@ybotok/loam 0.2.0-alpha.1 → 0.2.0-alpha.13

package/dist/core/c4/splice/identity/existing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"existing.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/existing.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,SAAS,EAAkB,MAAM,sBAAsB,CAAC;AAEjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAqDpC;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAoB;IAC/C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;IAC5F,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,EAAQ,EAAQ,EAAE;QAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,SAAS;QAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,GAAG,GAAW,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAChC,sEAAsE;QACtE,wEAAwE;QACxE,8CAA8C;QAC9C,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;YAAE,SAAS;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,yEAAyE;YACzE,iDAAiD;YACjD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1G,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC;YAClH,CAAC;YACD,0EAA0E;YAC1E,uEAAuE;YACvE,0EAA0E;YAC1E,yEAAyE;YACzE,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClB,QAAQ,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,8EAA8E;IAC9E,yEAAyE;IACzE,2EAA2E;IAC3E,yCAAyC;IACzC,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAU,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3D,CAAC","sourcesContent":["/**\n * Which of a delta's tagged declarations the living fleet does NOT already have\n * — the third identity question of the archive's C4 merge, beside `./edges.ts`'s\n * \"which statement is this\" and `./owner.ts`'s \"which document owns it\".\n *\n * It moved out of `../landscape-merge.ts` when that file crossed the 400-line\n * limit, and this is the seam it wanted: everything here runs BEFORE a single\n * byte is placed, over parsed views and scans alone, and answers one question\n * that has nothing to do with where anything lands. What is left behind is the\n * splice itself.\n *\n * TWO JOINS, and the asymmetry between them is the whole subject. Ids are exact\n * and are checked against the map AND against every extending model, so\n * re-archiving is idempotent whichever document an addition landed in. Titles\n * are the id-less fallback every repository written before\n * `metadata { service }` relies on: global on the map (with the cross-service\n * collision refused rather than silently skipped) and scoped to one service in\n * the models, for the reason `./declared.ts` states.\n *\n * Relationships are matched by COUNT, not by membership: two edges the model\n * cannot tell apart are still two edges, and dropping the second one silently\n * loses a call the author drew.\n */\nimport type { Elem, Rel } from \"../../likec4.js\";\nimport { scanModel, type ScanKinds } from \"../../source-scan.js\";\nimport type { ExtendingModel } from \"../contract.js\";\nimport { modelDeclarations } from \"./declared.js\";\nimport { relKey } from \"./edges.js\";\n\nexport interface ExistingRequest {\n  /** The living map's parsed elements. */\n  livingEls: Elem[];\n  /** The living map's parsed relationships. */\n  livingRels: Rel[];\n  /**\n   * The corpus a service binding resolves against — the living map's elements\n   * plus the delta's, so a declaration the delta introduces resolves the moment\n   * its bytes would land.\n   */\n  bindEls: Elem[];\n  /** EVERY element the delta declares — edge identity reads past the tagged ones. */\n  deltaElements: Elem[];\n  /** The delta's tagged elements and relationships: the candidate additions. */\n  candidates: { els: Elem[]; rels: Rel[] };\n  /** The fleet's extending models, whose declarations count as existence too. */\n  models: readonly ExtendingModel[];\n  /**\n   * The kinds those models borrow from the map. A model's `kind name`\n   * declaration or `a .kind b` edge the scan cannot see is one this join counts\n   * as missing: the archive spliced a second copy of an edge the model already\n   * drew in the dotted form (2026-10).\n   */\n  borrowed?: ScanKinds;\n}\n\nexport interface Additions {\n  /** The tagged elements no living document already declares. */\n  els: Elem[];\n  /** The tagged relationships no living document already draws. */\n  rels: Rel[];\n  /**\n   * Every id the extending models declare. Routing needs it as well: an\n   * `extend` block's children are map fqns, so a container a model already draws\n   * anchors an addition's id chain in the map's namespace exactly as a living\n   * element does (`./owner.ts`).\n   */\n  declaredIds: Set<string>;\n  /**\n   * A title join the merge must refuse rather than take, present only when one\n   * was found — the caller stops there and nothing is written.\n   *\n   * REPORTED, not thrown, and that is a package rule rather than a style\n   * preference: `LandscapeSpliceError` lives in `../contract.ts`, and importing\n   * it as a VALUE from here would make `splice/` and `splice/identity/` import\n   * each other (`scripts/package-graph.mjs` refuses the cycle). The refusal text\n   * belongs to the merge anyway — it is the one that decides to write.\n   */\n  collision?: { addition: Elem; living: Elem };\n}\n\n/**\n * Report (never guess) when a title join would cross two bound services: with\n * both sides carrying an explicit `metadata { service }` binding and every\n * binding disagreeing, they are provably DIFFERENT services' boxes sharing a\n * title ('API', 'Database'). Skipping would silently drop the addition, and any\n * delta edge into it would then refuse the whole archive at the merge's parse\n * net with a message about nothing.\n */\nexport function newAdditions(req: ExistingRequest): Additions {\n  const { livingEls, livingRels, bindEls, deltaElements, candidates, models, borrowed } = req;\n  const modelScans = models.map((model) => ({ scan: scanModel(model.text, borrowed) }));\n  const declared = modelDeclarations(modelScans, bindEls);\n  const haveIds = new Set([...livingEls.map((e) => e.id), ...declared.ids]);\n  // The title join needs the matched element back, not just membership: the\n  // cross-service guard below compares service BINDINGS across the join.\n  const byTitle = new Map<string, Elem[]>();\n  const seeTitle = (el: Elem): void => {\n    byTitle.set(el.title, [...(byTitle.get(el.title) ?? []), el]);\n  };\n  for (const el of livingEls) seeTitle(el);\n  const els: Elem[] = [];\n  for (const e of candidates.els) {\n    if (haveIds.has(e.id)) continue;\n    // The addition's OWN service first, and before the map's global title\n    // index: a box this service's model already draws is existence, whoever\n    // else on the map happens to share the title.\n    if (declared.declaresTitle(e.id, e.title)) continue;\n    const sameTitle = byTitle.get(e.title);\n    if (sameTitle !== undefined) {\n      // A title match is the id-less fallback join, and skipping on it is only\n      // safe when the two sides could be the same box.\n      if (e.service !== undefined && sameTitle.every((m) => m.service !== undefined && m.service !== e.service)) {\n        return { els, rels: [], declaredIds: new Set(declared.ids), collision: { addition: e, living: sameTitle[0]! } };\n      }\n      // KNOWN (narrowed by the guard above): with EITHER side unbound the title\n      // join stays trusting — the unbound title-fallback is the legal legacy\n      // pattern — so a cross-service collision hiding behind an unbound element\n      // is still silently skipped here. Scoping titles per service is backlog.\n      continue;\n    }\n    haveIds.add(e.id);\n    seeTitle(e);\n    els.push(e);\n  }\n\n  // An edge already in the landscape consumes one delta edge of the same\n  // identity, which is what keeps re-archiving idempotent.\n  const have = new Map<string, number>();\n  for (const r of livingRels) {\n    const k = relKey(livingEls, r);\n    have.set(k, (have.get(k) ?? 0) + 1);\n  }\n  // An edge an extending model already draws consumes a delta edge exactly as a\n  // living map edge does — keyed through the DELTA's elements, because the\n  // model spells its endpoints in the map's fqn namespace and the delta must\n  // too for the nesting to resolve at all.\n  for (const { scan } of modelScans) {\n    for (const r of scan?.rels ?? []) {\n      const k = relKey(deltaElements, r);\n      have.set(k, (have.get(k) ?? 0) + 1);\n    }\n  }\n  const rels: Rel[] = [];\n  for (const r of candidates.rels) {\n    const k = relKey(deltaElements, r);\n    const n = have.get(k) ?? 0;\n    if (n > 0) {\n      have.set(k, n - 1);\n      continue;\n    }\n    rels.push(r);\n  }\n  return { els, rels, declaredIds: new Set(declared.ids) };\n}\n"]}

package/dist/core/c4/splice/identity/interior.js

@@ -0,0 +1,80 @@
+/**
+ * `./owner.ts`'s question one construct up: not "whose interior is this id" but
+ * "does this whole NEW BLOCK hand its interior over" — decided ONCE per block,
+ * and read by BOTH halves of the archive's routing.
+ *
+ * A service the feature INTRODUCES arrives as one tagged element whose authored
+ * bytes already hold its containers. Those containers carry no feature tag of
+ * their own — LikeC4 does not inherit tags — so per-addition routing cannot see
+ * them: they rode onto the map inside their parent, and the service's extending
+ * model could then never declare them, because writing the container the adopt
+ * brief prescribes made the map's copy a duplicate and the service `c4.invalid`
+ * (verification 2026-09-04, refutation of E1). So the box lands on the map
+ * without its interior and the children go into the model's `extend <fqn> { }`
+ * block, which `../model/merge.ts` creates.
+ *
+ * ONE DECISION, NOT TWO, and that is the whole reason this is a module rather
+ * than a closure inside `../landscape-merge.ts`. A child of such a block CAN
+ * carry the feature tag, and then both halves see it: per-addition routing reads
+ * its tag and sends it to the model, while the block decision leaves the same
+ * child's bytes on the map. Each half was right on its own and the merge
+ * declared the child twice — `merge-failed`, exit 1, nothing written, on a delta
+ * neither half was wrong about (re-verification 2026-09-04). `covering` is what
+ * makes the routing defer: a declaration written inside a block is the BLOCK's
+ * to place, whether or not it is tagged.
+ *
+ * A block holding a RELATIONSHIP statement rides whole. Such an edge names its
+ * endpoints by their LOCAL names inside the block, and the model merge anchors a
+ * relationship at the model block's top level — splitting the two apart would
+ * leave the map naming children it no longer declares, and `api -> worker` at a
+ * model's top level resolves to nothing. The edge rides with its block, for the
+ * same reason its siblings do.
+ */
+import { parentIdOf } from "../../../kernel/ids/fqn/ancestors.js";
+export function planInteriors(req) {
+    const { scan, deltaElements, owner, addedEls } = req;
+    const byId = new Map(scan.elements.map((e) => [e.id, e]));
+    const blocks = [];
+    const routed = [];
+    const omit = [];
+    for (const e of addedEls) {
+        // A block is an addition that lands on the MAP (nothing owns its parent)
+        // and whose own interior belongs to a model. An addition routed away is not
+        // a block: its children ride inside its bytes into the same model, which is
+        // `../model/merge.ts`'s own `rides` rule.
+        if (owner(parentIdOf(e.id)) !== undefined)
+            continue;
+        const model = owner(e.id);
+        if (model === undefined)
+            continue;
+        // Not in the scan: the splice loop refuses on its own, with the message that
+        // names the declaration it could not locate.
+        const src = byId.get(e.id);
+        if (src === undefined)
+            continue;
+        const kids = scan.elements.filter((c) => parentIdOf(c.id) === e.id);
+        if (kids.length === 0)
+            continue;
+        const els = kids
+            .map((c) => deltaElements.find((x) => x.id === c.id))
+            .filter((x) => x !== undefined);
+        // A child the parse does not carry is one the model merge could not splice
+        // either (it splices by id), so the whole block rides rather than losing it.
+        const splits = els.length === kids.length && !scan.rels.some((r) => r.start >= src.start && r.end <= src.end);
+        blocks.push({ range: { start: src.start, end: src.end }, fate: splits ? "split" : "whole" });
+        if (!splits)
+            continue;
+        routed.push({ model, els });
+        omit.push(...kids.map((c) => ({ start: c.start, end: c.end })));
+    }
+    return {
+        omit,
+        routed,
+        covering: (at) => blocks.find((b) => inside(at, b.range))?.fate ?? null,
+    };
+}
+/** Strictly inside: the ranges of two declarations nest or are disjoint, never overlap. */
+function inside(at, block) {
+    return at.start >= block.start && at.end <= block.end && (at.start !== block.start || at.end !== block.end);
+}
+//# sourceMappingURL=interior.js.map

package/dist/core/c4/splice/identity/interior.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interior.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/interior.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAuClE,MAAM,UAAU,aAAa,CAAC,GAAoB;IAChD,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAmD,EAAE,CAAC;IAClE,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAkB,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS;YAAE,SAAS;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,6EAA6E;QAC7E,6CAA6C;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,MAAM,GAAG,GAAG,IAAI;aACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACpD,MAAM,CAAC,CAAC,CAAC,EAAa,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAC7C,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9G,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM;QACN,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI;KACxE,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAS,MAAM,CAAC,EAAe,EAAE,KAAkB;IACjD,OAAO,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC;AAC9G,CAAC","sourcesContent":["/**\n * `./owner.ts`'s question one construct up: not \"whose interior is this id\" but\n * \"does this whole NEW BLOCK hand its interior over\" — decided ONCE per block,\n * and read by BOTH halves of the archive's routing.\n *\n * A service the feature INTRODUCES arrives as one tagged element whose authored\n * bytes already hold its containers. Those containers carry no feature tag of\n * their own — LikeC4 does not inherit tags — so per-addition routing cannot see\n * them: they rode onto the map inside their parent, and the service's extending\n * model could then never declare them, because writing the container the adopt\n * brief prescribes made the map's copy a duplicate and the service `c4.invalid`\n * (verification 2026-09-04, refutation of E1). So the box lands on the map\n * without its interior and the children go into the model's `extend <fqn> { }`\n * block, which `../model/merge.ts` creates.\n *\n * ONE DECISION, NOT TWO, and that is the whole reason this is a module rather\n * than a closure inside `../landscape-merge.ts`. A child of such a block CAN\n * carry the feature tag, and then both halves see it: per-addition routing reads\n * its tag and sends it to the model, while the block decision leaves the same\n * child's bytes on the map. Each half was right on its own and the merge\n * declared the child twice — `merge-failed`, exit 1, nothing written, on a delta\n * neither half was wrong about (re-verification 2026-09-04). `covering` is what\n * makes the routing defer: a declaration written inside a block is the BLOCK's\n * to place, whether or not it is tagged.\n *\n * A block holding a RELATIONSHIP statement rides whole. Such an edge names its\n * endpoints by their LOCAL names inside the block, and the model merge anchors a\n * relationship at the model block's top level — splitting the two apart would\n * leave the map naming children it no longer declares, and `api -> worker` at a\n * model's top level resolves to nothing. The edge rides with its block, for the\n * same reason its siblings do.\n */\nimport { parentIdOf } from \"../../../kernel/ids/fqn/ancestors.js\";\nimport type { Elem } from \"../../likec4.js\";\nimport type { ScannedModel } from \"../../source-scan.js\";\nimport type { SourceRange } from \"../authored-source.js\";\nimport type { ExtendingModel } from \"../contract.js\";\n\n/** What one block decided about everything written inside it. */\nexport type BlockFate = \"whole\" | \"split\";\n\nexport interface InteriorRequest {\n  /** The delta's declarations located in source — the bytes every decision is about. */\n  scan: ScannedModel;\n  /** EVERY element the delta declares: a child the parse does not carry cannot be routed. */\n  deltaElements: readonly Elem[];\n  /** Which document owns a given parent id's interior (`./owner.ts`). */\n  owner: (parentId: string) => ExtendingModel | undefined;\n  /** The delta's declarations this merge is adding — where the blocks are found. */\n  addedEls: readonly Elem[];\n}\n\n/** One split block's share: what its service's model takes, and what the map must drop. */\nexport interface RoutedInterior {\n  model: ExtendingModel;\n  els: Elem[];\n}\n\nexport interface Interiors {\n  /** Delta ranges the map's spliced bytes must leave behind — the split blocks' children. */\n  readonly omit: readonly SourceRange[];\n  /** What each split block hands the model that owns it. */\n  readonly routed: readonly RoutedInterior[];\n  /**\n   * The decision of the block a statement is written INSIDE, or null when no\n   * block holds it and ordinary routing applies. A block's own declaration is\n   * not inside itself and answers null.\n   */\n  covering: (at: SourceRange) => BlockFate | null;\n}\n\nexport function planInteriors(req: InteriorRequest): Interiors {\n  const { scan, deltaElements, owner, addedEls } = req;\n  const byId = new Map(scan.elements.map((e) => [e.id, e]));\n  const blocks: Array<{ range: SourceRange; fate: BlockFate }> = [];\n  const routed: RoutedInterior[] = [];\n  const omit: SourceRange[] = [];\n\n  for (const e of addedEls) {\n    // A block is an addition that lands on the MAP (nothing owns its parent)\n    // and whose own interior belongs to a model. An addition routed away is not\n    // a block: its children ride inside its bytes into the same model, which is\n    // `../model/merge.ts`'s own `rides` rule.\n    if (owner(parentIdOf(e.id)) !== undefined) continue;\n    const model = owner(e.id);\n    if (model === undefined) continue;\n    // Not in the scan: the splice loop refuses on its own, with the message that\n    // names the declaration it could not locate.\n    const src = byId.get(e.id);\n    if (src === undefined) continue;\n    const kids = scan.elements.filter((c) => parentIdOf(c.id) === e.id);\n    if (kids.length === 0) continue;\n    const els = kids\n      .map((c) => deltaElements.find((x) => x.id === c.id))\n      .filter((x): x is Elem => x !== undefined);\n    // A child the parse does not carry is one the model merge could not splice\n    // either (it splices by id), so the whole block rides rather than losing it.\n    const splits = els.length === kids.length && !scan.rels.some((r) => r.start >= src.start && r.end <= src.end);\n    blocks.push({ range: { start: src.start, end: src.end }, fate: splits ? \"split\" : \"whole\" });\n    if (!splits) continue;\n    routed.push({ model, els });\n    omit.push(...kids.map((c) => ({ start: c.start, end: c.end })));\n  }\n\n  return {\n    omit,\n    routed,\n    covering: (at) => blocks.find((b) => inside(at, b.range))?.fate ?? null,\n  };\n}\n\n/** Strictly inside: the ranges of two declarations nest or are disjoint, never overlap. */\nfunction inside(at: SourceRange, block: SourceRange): boolean {\n  return at.start >= block.start && at.end <= block.end && (at.start !== block.start || at.end !== block.end);\n}\n"]}

package/dist/core/c4/splice/identity/owner.js

@@ -0,0 +1,50 @@
+/**
+ * Which DOCUMENT owns the home of a new declaration — the other identity
+ * question the archive's C4 merge asks, beside `./edges.ts`'s "which statement
+ * is this".
+ *
+ * A declaration nested under a service's element belongs to that service's
+ * `model.likec4` when the model EXTENDS the fleet map: that is the only
+ * document allowed to declare the service's interior (SCHEMA.md, "the map holds
+ * no service's interior"), and the map's copy becomes a duplicate the moment
+ * the model writes its own — which is exactly what the adopt brief tells a
+ * service to do, and exactly the failure this closes (verification 2026-09-04,
+ * E1).
+ *
+ * The PARENT is what resolves, never the element itself, so the caller hands in
+ * the parent id and this answers "whose interior is that". A service's own
+ * element on the map has a parent that stands for nothing — a grouping box, or
+ * the model root — so it resolves to no service with a model, stays on the map,
+ * and every service-level edge between two of them stays with it. Asking about a
+ * service element's OWN id is the same question one level down, and that is how
+ * the landscape merge learns where a NEW service's interior belongs.
+ *
+ * A service with a STANDALONE model, or none at all, is simply absent from the
+ * list and therefore owns nothing here: the map draws its containers, which is
+ * legal and is what every repository did before the extending shape existed.
+ */
+import { ancestorIds } from "../../../kernel/ids/fqn/ancestors.js";
+import { serviceResolver } from "../../resolve/service.js";
+export function ownerOf(req) {
+    const { bindEls, living, declared, added, models } = req;
+    if (models.length === 0)
+        return () => undefined;
+    const byService = new Map(models.map((m) => [m.service, m]));
+    const resolve = serviceResolver(bindEls);
+    return (parentId) => {
+        if (parentId === "")
+            return undefined;
+        // Walk up until the chain reaches an id the map's namespace already holds.
+        // Everything below that point has to be a declaration this delta ADDS —
+        // a child of a container the same delta introduces, or the new service
+        // element itself — because those ids will exist once the merge lands.
+        for (const a of ancestorIds(parentId)) {
+            if (living.has(a) || declared.has(a))
+                break;
+            if (!added.has(a))
+                return undefined;
+        }
+        return byService.get(resolve(parentId));
+    };
+}
+//# sourceMappingURL=owner.js.map

package/dist/core/c4/splice/identity/owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/owner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAsC3D,MAAM,UAAU,OAAO,CAAC,GAAiB;IACvC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,CAAC,QAAgB,EAA8B,EAAE;QACtD,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,SAAS,CAAC;QACtC,2EAA2E;QAC3E,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,MAAM;YAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;QACtC,CAAC;QACD,OAAO,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Which DOCUMENT owns the home of a new declaration — the other identity\n * question the archive's C4 merge asks, beside `./edges.ts`'s \"which statement\n * is this\".\n *\n * A declaration nested under a service's element belongs to that service's\n * `model.likec4` when the model EXTENDS the fleet map: that is the only\n * document allowed to declare the service's interior (SCHEMA.md, \"the map holds\n * no service's interior\"), and the map's copy becomes a duplicate the moment\n * the model writes its own — which is exactly what the adopt brief tells a\n * service to do, and exactly the failure this closes (verification 2026-09-04,\n * E1).\n *\n * The PARENT is what resolves, never the element itself, so the caller hands in\n * the parent id and this answers \"whose interior is that\". A service's own\n * element on the map has a parent that stands for nothing — a grouping box, or\n * the model root — so it resolves to no service with a model, stays on the map,\n * and every service-level edge between two of them stays with it. Asking about a\n * service element's OWN id is the same question one level down, and that is how\n * the landscape merge learns where a NEW service's interior belongs.\n *\n * A service with a STANDALONE model, or none at all, is simply absent from the\n * list and therefore owns nothing here: the map draws its containers, which is\n * legal and is what every repository did before the extending shape existed.\n */\nimport { ancestorIds } from \"../../../kernel/ids/fqn/ancestors.js\";\nimport type { Elem } from \"../../likec4.js\";\nimport { serviceResolver } from \"../../resolve/service.js\";\nimport type { ExtendingModel } from \"../contract.js\";\n\nexport interface OwnerRequest {\n  /**\n   * The corpus the parent id resolves against — the LIVING map's elements plus\n   * the delta's own, so an element the delta introduces resolves the moment its\n   * bytes would land.\n   */\n  bindEls: Elem[];\n  /**\n   * The ids the LIVING map declares. Reaching one is what proves the id chain is\n   * spelled in the map's own namespace.\n   */\n  living: ReadonlySet<string>;\n  /**\n   * The ids the fleet's extending models declare inside their `extend` blocks.\n   * Those are map fqns too — an `extend` frame reopens an element the map owns —\n   * so a container already drawn in a model anchors the chain exactly as a living\n   * one does, and an edge into a child of it still routes.\n   */\n  declared: ReadonlySet<string>;\n  /**\n   * The ids this merge is ADDING: the delta's declarations that survived the\n   * existence joins. An id that is neither living, declared, nor added is one the\n   * delta spells under its OWN name for an element the map already holds under\n   * another — the legacy title join, which the landscape merge still merges for.\n   * Routing it would open an `extend` block on an fqn the map has never heard of,\n   * and the model's parse net would refuse an archive that used to merge\n   * (verification 2026-09-04, refutation of E1: the guard used to accept any\n   * chain whose ANCESTOR was living, so a title-joined name inside a group the\n   * map declares — `marketplace.orderSvc` under the living `marketplace` — passed\n   * it and every grouped fleet's legacy delta became `merge-failed`).\n   */\n  added: ReadonlySet<string>;\n  models: readonly ExtendingModel[];\n}\n\nexport function ownerOf(req: OwnerRequest): (parentId: string) => ExtendingModel | undefined {\n  const { bindEls, living, declared, added, models } = req;\n  if (models.length === 0) return () => undefined;\n  const byService = new Map(models.map((m) => [m.service, m]));\n  const resolve = serviceResolver(bindEls);\n  return (parentId: string): ExtendingModel | undefined => {\n    if (parentId === \"\") return undefined;\n    // Walk up until the chain reaches an id the map's namespace already holds.\n    // Everything below that point has to be a declaration this delta ADDS —\n    // a child of a container the same delta introduces, or the new service\n    // element itself — because those ids will exist once the merge lands.\n    for (const a of ancestorIds(parentId)) {\n      if (living.has(a) || declared.has(a)) break;\n      if (!added.has(a)) return undefined;\n    }\n    return byService.get(resolve(parentId));\n  };\n}\n"]}

package/dist/core/c4/splice/landscape-merge.js

@@ -1,11 +1,17 @@
-import { loadSource } from "../likec4.js";
+import { parentIdOf } from "../../kernel/ids/fqn/ancestors.js";
+import { errorText, loadSource } from "../likec4.js";
+import { firstUnlocated, unlocatedReason } from "../locate/unlocated.js";
 import { elementService, serviceOf } from "../resolve/service.js";
-import { scanModel } from "../source-scan.js";
-import { spliceSource } from "./authored-source.js";
-import { LandscapeSpliceError } from "./contract.js";
+import { kindsDeclared, scanModel } from "../source-scan.js";
+import { matchLineEndings, spliceSource } from "./authored-source.js";
+import { assertSpliceVisible, LandscapeSpliceError, } from "./contract.js";
 import { assertMergeableDelta } from "./delta-blocks.js";
-import { relKey, relSortKey } from "./identity/edges.js";
-import { elementSpot, nestedInsert, relSpot, topStatements, } from "./placement.js";
+import { relSortKey, relStatementKey, scannedStatementKey } from "./identity/edges.js";
+import { newAdditions } from "./identity/existing.js";
+import { planInteriors } from "./identity/interior.js";
+import { ownerOf } from "./identity/owner.js";
+import { elementSpot, relSpot, topStatements } from "./placement.js";
+import { nestedInsert } from "./text/spot.js";
 /* ------------------------------------------------------------------ */
 /* Merging                                                             */
 /* ------------------------------------------------------------------ */
@@ -33,20 +39,40 @@ import { elementSpot, nestedInsert, relSpot, topStatements, } from "./placement.
  * dotted id at top level, which LikeC4 rejects. The additions carry no marker
  * comment: which archive added what is the git history's to say.
  *
- * Existence is checked semantically against the parsed landscape (by element
- * id/title and by edge identity), so re-archiving is idempotent and title
- * strings appearing elsewhere in the source cause no false skips. Assumes the
- * delta reuses the landscape's element identifiers for existing services. A
- * title match whose two sides are BOTH bound to different services is not an
- * existence hit but a collision, and refuses the archive (see the guard).
+ * Existence is checked semantically against the parsed landscape AND against
+ * every extending model the request carries (by element id/title and by edge
+ * identity), so re-archiving is idempotent whichever document the additions
+ * landed in — `./identity/existing.ts` holds that phase and its two joins, and
+ * this function only turns the collision it reports into the refusal.
  *
  * Splicing is text surgery, so the computed result is PARSED before it is
  * returned: a merged landscape LikeC4 rejects refuses the archive at plan time
  * (merge-failed, nothing written — the unparseable-delta discipline) instead
  * of landing in the living docs.
+ *
+ * NOT EVERYTHING LANDS HERE. A service whose model EXTENDS this map owns its
+ * own interior, and an addition nested under such a service is ROUTED to that
+ * model instead (`./identity/owner.ts` decides, `./model/merge.ts` splices).
+ * Until it was, a delta's container landed in the map and the service was
+ * `c4.invalid` — a duplicate declaration — the moment its model wrote the same
+ * container, which is exactly what the adopt brief tells it to do
+ * (verification 2026-09-04, E1). With no extending models in the request this
+ * function behaves as it always did.
+ *
+ * Routing per ADDITION is not the whole of it, because a service the feature
+ * INTRODUCES carries its interior in one element's authored bytes and those
+ * children carry no feature tag of their own. `./identity/interior.ts` decides, once
+ * per such block, whether it hands that interior to the model — cut out of what
+ * lands on the map — or rides whole; the routing below DEFERS to that decision
+ * for everything written inside the block, which is what keeps the two from
+ * placing the same child twice.
  */
 export async function planLandscapeMerge(merge) {
     const { landscapeText: text, deltaText, deltaElements, newEls, newRels, featureId } = merge;
+    const models = merge.models ?? [];
+    // What every extending model borrows from this map: its kinds, without which
+    // a model's scan reads `container outbox` and `a .delivers b` as property lines.
+    const borrowed = kindsDeclared(text);
     // First, and before the early return for "nothing to add": a block this merge
     // cannot carry is lost whether or not the delta also has tagged elements to
     // splice. See delta-blocks.ts.
@@ -55,65 +81,44 @@ export async function planLandscapeMerge(merge) {
     if (land.errors.length > 0) {
         throw new LandscapeSpliceError(`landscape.likec4 has ${land.errors.length} error(s) — fix it before archiving`);
     }
-    const haveIds = new Set(land.elements.map((e) => e.id));
-    // The title join needs the matched element back, not just membership: the
-    // cross-service guard below compares service BINDINGS across the join.
-    const byTitle = new Map();
-    const seeTitle = (el) => {
-        byTitle.set(el.title, [...(byTitle.get(el.title) ?? []), el]);
-    };
-    for (const el of land.elements)
-        seeTitle(el);
-    const addedEls = [];
-    for (const e of newEls) {
-        if (haveIds.has(e.id))
-            continue;
-        const sameTitle = byTitle.get(e.title);
-        if (sameTitle !== undefined) {
-            // A title match is the id-less fallback join, and skipping on it is only
-            // safe when the two sides could be the same box. When both sides carry an
-            // explicit `metadata { service }` binding and every binding disagrees,
-            // they are provably DIFFERENT services' boxes sharing a title ('API',
-            // 'Database') — the skip would silently drop the addition, and any delta
-            // edge into it would then refuse the whole archive at the parse net
-            // below with a message about nothing. Refuse here instead, at plan time,
-            // naming both sides.
-            if (e.service !== undefined && sameTitle.every((m) => m.service !== undefined && m.service !== e.service)) {
-                const m = sameTitle[0];
-                throw new LandscapeSpliceError(`the delta's '${e.id}' (bound to service '${e.service}') shares the title '${e.title}' with '${m.id}' (bound to service '${m.service}') — a title join across services would silently drop the addition; ` +
-                    `retitle one of them, or reuse the id '${m.id}' if they really are the same element`);
-            }
-            // KNOWN (narrowed by the guard above): with EITHER side unbound the title
-            // join stays trusting — the unbound title-fallback is the legal legacy
-            // pattern — so a cross-service collision hiding behind an unbound element
-            // is still silently skipped here. Scoping titles per service is backlog.
-            continue;
-        }
-        haveIds.add(e.id);
-        seeTitle(e);
-        addedEls.push(e);
-    }
-    // Edges are matched by COUNT, not by membership: two edges the model cannot tell
-    // apart are still two edges, and dropping the second one silently loses a call
-    // the author drew. An edge already in the landscape consumes one delta edge of
-    // the same identity, which is what keeps re-archiving idempotent.
-    const have = new Map();
-    for (const r of land.relationships) {
-        const k = relKey(land.elements, r);
-        have.set(k, (have.get(k) ?? 0) + 1);
+    // Service binding for the existence joins AND for routing and placement:
+    // living elements first (they win a shared id), the delta's after — a spliced
+    // statement's id resolves to its service the moment its bytes land in the scan.
+    const bindEls = [...land.elements, ...deltaElements.filter((d) => !land.elements.some((l) => l.id === d.id))];
+    // What the living fleet already has — the map AND every extending model, by id
+    // and by title. `./identity/existing.ts` holds both joins and their asymmetry.
+    const added = newAdditions({
+        livingEls: land.elements,
+        livingRels: land.relationships,
+        bindEls,
+        deltaElements,
+        candidates: { els: newEls, rels: newRels },
+        models,
+        borrowed,
+    });
+    if (added.collision !== undefined) {
+        const { addition: e, living: m } = added.collision;
+        throw new LandscapeSpliceError(`the delta's '${e.id}' (bound to service '${e.service}') shares the title '${e.title}' with '${m.id}' (bound to service '${m.service}') — a title join across services would silently drop the addition; ` +
+            `retitle one of them, or reuse the id '${m.id}' if they really are the same element`);
     }
-    const addedRels = [];
-    for (const r of newRels) {
-        const k = relKey(deltaElements, r);
-        const n = have.get(k) ?? 0;
-        if (n > 0) {
-            have.set(k, n - 1);
-            continue;
-        }
-        addedRels.push(r);
+    const addedEls = added.els;
+    const addedRels = added.rels;
+    const owner = ownerOf({
+        bindEls,
+        living: new Set(land.elements.map((e) => e.id)),
+        declared: added.declaredIds,
+        added: new Set(addedEls.map((e) => e.id)),
+        models,
+    });
+    // Nothing to add: the same shape the merge returned before routing existed,
+    // and the reason it is decided HERE rather than after the loops below — a
+    // no-op archive must not have to scan the delta, nor answer the landscape
+    // guards further down, which refuse documents this merge is not touching.
+    // Equivalent to the old "nothing reached the map and nothing was routed":
+    // every addition ends up in one of those two, so an empty pair means both.
+    if (addedEls.length === 0 && addedRels.length === 0) {
+        return { content: null, addedEls: [], addedRels: [], models: [] };
     }
-    if (addedEls.length === 0 && addedRels.length === 0)
-        return { content: null, addedEls, addedRels };
     const scan = scanModel(deltaText);
     if (scan === null) {
         throw new LandscapeSpliceError("delta.likec4 has no model block — nothing to splice the additions from");
@@ -123,6 +128,62 @@ export async function planLandscapeMerge(merge) {
     // parent is itself new is recognised as riding inside the parent's text and
     // is never inserted twice.
     const byId = new Map(scan.elements.map((e) => [e.id, e]));
+    // Relationships: match each parsed addition back to its statement in the
+    // delta source — full identity (`relStatementKey`), consumed one statement
+    // per addition so duplicates stay duplicates. Built before the routing
+    // because routing has to know WHERE an edge was written: one drawn inside a
+    // block that rides whole is already on the map. A statement is keyed with the
+    // tags its kind gives it, which the parsed addition carries and its text does not.
+    const pool = new Map();
+    for (const s of scan.rels) {
+        const k = scannedStatementKey(s, merge.deltaKindTags ?? {});
+        pool.set(k, [...(pool.get(k) ?? []), s]);
+    }
+    const interiors = planInteriors({ scan, deltaElements, owner, addedEls });
+    const routed = new Map();
+    const into = (model) => {
+        const existing = routed.get(model.path);
+        if (existing !== undefined)
+            return existing;
+        const fresh = { model, els: [], rels: [], borrowed };
+        routed.set(model.path, fresh);
+        return fresh;
+    };
+    for (const share of interiors.routed)
+        into(share.model).els.push(...share.els);
+    const mapEls = [];
+    for (const e of addedEls) {
+        const src = byId.get(e.id);
+        // Written inside a block that has already decided: a split block handed it
+        // to the model with its siblings, and a whole one carries it onto the map
+        // in the parent's own bytes, where the splice loop's `rides` finds it. Both
+        // are placed exactly once, which is the point of asking the block first.
+        const fate = src === undefined ? null : interiors.covering(src);
+        if (fate === "split")
+            continue;
+        const model = fate === "whole" ? undefined : owner(parentIdOf(e.id));
+        if (model === undefined)
+            mapEls.push(e);
+        else
+            into(model).els.push(e);
+    }
+    const mapRels = [];
+    for (const r of addedRels) {
+        // An edge written inside a block that rides whole names its endpoints by
+        // their LOCAL names and reads only there; it stays with its block.
+        const stmts = pool.get(relStatementKey(r)) ?? [];
+        const inBlock = stmts.length > 0 && stmts.every((s) => interiors.covering(s) !== null);
+        // Otherwise the SOURCE decides: a call is drawn where the caller draws its
+        // calls, and only when the source is not itself interior does the target's
+        // owner get the edge. A service-level edge belongs to neither and stays on
+        // the map.
+        const model = inBlock ? undefined : owner(parentIdOf(r.source)) ?? owner(parentIdOf(r.target));
+        if (model === undefined)
+            mapRels.push(r);
+        else
+            into(model).rels.push(r);
+    }
+    const touchesMap = mapEls.length > 0 || mapRels.length > 0;
     const spliced = [];
     const rides = (start, end) => spliced.some((r) => start >= r.start && end <= r.end);
     // The living model, scanned on MASKED source (scanModel) and RE-SCANNED
@@ -137,10 +198,6 @@ export async function planLandscapeMerge(merge) {
     // LikeC4, so the parse net below would pass a landscape containing none of
     // the architecture).
     let content = text;
-    // Service binding for placement: living elements first (they win a shared
-    // id), the delta's after — a spliced statement's id resolves to its service
-    // the moment its bytes land in the scan.
-    const bindEls = [...land.elements, ...deltaElements.filter((d) => !land.elements.some((l) => l.id === d.id))];
     let livingScan = scanModel(content);
     let stmts = livingScan === null ? [] : topStatements(livingScan, bindEls);
     const rescan = () => {
@@ -155,16 +212,19 @@ export async function planLandscapeMerge(merge) {
     // Built fresh at every use, never captured: `content` and `stmts` are rebound
     // by each rescan, and a region assembled before a splice describes a document
     // that no longer exists.
-    const modelRegion = () => ({ text: content, stmts, close: requireModel().close });
-    const applyAt = (at, insert) => {
+    const modelRegion = () => ({ text: content, stmts, blocks: requireModel().blocks });
+    // Every insert must be one the next scan sees (`assertSpliceVisible`).
+    const applyAt = (at, insert, what) => {
+        const before = livingScan;
         content = content.slice(0, at) + insert + content.slice(at);
         rescan();
+        assertSpliceVisible(before, livingScan, what);
     };
-    const applyTop = (spot, block) => {
+    const applyTop = (spot, block, what) => {
         // A bare spot shares its line with other text (the closing brace, or a
         // statement the block displaces) — it brings its own newlines; a
         // line-start spot slots between lines.
-        applyAt(spot.at, spot.bare ? `\n${block}\n` : `${block}\n`);
+        applyAt(spot.at, spot.bare ? `\n${block}\n` : `${block}\n`, what);
     };
     // Placement walks the scanned statement layout, so a declaration the scan
     // cannot see is one placement would blindly splice around — LikeC4 accepts
@@ -173,15 +233,19 @@ export async function planLandscapeMerge(merge) {
     // element bound to its service would miss its neighborhood, and a bodyless
     // parent gaining a body could wrap the wrong declaration. Refuse
     // mechanically (the parse-net discipline) instead of splicing blind.
+    //
+    // THAT something is unlocated is decided here, from the parse already in
+    // hand; WHAT and why is `firstUnlocated`'s, at the price of a second parse on
+    // this path alone. The message used to guess "most often two declarations
+    // sharing one line" whatever the map held, and a fleet read it over a
+    // declaration on a line of its own in a second `model { }` block the scan
+    // did not read then (2026-10): it names LikeC4's line now, and a shared line
+    // only when that line shows one.
     if (livingScan !== null) {
         const seen = new Set(livingScan.elements.map((e) => e.id));
-        const invisible = land.elements.find((e) => !seen.has(e.id));
-        if (invisible !== undefined) {
-            throw new LandscapeSpliceError(`landscape.likec4 declares '${invisible.id}' in a form placement cannot locate — most often two declarations sharing one line; give each its own line, then re-run`);
-        }
-        if (livingScan.rels.length < land.relationships.length) {
-            throw new LandscapeSpliceError(`landscape.likec4 declares ${land.relationships.length} relationship(s) but placement can locate only ${livingScan.rels.length} — most often two statements sharing one line; give each its own line, then re-run`);
-        }
+        const blind = land.elements.some((e) => !seen.has(e.id)) || livingScan.rels.length < land.relationships.length;
+        if (blind)
+            throw new LandscapeSpliceError(unlocatedReason("landscape.likec4", await firstUnlocated(text, livingScan)));
     }
     const livingParentOf = (parentId) => {
         if (livingScan === null)
@@ -199,7 +263,7 @@ export async function planLandscapeMerge(merge) {
     };
     // Ancestors first: a spliced parent covers its children before they are seen.
     const depth = (id) => id.split(".").length;
-    const sortedEls = [...addedEls].sort((a, b) => depth(a.id) - depth(b.id) || (byId.get(a.id)?.start ?? 0) - (byId.get(b.id)?.start ?? 0));
+    const sortedEls = [...mapEls].sort((a, b) => depth(a.id) - depth(b.id) || (byId.get(a.id)?.start ?? 0) - (byId.get(b.id)?.start ?? 0));
     for (const e of sortedEls) {
         const src = byId.get(e.id);
         if (src === undefined) {
@@ -207,10 +271,15 @@ export async function planLandscapeMerge(merge) {
         }
         if (rides(src.start, src.end))
             continue;
+        // Every split block's children, whichever block they belong to:
+        // `spliceSource` keeps only the ranges that fall inside the bytes it is
+        // carrying, so a block riding inside ANOTHER new block still loses its own
+        // interior on the way to the map.
+        const omit = interiors.omit;
         const dot = e.id.lastIndexOf(".");
         if (dot === -1) {
             const spot = elementSpot(modelRegion(), e.id, elementService(e));
-            applyTop(spot, spliceSource(deltaText, src, featureId, "  "));
+            applyTop(spot, spliceSource(deltaText, src, { featureId, indent: "  ", omit }), e.id);
             spliced.push({ start: src.start, end: src.end });
             continue;
         }
@@ -219,24 +288,14 @@ export async function planLandscapeMerge(merge) {
         if (parent === null) {
             throw new LandscapeSpliceError(`'${e.id}' nests under '${parentId}', which is neither in the living landscape nor added by this delta — there is nowhere to insert it`);
         }
-        const nested = nestedInsert(content, parent, spliceSource(deltaText, src, featureId, parent.indent + "  "));
-        applyAt(nested.at, nested.insert);
+        const nested = nestedInsert(content, parent, spliceSource(deltaText, src, { featureId, indent: parent.indent + "  ", omit }));
+        applyAt(nested.at, nested.insert, e.id);
         spliced.push({ start: src.start, end: src.end });
     }
-    // Relationships: match each parsed addition back to its statement in the
-    // delta source — full identity (endpoints, title, all three spine keys,
-    // tags), consumed one statement per addition so duplicates stay duplicates.
-    // The spine keys earn their place here the same way they do in `relKey`:
-    // without them two additions differing only by `publishes` share one pool
-    // entry, and `shift()` hands the second one the first one's authored bytes.
-    const relKeyOf = (r) => JSON.stringify([r.source, r.target, r.title ?? "", r.op ?? "", r.publishes ?? "", r.consumes ?? "", [...r.tags].sort()]);
-    const pool = new Map();
-    for (const s of scan.rels) {
-        const k = relKeyOf(s);
-        pool.set(k, [...(pool.get(k) ?? []), s]);
-    }
-    for (const r of addedRels) {
-        const s = pool.get(relKeyOf(r))?.shift();
+    // Each map-bound addition takes its statement out of the pool built above:
+    // one statement per addition, so duplicates stay duplicates.
+    for (const r of mapRels) {
+        const s = pool.get(relStatementKey(r))?.shift();
         if (s === undefined) {
             throw new LandscapeSpliceError(`cannot locate the '${r.source} -> ${r.target}' relationship in delta.likec4 — the landscape merge splices authored source, and no matching declaration was found`);
         }
@@ -248,22 +307,31 @@ export async function planLandscapeMerge(merge) {
         // safety-netted by the re-parse below), never which service a check
         // grades.
         const spot = relSpot(modelRegion(), serviceOf(deltaElements, r.source), key);
-        applyTop(spot, spliceSource(deltaText, s, featureId, "  "));
+        applyTop(spot, spliceSource(deltaText, s, { featureId, indent: "  " }), `${r.source} -> ${r.target}`);
     }
     // The safety net: prove the computed landscape parses before anything is
     // written. Splice bugs — and legal inputs the living document cannot absorb,
     // like a kind its specification never declares — refuse here, at plan time,
-    // instead of corrupting the one file the whole fleet reads.
-    const check = await loadSource(content);
-    if (check.errors.length > 0) {
-        const detail = check.errors
-            .slice(0, 3)
-            .map((e) => (typeof e.line === "number" ? `L${e.line}: ${e.message}` : e.message))
-            .join("; ");
-        throw new LandscapeSpliceError(`the merged landscape would not parse (${check.errors.length} error(s): ${detail}) — nothing was written. ` +
-            `The delta's additions do not fit the living landscape as authored — most often an element kind or tag ` +
-            `its specification block does not declare; fix the landscape's specification or the delta, then re-run`);
+    // instead of corrupting the one file the whole fleet reads. Skipped when
+    // every addition was routed away: the text is the one already parsed above,
+    // and the models get their own net from the caller, which is the only side
+    // that can stage a model beside the map it extends.
+    // The splice composed bytes from two documents, and the delta's newlines are
+    // not necessarily the map's. Corrected before the net, so what is proven is
+    // what would be written.
+    content = matchLineEndings(text, content);
+    if (touchesMap) {
+        const check = await loadSource(content);
+        if (check.errors.length > 0) {
+            const detail = check.errors
+                .slice(0, 3)
+                .map(errorText)
+                .join("; ");
+            throw new LandscapeSpliceError(`the merged landscape would not parse (${check.errors.length} error(s): ${detail}) — nothing was written. ` +
+                `The delta's additions do not fit the living landscape as authored — most often an element kind or tag ` +
+                `its specification block does not declare; fix the landscape's specification or the delta, then re-run`);
+        }
     }
-    return { content, addedEls, addedRels };
+    return { content: touchesMap ? content : null, addedEls: mapEls, addedRels: mapRels, models: [...routed.values()] };
 }
 //# sourceMappingURL=landscape-merge.js.map