n        // two answers `readRootExclude` insists must stay apart — \"the file\n        // excludes nothing\" and \"loam could not read the file\" are opposite\n        // facts about what the renderer will load, and the text view had the\n        // distinction while `--json` did not (verification 2026-09-04, review C).\n        exclude: {\n          updated: out.projects.exclude.updated,\n          entries: out.projects.exclude.entries,\n          added: out.projects.exclude.added,\n          removed: out.projects.exclude.removed,\n          unreadable: out.projects.exclude.unreadable,\n        },\n      },\n    });\n    return;\n  }\n  if (out.recovered !== null && out.recovered.outcome !== \"consistent\") {\n    console.log(\n      `note: recovered an interrupted \\`loam ${out.recovered.command}\\` commit first (${out.recovered.outcome}).`,\n    );\n  }\n  console.log(views(out));\n  serviceViews(out.serviceViews);\n  // Owed on BOTH arms: the run that declined to rewrite an existing file, and\n  // the run that wrote the tolerant shape because there was none to protect.\n  if (out.mapUnreadable) console.log(LANDSCAPE_UNREADABLE_NOTE);\n  projects(out.projects);\n  exclude(out.projects);\n}\n\n/** The one line about the generated views file. */\nfunction views(out: SyncReport): string {\n  // \"nothing to write\" is a claim about the WHOLE run, and it is false the moment\n  // any of this verb's FOUR writers landed something beside a current subsystem\n  // views file: the per-service views file, a project file created, one removed,\n  // or the root `exclude` rewritten. The exclude arm was missed when it was\n  // added, so the tail contradicted the very next line of output (verification\n  // 2026-09-04, review C) — and the per-service file is the same trap one file\n  // over, which is why it is in the same expression rather than a second one.\n  const quiet =\n    out.serviceViews === \"current\" &&\n    out.projects.created.length === 0 &&\n    out.projects.removed.length === 0 &&\n    !out.projects.exclude.updated;\n  const sentence: Record<SyncAction, string> = {\n    current: `architecture/subsystems.likec4 is current (${out.subsystems} subsystem(s))${quiet ? \" — nothing to write.\" : \".\"}`,\n    created: `wrote architecture/subsystems.likec4 — ${out.subsystems} subsystem view(s).`,\n    updated: `updated architecture/subsystems.likec4 — ${out.subsystems} subsystem view(s).`,\n    removed: `removed architecture/subsystems.likec4 — the tree has no subsystems, so the generated file must be absent.`,\n    blocked:\n      \"architecture/subsystems.likec4 left as it is — architecture/ does not parse as one project, so the \" +\n      \"render's element join is the landscape file's alone (a use-case document that binds an element of its \" +\n      \"own is not in it), and rewriting the file would take its `include` lines with it.\",\n    refused: authoredRefusal(\"architecture/subsystems.likec4\"),\n  };\n  return sentence[out.action];\n}\n\n/**\n * The one line about `architecture/services.likec4`, printed on every answer but\n * `current` — so on the two that left the file alone (`blocked`, `refused`) as\n * well as the three that changed it. \"Nothing happened to it, and here is why\"\n * is exactly the sentence a person needs; only \"nothing happened to it because\n * nothing needed to\" is silence worth keeping.\n *\n * SILENT WHEN CURRENT, and that is the difference from the subsystem file's line\n * above: that one is the sentence this command has always ended on and a person\n * reads it as \"the run happened\", while a second unconditional line about a file\n * nothing touched is noise on every run in a fleet that is already in order. The\n * `--json` key is unconditional for the opposite reason — a consumer branches on\n * a value, not on a line's presence.\n *\n * No view COUNT here, deliberately. The subsystem line counts subsystems because\n * the tree answers that without reading anything; the per-service file draws\n * only the services the MAP resolves, and the honest count is the render's, not\n * the tree's. loam never reads a generated file's content (docs/DESIGN.md rule\n * 26), so counting the views in it is the one place the count could come from\n * and the one place it may not.\n */\nfunction serviceViews(action: SyncAction): void {\n  if (action === \"current\") return;\n  const sentence: Record<Exclude<SyncAction, \"current\">, string> = {\n    created: `wrote ${SERVICE_VIEWS} — one overview view per service the fleet map draws.`,\n    updated: `updated ${SERVICE_VIEWS} — one overview view per service the fleet map draws.`,\n    removed: `removed ${SERVICE_VIEWS} — the fleet map draws none of the services under services/, so the generated file must be absent.`,\n    blocked:\n      `${SERVICE_VIEWS} left as it is — architecture/ does not parse as one project, so no service resolves to a ` +\n      \"map element and the render would have emptied the file rather than improved it.\",\n    refused: authoredRefusal(SERVICE_VIEWS),\n  };\n  console.log(sentence[action]);\n}\n\n/** The per-service project files this run created and removed. */\nfunction projects(out: ProjectsReport): void {\n  if (out.created.length > 0) {\n    console.log(\n      `wrote ${out.created.length} services/<…>/likec4.config.json — one LikeC4 project per service model whose ` +\n        \"model stands alone (an existing file is yours and is never rewritten; commit the new ones before a \" +\n        \"`loam subsystem move`, which refuses over untracked paths). With more than one project, \" +\n        \"likec4 validate at the docs root needs --project <name>; build and export take every project.\",\n    );\n  }\n  // Named one per line: this is a DELETE of a file a team may have written, and\n  // a count would leave a reader nothing to check against their own diff.\n  for (const path of out.removed) console.log(`removed ${path}`);\n  if (out.removed.length > 0) {\n    console.log(\n      \"— that model extends the fleet map, and a project file beside it registers a second renderer project \" +\n        \"rooted at the service directory: `likec4 validate .` then refuses without `--project`, and wherever \" +\n        \"that project claims the model it loads it alone, where the map's kinds are not, and the fleet project \" +\n        \"loses the service's interior. This is what `service.likec4-config-stray` names.\",\n    );\n  }\n  if (!out.root && out.modelled > 0) {\n    console.log(\n      \"note: no likec4.config.json at the docs root, so no service project files were written — \" +\n        \"`loam doctor` prints the root file.\",\n    );\n  }\n}\n\n/** The root project's `exclude`, and the one state loam refuses to touch. */\nfunction exclude(out: ProjectsReport): void {\n  const plan = out.exclude;\n  if (plan.updated) {\n    // Named entries rather than a count: this line is the whole record of a\n    // rewrite to a file the team owns, and \"updated the exclude list\" gives a\n    // reader nothing to check against their own diff.\n    const parts = [\n      ...(plan.added.length > 0 ? [`+${plan.added.join(\" +\")}`] : []),\n      ...(plan.removed.length > 0 ? [`-${plan.removed.join(\" -\")}`] : []),\n    ];\n    console.log(\n      `rewrote likec4.config.json's \\`exclude\\` (${parts.join(\" \")}) — the root project excludes exactly the ` +\n        \"models that stand alone; a model that extends the fleet map renders from the docs root and must not be excluded.\",\n    );\n  }\n  if (plan.unreadable) {\n    console.log(\n      \"note: likec4.config.json at the docs root is not a JSON object with a string `exclude` list, so it was \" +\n        \"left exactly as it is — loam does not rewrite a project file it cannot read.\",\n    );\n  }\n}\n"]}