@ybotok/loam 0.2.0-alpha.4 → 0.2.0-alpha.6

package/dist/commands/subsystem/txn/exclude.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exclude.js","sourceRoot":"","sources":["../../../../src/commands/subsystem/txn/exclude.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAgB,MAAM,kCAAkC,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,EAAE,SAAS,EAAqB,MAAM,iCAAiC,CAAC;AAgB/E,+FAA+F;AAC/F,MAAM,CAAC,MAAM,UAAU,GAAgB;IACrC,OAAO,EAAE,KAAK;IACd,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,EAAE;IACT,OAAO,EAAE,EAAE;IACX,KAAK,EAAE,IAAI;IACX,UAAU,EAAE,KAAK;CAClB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAgB,EAChB,QAAkC,EAClC,MAA+C;IAE/C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACjE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,2EAA2E;IAC3E,kEAAkE;IAClE,+DAA+D;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE;QACxC,UAAU;QACV,SAAS;QACT,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;KACxD,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;IACpF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC;IAC1F,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,OAAO,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACtF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,MAAM;QACf,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC3D,2EAA2E;QAC3E,mEAAmE;QACnE,4EAA4E;QAC5E,yEAAyE;QACzE,yDAAyD;QACzD,KAAK,EAAE,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC;QACjD,UAAU,EAAE,KAAK;KAClB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,oBAAoB,CAAC,OAAgB,EAAE,OAA0B;IAC9E,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,kBAAkB;QAClB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC","sourcesContent":["/**\n * The ROOT `likec4.config.json`'s `exclude` list, as `loam subsystem sync`\n * derives it from the shapes on disk.\n *\n * It sits beside `./views.ts` for that module's reason and by the same seam:\n * both answer \"what should this renderer-only file say, given the tree?\", both\n * are pure derivations one command writes, and keeping them together is what\n * stops the writer and the grader spelling one rule twice. The difference is\n * ownership, and it is stated in `core/c4/service-model/renderer.ts`: every byte\n * of the generated views file is loam's, while this file is the team's and loam\n * maintains exactly the `services/` entries in it. What an entry COVERS is\n * `core/c4/root-project/exclude.ts`'s question, asked of the directory the entry\n * names rather than of its spelling.\n *\n * It is a module rather than three functions in `../sync.ts` because that file\n * reached its line limit carrying them, and this is the phase boundary inside\n * it: `sync.ts` is the lock, the transaction and the report; this is one of the\n * three things it decides to write.\n */\nimport { readFile } from \"node:fs/promises\";\nimport { excludingEntry, parseRootProject, readRootExclude } from \"../../../core/c4/root-project/exclude.js\";\nimport { standaloneExclude } from \"../../../core/c4/service-model/renderer.js\";\nimport { serviceTreePath, type DocsDir } from \"../../../core/kernel/ids/dirs.js\";\nimport { rootProjectPath } from \"../../../core/repo/paths.js\";\nimport type { SurveyedModel } from \"../../../core/repo/tree/render/projects.js\";\nimport type { WalkedService } from \"../../../core/repo/tree/walk.js\";\nimport { planWrite, type PlannedWrite } from \"../../../core/staging/writes.js\";\n\n/** What one sync did to the ROOT project's `exclude` list. */\nexport interface ExcludePlan {\n  /** Whether this run rewrites the list. */\n  updated: boolean;\n  /** The list as it stands after this run — the current one when nothing changed. */\n  entries: string[];\n  added: string[];\n  removed: string[];\n  /** The rewrite, staged with everything else. Null when nothing is owed. */\n  write: PlannedWrite | null;\n  /** The root file exists and loam could not read an `exclude` list out of it — reported, never rewritten. */\n  unreadable: boolean;\n}\n\n/** The answer for a run that has no root file to read, and the shape every other arm fills. */\nexport const NO_EXCLUDE: ExcludePlan = {\n  updated: false,\n  entries: [],\n  added: [],\n  removed: [],\n  write: null,\n  unreadable: false,\n};\n\n/**\n * The root project's `exclude` list, recomputed from the shapes on disk.\n *\n * WHAT MAKES THIS SAFE TO RUN ON EVERY SYNC is the split `standaloneExclude`\n * enforces: the `services/` half of the list is loam's and every other entry is\n * the team's, kept in order. The scaffold's node_modules glob, `features/**`, a\n * team's own `drafts/**` all survive; only the entries that decide whether a\n * model is renderable are derived. A standalone model MUST be excluded (inside\n * the root project every kind it declares is a duplicate blamed on the map as\n * well) and an extending model must NOT be (the root project is the only place\n * it parses), so a service that migrates from one shape to the other has its\n * entry added or dropped on the next sync instead of quietly blanking a project.\n *\n * THE GATE keeps an old repository untouched. A fleet whose models all stand\n * alone and whose root already says `services/**` is already correct, and\n * rewriting it into one entry per service would be a diff with no fact behind\n * it — so the rewrite happens only when at least one model extends the map (the\n * blanket exclusion is then wrong) or some standalone model is not covered at\n * all (the renderer is merging it into the map right now). Comparing the parsed\n * ARRAYS rather than the bytes is the second half of the same rule: a file whose\n * `exclude` already says what this run would write is left exactly as the team\n * formatted it.\n *\n * A root config loam cannot read an `exclude` list out of is REPORTED and never\n * rewritten. Guessing at the JSON a team hand-wrote is how a writer destroys a\n * file it did not understand.\n */\nexport async function planExclude(\n  docsDir: DocsDir,\n  services: readonly WalkedService[],\n  models: readonly SurveyedModel<WalkedService>[],\n): Promise<ExcludePlan> {\n  const current = await readRootExclude(docsDir);\n  if (current === null) return { ...NO_EXCLUDE, unreadable: true };\n  const standalone = models.filter((m) => m.standalone).map((m) => serviceTreePath(m.service));\n  // Both halves of the shape scan travel, not just the standalone one: an entry\n  // is loam's to take back either because loam wrote it (a tree the enumeration\n  // returns) or because it HIDES a model that only parses in the root project,\n  // and only the extending list can answer the second question. Without it a\n  // subsystem-wide `services/platform/**` survived every sync while\n  // `service.model-excluded` named that same sync as the repair.\n  const extending = models.filter((m) => !m.standalone).map((m) => serviceTreePath(m.service));\n  const wanted = standaloneExclude(current, {\n    standalone,\n    extending,\n    enumerated: services.map((svc) => serviceTreePath(svc)),\n  });\n  const uncovered = standalone.some((tree) => excludingEntry(current, tree) === null);\n  if (extending.length === 0 && !uncovered) return { ...NO_EXCLUDE, entries: [...current] };\n  if (current.length === wanted.length && current.every((entry, i) => entry === wanted[i])) {\n    return { ...NO_EXCLUDE, entries: wanted };\n  }\n  const bytes = await rewrittenRootProject(docsDir, wanted);\n  if (bytes === null) return { ...NO_EXCLUDE, entries: [...current], unreadable: true };\n  return {\n    updated: true,\n    entries: wanted,\n    added: wanted.filter((entry) => !current.includes(entry)),\n    removed: current.filter((entry) => !wanted.includes(entry)),\n    // `planWrite` decides create-vs-overwrite from the filesystem, so the root\n    // file — which by definition already exists here — is staged as an\n    // OVERWRITE, and `swapStaged` compares it against its pre-image immediately\n    // before the rename: a team member editing the same file during the sync\n    // stops the commit instead of having their bytes buried.\n    write: planWrite(rootProjectPath(docsDir), bytes),\n    unreadable: false,\n  };\n}\n\n/**\n * The root project file with its `exclude` replaced and NOTHING else touched —\n * every other key kept, in the order the team wrote them, re-serialised as\n * 2-space JSON with a trailing newline (`core/docs.ts`'s own form, so a\n * scaffolded file round-trips byte for byte).\n *\n * Null when the file stopped being a JSON object between `readRootExclude` and\n * here, which is a concurrent edit rather than a state loam may write over.\n */\nasync function rewrittenRootProject(docsDir: DocsDir, exclude: readonly string[]): Promise<string | null> {\n  let text: string;\n  try {\n    text = await readFile(rootProjectPath(docsDir), \"utf8\");\n  } catch {\n    // Unreadable is not \"excludes nothing\": the caller reports it and writes\n    // nothing at all.\n    return null;\n  }\n  // The SAME parse the grader read the list with — `parseRootProject`, which\n  // tolerates the byte-order mark PowerShell's `Out-File` writes. Two parses\n  // would mean a run that read an `exclude` here and then declared the file\n  // unreadable at the write, which is exactly what a BOM produced before\n  // (re-verification 2026-09-04, area C item 3). Re-read rather than carried:\n  // the point of this read is that it happens immediately before the swap.\n  const parsed = parseRootProject(text);\n  if (parsed === null) return null;\n  return `${JSON.stringify({ ...parsed, exclude: [...exclude] }, null, 2)}\\n`;\n}\n"]}

package/dist/commands/subsystem/txn/report.js

@@ -0,0 +1,124 @@
+/**
+ * What one `loam subsystem sync` SAYS it did — the `--json` envelope and the
+ * human lines, in one place.
+ *
+ * It sits beside `./views.ts` and `./exclude.ts` because it is the third answer
+ * about the same three files, and it moved out of `../sync.ts` for that file's
+ * standing reason: `sync.ts` is the lock, the transaction and the plan, and it
+ * reached the 400-line limit carrying the output too. Composing a report is not
+ * a phase of the commit, so nothing here reads the disk or decides anything — a
+ * caller hands over what happened and this spells it.
+ */
+import { emitJson } from "../../../core/envelope/json.js";
+import { LANDSCAPE_UNREADABLE_NOTE } from "./views.js";
+export function reportSync(json, out) {
+    // One reason today, and it is exactly the `action` it explains — spelled as a
+    // record so a second cause is an added value rather than a re-read of the
+    // sentence a person sees.
+    const blocked = out.action === "blocked" ? { reason: "landscape-invalid" } : null;
+    if (json) {
+        emitJson({
+            command: "subsystem",
+            path: "architecture/subsystems.likec4",
+            action: out.action,
+            subsystems: out.subsystems,
+            ...(blocked === null ? {} : { blocked }),
+            ...(out.recovered === null ? {} : { recovered: out.recovered }),
+            projects: {
+                root: out.projects.root,
+                created: out.projects.created,
+                removed: out.projects.removed,
+                current: out.projects.current,
+                // Additive, and emitted in every mode including the untouched one: a
+                // consumer must be able to read what the root project now excludes
+                // without branching on whether this run happened to change it.
+                //
+                // `unreadable` travels with it because `entries: []` alone collapses the
+                // two answers `readRootExclude` insists must stay apart — "the file
+                // excludes nothing" and "loam could not read the file" are opposite
+                // facts about what the renderer will load, and the text view had the
+                // distinction while `--json` did not (verification 2026-09-04, review C).
+                exclude: {
+                    updated: out.projects.exclude.updated,
+                    entries: out.projects.exclude.entries,
+                    added: out.projects.exclude.added,
+                    removed: out.projects.exclude.removed,
+                    unreadable: out.projects.exclude.unreadable,
+                },
+            },
+        });
+        return;
+    }
+    if (out.recovered !== null && out.recovered.outcome !== "consistent") {
+        console.log(`note: recovered an interrupted \`loam ${out.recovered.command}\` commit first (${out.recovered.outcome}).`);
+    }
+    console.log(views(out));
+    // Owed on BOTH arms: the run that declined to rewrite an existing file, and
+    // the run that wrote the tolerant shape because there was none to protect.
+    if (out.mapUnreadable)
+        console.log(LANDSCAPE_UNREADABLE_NOTE);
+    projects(out.projects);
+    exclude(out.projects);
+}
+/** The one line about the generated views file. */
+function views(out) {
+    // "nothing to write" is a claim about the WHOLE run, and it is false the moment
+    // any of this verb's three writers landed something beside a current views
+    // file: a project file created, one removed, or the root `exclude` rewritten.
+    // The third was missed when it was added, so the tail contradicted the very
+    // next line of output (verification 2026-09-04, review C).
+    const quiet = out.projects.created.length === 0 && out.projects.removed.length === 0 && !out.projects.exclude.updated;
+    const sentence = {
+        current: `architecture/subsystems.likec4 is current (${out.subsystems} subsystem(s))${quiet ? " — nothing to write." : "."}`,
+        created: `wrote architecture/subsystems.likec4 — ${out.subsystems} subsystem view(s).`,
+        updated: `updated architecture/subsystems.likec4 — ${out.subsystems} subsystem view(s).`,
+        removed: `removed architecture/subsystems.likec4 — the tree has no subsystems, so the generated file must be absent.`,
+        blocked: "architecture/subsystems.likec4 left as it is — architecture/ does not parse as one project, so the " +
+            "render's element join is the landscape file's alone (a use-case document that binds an element of its " +
+            "own is not in it), and rewriting the file would take its `include` lines with it.",
+    };
+    return sentence[out.action];
+}
+/** The per-service project files this run created and removed. */
+function projects(out) {
+    if (out.created.length > 0) {
+        console.log(`wrote ${out.created.length} services/<…>/likec4.config.json — one LikeC4 project per service model whose ` +
+            "model stands alone (an existing file is yours and is never rewritten; commit the new ones before a " +
+            "`loam subsystem move`, which refuses over untracked paths). With more than one project, " +
+            "likec4 validate at the docs root needs --project <name>; build and export take every project.");
+    }
+    // Named one per line: this is a DELETE of a file a team may have written, and
+    // a count would leave a reader nothing to check against their own diff.
+    for (const path of out.removed)
+        console.log(`removed ${path}`);
+    if (out.removed.length > 0) {
+        console.log("— that model extends the fleet map, and a project file beside it registers a second renderer project " +
+            "rooted at the service directory: `likec4 validate .` then refuses without `--project`, and wherever " +
+            "that project claims the model it loads it alone, where the map's kinds are not, and the fleet project " +
+            "loses the service's interior. This is what `service.likec4-config-stray` names.");
+    }
+    if (!out.root && out.modelled > 0) {
+        console.log("note: no likec4.config.json at the docs root, so no service project files were written — " +
+            "`loam doctor` prints the root file.");
+    }
+}
+/** The root project's `exclude`, and the one state loam refuses to touch. */
+function exclude(out) {
+    const plan = out.exclude;
+    if (plan.updated) {
+        // Named entries rather than a count: this line is the whole record of a
+        // rewrite to a file the team owns, and "updated the exclude list" gives a
+        // reader nothing to check against their own diff.
+        const parts = [
+            ...(plan.added.length > 0 ? [`+${plan.added.join(" +")}`] : []),
+            ...(plan.removed.length > 0 ? [`-${plan.removed.join(" -")}`] : []),
+        ];
+        console.log(`rewrote likec4.config.json's \`exclude\` (${parts.join(" ")}) — the root project excludes exactly the ` +
+            "models that stand alone; a model that extends the fleet map renders from the docs root and must not be excluded.");
+    }
+    if (plan.unreadable) {
+        console.log("note: likec4.config.json at the docs root is not a JSON object with a string `exclude` list, so it was " +
+            "left exactly as it is — loam does not rewrite a project file it cannot read.");
+    }
+}
+//# sourceMappingURL=report.js.map

package/dist/commands/subsystem/txn/report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../../../src/commands/subsystem/txn/report.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAG1D,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAiDvD,MAAM,UAAU,UAAU,CAAC,IAAa,EAAE,GAAe;IACvD,8EAA8E;IAC9E,0EAA0E;IAC1E,0BAA0B;IAC1B,MAAM,OAAO,GAAuB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACtG,IAAI,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC;YACP,OAAO,EAAE,WAAW;YACpB,IAAI,EAAE,gCAAgC;YACtC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;YACxC,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;YAC/D,QAAQ,EAAE;gBACR,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;gBACvB,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;gBAC7B,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;gBAC7B,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO;gBAC7B,qEAAqE;gBACrE,mEAAmE;gBACnE,+DAA+D;gBAC/D,EAAE;gBACF,yEAAyE;gBACzE,oEAAoE;gBACpE,oEAAoE;gBACpE,qEAAqE;gBACrE,0EAA0E;gBAC1E,OAAO,EAAE;oBACP,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO;oBACrC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO;oBACrC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK;oBACjC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO;oBACrC,UAAU,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU;iBAC5C;aACF;SACF,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;QACrE,OAAO,CAAC,GAAG,CACT,yCAAyC,GAAG,CAAC,SAAS,CAAC,OAAO,oBAAoB,GAAG,CAAC,SAAS,CAAC,OAAO,IAAI,CAC5G,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,GAAG,CAAC,aAAa;QAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC9D,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACxB,CAAC;AAED,mDAAmD;AACnD,SAAS,KAAK,CAAC,GAAe;IAC5B,gFAAgF;IAChF,2EAA2E;IAC3E,8EAA8E;IAC9E,4EAA4E;IAC5E,2DAA2D;IAC3D,MAAM,KAAK,GACT,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;IAC1G,MAAM,QAAQ,GAA+B;QAC3C,OAAO,EAAE,8CAA8C,GAAG,CAAC,UAAU,iBAAiB,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,GAAG,EAAE;QAC5H,OAAO,EAAE,0CAA0C,GAAG,CAAC,UAAU,qBAAqB;QACtF,OAAO,EAAE,4CAA4C,GAAG,CAAC,UAAU,qBAAqB;QACxF,OAAO,EAAE,4GAA4G;QACrH,OAAO,EACL,qGAAqG;YACrG,wGAAwG;YACxG,mFAAmF;KACtF,CAAC;IACF,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,kEAAkE;AAClE,SAAS,QAAQ,CAAC,GAAmB;IACnC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CACT,SAAS,GAAG,CAAC,OAAO,CAAC,MAAM,gFAAgF;YACzG,qGAAqG;YACrG,0FAA0F;YAC1F,+FAA+F,CAClG,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,wEAAwE;IACxE,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAC/D,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CACT,uGAAuG;YACrG,sGAAsG;YACtG,wGAAwG;YACxG,iFAAiF,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CACT,2FAA2F;YACzF,qCAAqC,CACxC,CAAC;IACJ,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,OAAO,CAAC,GAAmB;IAClC,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC;IACzB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,wEAAwE;QACxE,0EAA0E;QAC1E,kDAAkD;QAClD,MAAM,KAAK,GAAG;YACZ,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC;QACF,OAAO,CAAC,GAAG,CACT,6CAA6C,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,4CAA4C;YACtG,kHAAkH,CACrH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CACT,yGAAyG;YACvG,8EAA8E,CACjF,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["/**\n * What one `loam subsystem sync` SAYS it did — the `--json` envelope and the\n * human lines, in one place.\n *\n * It sits beside `./views.ts` and `./exclude.ts` because it is the third answer\n * about the same three files, and it moved out of `../sync.ts` for that file's\n * standing reason: `sync.ts` is the lock, the transaction and the plan, and it\n * reached the 400-line limit carrying the output too. Composing a report is not\n * a phase of the commit, so nothing here reads the disk or decides anything — a\n * caller hands over what happened and this spells it.\n */\nimport { emitJson } from \"../../../core/envelope/json.js\";\nimport type { CommitRecovery } from \"../../../core/staging/interrupted.js\";\nimport type { ExcludePlan } from \"./exclude.js\";\nimport { LANDSCAPE_UNREADABLE_NOTE } from \"./views.js\";\n\n/**\n * What one sync did to the views file — and ONLY that file; the projects report\n * separately.\n *\n * `blocked` is the fifth answer: the map cannot be read, a generated file\n * already exists, and this run left it exactly as it is. The tolerant render\n * used to run anyway and rewrote a good file down to title and description\n * (verification 2026-09-04, W5). The project half is unaffected and still runs —\n * neither the per-service files nor the root `exclude` depend on the map.\n */\nexport type SyncAction = \"current\" | \"created\" | \"updated\" | \"removed\" | \"blocked\";\n\n/** Why a run answered `blocked`. One reason today; a key rather than a bare string so a second one is additive. */\ninterface SyncBlocked {\n  reason: \"landscape-invalid\";\n}\n\n/** The additive `projects` payload key, and what the text lines are composed from. */\nexport interface ProjectsReport {\n  root: boolean;\n  /** POSIX paths relative to the DOCS ROOT, written this run, sorted by path. */\n  created: string[];\n  /**\n   * POSIX paths relative to the DOCS ROOT, DELETED this run, sorted by path — a\n   * `likec4.config.json` beside a model that extends the map. `[]` rather than\n   * absent on a run that removed none, so a consumer reads the key.\n   *\n   * SORTED BY PATH rather than by service id, which is the order the survey\n   * hands them over in: `../sync.ts` sorts both arrays where it spells them, so\n   * the `--json` list and the `removed <path>` lines below can never disagree.\n   */\n  removed: string[];\n  current: number;\n  modelled: number;\n  exclude: ExcludePlan;\n}\n\n/** Everything one run has to say, as the caller knows it. */\nexport interface SyncReport {\n  action: SyncAction;\n  subsystems: number;\n  recovered: CommitRecovery | null;\n  projects: ProjectsReport;\n  /** The map could not be read at all — the note is owed whether or not a file was protected. */\n  mapUnreadable: boolean;\n}\n\nexport function reportSync(json: boolean, out: SyncReport): void {\n  // One reason today, and it is exactly the `action` it explains — spelled as a\n  // record so a second cause is an added value rather than a re-read of the\n  // sentence a person sees.\n  const blocked: SyncBlocked | null = out.action === \"blocked\" ? { reason: \"landscape-invalid\" } : null;\n  if (json) {\n    emitJson({\n      command: \"subsystem\",\n      path: \"architecture/subsystems.likec4\",\n      action: out.action,\n      subsystems: out.subsystems,\n      ...(blocked === null ? {} : { blocked }),\n      ...(out.recovered === null ? {} : { recovered: out.recovered }),\n      projects: {\n        root: out.projects.root,\n        created: out.projects.created,\n        removed: out.projects.removed,\n        current: out.projects.current,\n        // Additive, and emitted in every mode including the untouched one: a\n        // consumer must be able to read what the root project now excludes\n        // without branching on whether this run happened to change it.\n        //\n        // `unreadable` travels with it because `entries: []` alone collapses the\n        // two answers `readRootExclude` insists must stay apart — \"the file\n        // excludes nothing\" and \"loam could not read the file\" are opposite\n        // facts about what the renderer will load, and the text view had the\n        // distinction while `--json` did not (verification 2026-09-04, review C).\n        exclude: {\n          updated: out.projects.exclude.updated,\n          entries: out.projects.exclude.entries,\n          added: out.projects.exclude.added,\n          removed: out.projects.exclude.removed,\n          unreadable: out.projects.exclude.unreadable,\n        },\n      },\n    });\n    return;\n  }\n  if (out.recovered !== null && out.recovered.outcome !== \"consistent\") {\n    console.log(\n      `note: recovered an interrupted \\`loam ${out.recovered.command}\\` commit first (${out.recovered.outcome}).`,\n    );\n  }\n  console.log(views(out));\n  // Owed on BOTH arms: the run that declined to rewrite an existing file, and\n  // the run that wrote the tolerant shape because there was none to protect.\n  if (out.mapUnreadable) console.log(LANDSCAPE_UNREADABLE_NOTE);\n  projects(out.projects);\n  exclude(out.projects);\n}\n\n/** The one line about the generated views file. */\nfunction views(out: SyncReport): string {\n  // \"nothing to write\" is a claim about the WHOLE run, and it is false the moment\n  // any of this verb's three writers landed something beside a current views\n  // file: a project file created, one removed, or the root `exclude` rewritten.\n  // The third was missed when it was added, so the tail contradicted the very\n  // next line of output (verification 2026-09-04, review C).\n  const quiet =\n    out.projects.created.length === 0 && out.projects.removed.length === 0 && !out.projects.exclude.updated;\n  const sentence: Record<SyncAction, string> = {\n    current: `architecture/subsystems.likec4 is current (${out.subsystems} subsystem(s))${quiet ? \" — nothing to write.\" : \".\"}`,\n    created: `wrote architecture/subsystems.likec4 — ${out.subsystems} subsystem view(s).`,\n    updated: `updated architecture/subsystems.likec4 — ${out.subsystems} subsystem view(s).`,\n    removed: `removed architecture/subsystems.likec4 — the tree has no subsystems, so the generated file must be absent.`,\n    blocked:\n      \"architecture/subsystems.likec4 left as it is — architecture/ does not parse as one project, so the \" +\n      \"render's element join is the landscape file's alone (a use-case document that binds an element of its \" +\n      \"own is not in it), and rewriting the file would take its `include` lines with it.\",\n  };\n  return sentence[out.action];\n}\n\n/** The per-service project files this run created and removed. */\nfunction projects(out: ProjectsReport): void {\n  if (out.created.length > 0) {\n    console.log(\n      `wrote ${out.created.length} services/<…>/likec4.config.json — one LikeC4 project per service model whose ` +\n        \"model stands alone (an existing file is yours and is never rewritten; commit the new ones before a \" +\n        \"`loam subsystem move`, which refuses over untracked paths). With more than one project, \" +\n        \"likec4 validate at the docs root needs --project <name>; build and export take every project.\",\n    );\n  }\n  // Named one per line: this is a DELETE of a file a team may have written, and\n  // a count would leave a reader nothing to check against their own diff.\n  for (const path of out.removed) console.log(`removed ${path}`);\n  if (out.removed.length > 0) {\n    console.log(\n      \"— that model extends the fleet map, and a project file beside it registers a second renderer project \" +\n        \"rooted at the service directory: `likec4 validate .` then refuses without `--project`, and wherever \" +\n        \"that project claims the model it loads it alone, where the map's kinds are not, and the fleet project \" +\n        \"loses the service's interior. This is what `service.likec4-config-stray` names.\",\n    );\n  }\n  if (!out.root && out.modelled > 0) {\n    console.log(\n      \"note: no likec4.config.json at the docs root, so no service project files were written — \" +\n        \"`loam doctor` prints the root file.\",\n    );\n  }\n}\n\n/** The root project's `exclude`, and the one state loam refuses to touch. */\nfunction exclude(out: ProjectsReport): void {\n  const plan = out.exclude;\n  if (plan.updated) {\n    // Named entries rather than a count: this line is the whole record of a\n    // rewrite to a file the team owns, and \"updated the exclude list\" gives a\n    // reader nothing to check against their own diff.\n    const parts = [\n      ...(plan.added.length > 0 ? [`+${plan.added.join(\" +\")}`] : []),\n      ...(plan.removed.length > 0 ? [`-${plan.removed.join(\" -\")}`] : []),\n    ];\n    console.log(\n      `rewrote likec4.config.json's \\`exclude\\` (${parts.join(\" \")}) — the root project excludes exactly the ` +\n        \"models that stand alone; a model that extends the fleet map renders from the docs root and must not be excluded.\",\n    );\n  }\n  if (plan.unreadable) {\n    console.log(\n      \"note: likec4.config.json at the docs root is not a JSON object with a string `exclude` list, so it was \" +\n        \"left exactly as it is — loam does not rewrite a project file it cannot read.\",\n    );\n  }\n}\n"]}

package/dist/commands/subsystem/txn/txn.js

@@ -7,6 +7,25 @@
  * the same commit as whatever changed the tree — a marker without its view,
  * or renames without theirs, is exactly the `subsystem.views-stale` state
  * the generated file's contract refuses to leave between two commits.
+ *
+ * This window does NOT write the per-service project files
+ * (`services/<…>/<id>/likec4.config.json`); only `../sync.ts` does, and the
+ * asymmetry is deliberate rather than an omission. The views file must ride
+ * in the verb's commit because its bytes depend on the PLACEMENT the verb is
+ * changing. A project file's bytes depend on the service id alone, which no
+ * verb here changes — and the file lives INSIDE the service directory, so a
+ * `move` carries it to the new location as part of the rename it already
+ * journals (in a git-backed repo that move REFUSES first, `move-uncommitted`,
+ * until the files `sync` created are committed — the refusal names them, and
+ * `sync`'s own output says to commit them), and `rm` never reaches one,
+ * because it refuses any subsystem that still holds a member
+ * (`subsystem-not-empty`, `../edit.ts`). No verb can
+ * therefore leave a project file stale or orphaned, and a verb that filled
+ * gaps in passing would silently write files a `--json` reader of `new` or
+ * `rename` was never told to expect. The one state a verb can leave is a
+ * model with no file beside it, and that is the state `validate --all` names
+ * as `service.likec4-config-missing`, with `loam subsystem sync` as the
+ * repair — one writer, so the create-only rule has one place to hold.
  */
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
@@ -20,7 +39,7 @@ import { recoverInterruptedCommit } from "../../../core/staging/recovery/recover
 import { commitStaged } from "../../../core/staging/txn/transaction.js";
 import {} from "../../../core/staging/writes.js";
 import { viewsAgree } from "../../../core/repo/tree/render/views.js";
-import { expectedViews } from "./views.js";
+import { expectedViews, LANDSCAPE_UNREADABLE_NOTE } from "./views.js";
 /** The text tail a verb's success line carries about the generated file. */
 export function reportViews(views) {
     return views === "current" ? "" : ` — architecture/subsystems.likec4 ${views}`;
@@ -57,14 +76,14 @@ export async function commitWindow(docsDir, json, plan) {
             return;
         const path = subsystemViewsPath(docsDir);
         const expected = await expectedViews(docsDir, txn.tree);
-        const bytes = expected === null ? null : Buffer.from(expected, "utf8");
+        const bytes = expected.content === null ? null : Buffer.from(expected.content, "utf8");
         // Content, not bytes — `viewsAgree` carries the reason. Without it every
         // subsystem move on a Windows clone folded a rewrite of this file into its
         // transaction that changed not one fact, and journalled it.
         const current = existsSync(path) ? await readFile(path, "utf8") : null;
         let views = "current";
         const writes = [...txn.writes];
-        if (!viewsAgree(current, expected)) {
+        if (!viewsAgree(current, expected.content)) {
             views = current === null ? "created" : bytes === null ? "removed" : "updated";
             writes.push({ path, content: bytes });
         }
@@ -86,6 +105,13 @@ export async function commitWindow(docsDir, json, plan) {
             return;
         }
         await txn.report(views, recovered);
+        // A verb CANNOT leave this file behind the tree — its bytes depend on the
+        // placement the verb just changed, so the tolerant render lands even when the
+        // map is unreadable and the file loses its includes. `sync` may decline that
+        // rewrite (`action: "blocked"`); a verb may not, so the person is told
+        // instead, and the same note names the run that puts the includes back.
+        if (!json && !expected.known)
+            console.log(LANDSCAPE_UNREADABLE_NOTE);
     }
     finally {
         await releaseLock();

package/dist/commands/subsystem/txn/txn.js.map

@@ -1 +1 @@
-{"version":3,"file":"txn.js","sourceRoot":"","sources":["../../../../src/commands/subsystem/txn/txn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,IAAI,EAAkB,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAuB,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AACxE,OAAO,EAAqB,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,yCAAyC,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAI3C,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,KAAkB;IAC5C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qCAAqC,KAAK,EAAE,CAAC;AACjF,CAAC;AAqBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,IAAa,EACb,IAAuD;IAEvD,IAAI,WAAgC,CAAC;IACrC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,aAAa,CAAC;YAAE,MAAM,GAAG,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,IAAI,SAAgC,CAAC;QACrC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,sBAAsB,CAAC;gBAAE,MAAM,GAAG,CAAC;YACxD,IAAI,CAAC,IAAI,EAAE,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO;QAEzB,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,IAAI,KAAK,GAAgB,SAAS,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnC,KAAK,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,YAAY,CAClC;YACE,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,WAAW;YACpB,KAAK,EAAE,qBAAqB;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;SACzD,EACD,MAAM,EACN,GAAG,CAAC,IAAI,CACT,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,GACR,SAAS,CAAC,IAAI,KAAK,qBAAqB;gBACtC,CAAC,CAAC,SAAS,CAAC,IAAI;gBAChB,CAAC,CAAC,SAAS,CAAC,KAAK;oBACf,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,IAAI,SAAS,CAAC,IAAI,CAAC;oBACrD,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,EAAE,CAAC;IACtB,CAAC;AACH,CAAC","sourcesContent":["/**\n * The shared commit window every subsystem WRITE verb goes through — `new`,\n * `rm`, `move` and `rename` all land here: lock, recover a predecessor's\n * journal, plan against the walked tree, regenerate the views file from the\n * PLANNED post-state, commit through the journaled transaction (directory\n * renames included), report. One window, because the views file must land in\n * the same commit as whatever changed the tree — a marker without its view,\n * or renames without theirs, is exactly the `subsystem.views-stale` state\n * the generated file's contract refuses to leave between two commits.\n */\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport type { DocsDir } from \"../../../core/kernel/ids/dirs.js\";\nimport { fail, type ErrorCode } from \"../../../core/envelope/json.js\";\nimport { subsystemViewsPath } from \"../../../core/repo/paths.js\";\nimport { listFleetTree } from \"../../../core/repo/repo.js\";\nimport type { FleetTree } from \"../../../core/repo/tree/walk.js\";\nimport { stageWrites } from \"../../../core/staging/commit.js\";\nimport { type CommitRecovery, InterruptedCommitError } from \"../../../core/staging/interrupted.js\";\nimport { acquireDocsLock, DocsBusyError } from \"../../../core/staging/lock.js\";\nimport { recoverInterruptedCommit } from \"../../../core/staging/recovery/recover.js\";\nimport { commitStaged } from \"../../../core/staging/txn/transaction.js\";\nimport { type PlannedWrite } from \"../../../core/staging/writes.js\";\nimport { viewsAgree } from \"../../../core/repo/tree/render/views.js\";\nimport { expectedViews } from \"./views.js\";\n\nexport type ViewsAction = \"created\" | \"updated\" | \"removed\" | \"current\";\n\n/** The text tail a verb's success line carries about the generated file. */\nexport function reportViews(views: ViewsAction): string {\n  return views === \"current\" ? \"\" : ` — architecture/subsystems.likec4 ${views}`;\n}\n\n/** What one subsystem verb asks the shared commit window to land. */\nexport interface SubsystemTxn {\n  /** The journal's `target` — what this commit is FOR. */\n  target: string;\n  /** Marker writes (create/delete); the views write is derived and appended. */\n  writes: PlannedWrite[];\n  /** The tree AS THE COMMIT LEAVES IT — the views file is rendered from this. */\n  tree: FleetTree;\n  /** Directory renames, performed after the swaps, in this order. */\n  moves?: { from: string; to: string }[];\n  /** Remap of a RACED commit failure (new: a lost marker create is `already-exists`). */\n  racedCode?: ErrorCode;\n  /** Remap of a rolled-back commit failure (move: `move-failed` — no merge was computed). */\n  failedCode?: ErrorCode;\n  /** The rollback sentence's verb for half-state files. */\n  what: string;\n  report: (views: ViewsAction, recovered: CommitRecovery | null) => void | Promise<void>;\n}\n\n/**\n * Lock → recover → plan → stage (views included) → journaled commit → report.\n * `plan` returning null means it already reported a refusal; nothing was\n * staged and nothing is written.\n */\nexport async function commitWindow(\n  docsDir: DocsDir,\n  json: boolean,\n  plan: (tree: FleetTree) => Promise<SubsystemTxn | null>,\n): Promise<void> {\n  let releaseLock: () => Promise<void>;\n  try {\n    releaseLock = await acquireDocsLock(docsDir);\n  } catch (err) {\n    if (!(err instanceof DocsBusyError)) throw err;\n    fail(json, \"docs-busy\", err.message);\n    return;\n  }\n  try {\n    let recovered: CommitRecovery | null;\n    try {\n      recovered = await recoverInterruptedCommit(docsDir);\n    } catch (err) {\n      if (!(err instanceof InterruptedCommitError)) throw err;\n      fail(json, \"commit-interrupted\", err.message);\n      return;\n    }\n    const txn = await plan(await listFleetTree(docsDir));\n    if (txn === null) return;\n\n    const path = subsystemViewsPath(docsDir);\n    const expected = await expectedViews(docsDir, txn.tree);\n    const bytes = expected === null ? null : Buffer.from(expected, \"utf8\");\n    // Content, not bytes — `viewsAgree` carries the reason. Without it every\n    // subsystem move on a Windows clone folded a rewrite of this file into its\n    // transaction that changed not one fact, and journalled it.\n    const current = existsSync(path) ? await readFile(path, \"utf8\") : null;\n    let views: ViewsAction = \"current\";\n    const writes = [...txn.writes];\n    if (!viewsAgree(current, expected)) {\n      views = current === null ? \"created\" : bytes === null ? \"removed\" : \"updated\";\n      writes.push({ path, content: bytes });\n    }\n    const staged = await stageWrites(writes);\n    const committed = await commitStaged(\n      {\n        root: docsDir,\n        command: \"subsystem\",\n        rerun: \"loam subsystem sync\",\n        target: txn.target,\n        ...(txn.moves === undefined ? {} : { moves: txn.moves }),\n      },\n      staged,\n      txn.what,\n    );\n    if (!committed.ok) {\n      const code =\n        committed.code === \"rollback-incomplete\"\n          ? committed.code\n          : committed.raced\n            ? (txn.racedCode ?? txn.failedCode ?? committed.code)\n            : (txn.failedCode ?? committed.code);\n      fail(json, code, committed.message);\n      return;\n    }\n    await txn.report(views, recovered);\n  } finally {\n    await releaseLock();\n  }\n}\n"]}
+{"version":3,"file":"txn.js","sourceRoot":"","sources":["../../../../src/commands/subsystem/txn/txn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,IAAI,EAAkB,MAAM,gCAAgC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAuB,sBAAsB,EAAE,MAAM,sCAAsC,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AACxE,OAAO,EAAqB,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,yCAAyC,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAItE,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,KAAkB;IAC5C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qCAAqC,KAAK,EAAE,CAAC;AACjF,CAAC;AAqBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,IAAa,EACb,IAAuD;IAEvD,IAAI,WAAgC,CAAC;IACrC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,CAAC,GAAG,YAAY,aAAa,CAAC;YAAE,MAAM,GAAG,CAAC;QAC/C,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,IAAI,SAAgC,CAAC;QACrC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,sBAAsB,CAAC;gBAAE,MAAM,GAAG,CAAC;YACxD,IAAI,CAAC,IAAI,EAAE,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QACrD,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO;QAEzB,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACvF,yEAAyE;QACzE,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,IAAI,KAAK,GAAgB,SAAS,CAAC;QACnC,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,KAAK,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,YAAY,CAClC;YACE,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,WAAW;YACpB,KAAK,EAAE,qBAAqB;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;SACzD,EACD,MAAM,EACN,GAAG,CAAC,IAAI,CACT,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,GACR,SAAS,CAAC,IAAI,KAAK,qBAAqB;gBACtC,CAAC,CAAC,SAAS,CAAC,IAAI;gBAChB,CAAC,CAAC,SAAS,CAAC,KAAK;oBACf,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,IAAI,SAAS,CAAC,IAAI,CAAC;oBACrD,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACnC,0EAA0E;QAC1E,8EAA8E;QAC9E,6EAA6E;QAC7E,uEAAuE;QACvE,wEAAwE;QACxE,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QACT,MAAM,WAAW,EAAE,CAAC;IACtB,CAAC;AACH,CAAC","sourcesContent":["/**\n * The shared commit window every subsystem WRITE verb goes through — `new`,\n * `rm`, `move` and `rename` all land here: lock, recover a predecessor's\n * journal, plan against the walked tree, regenerate the views file from the\n * PLANNED post-state, commit through the journaled transaction (directory\n * renames included), report. One window, because the views file must land in\n * the same commit as whatever changed the tree — a marker without its view,\n * or renames without theirs, is exactly the `subsystem.views-stale` state\n * the generated file's contract refuses to leave between two commits.\n *\n * This window does NOT write the per-service project files\n * (`services/<…>/<id>/likec4.config.json`); only `../sync.ts` does, and the\n * asymmetry is deliberate rather than an omission. The views file must ride\n * in the verb's commit because its bytes depend on the PLACEMENT the verb is\n * changing. A project file's bytes depend on the service id alone, which no\n * verb here changes — and the file lives INSIDE the service directory, so a\n * `move` carries it to the new location as part of the rename it already\n * journals (in a git-backed repo that move REFUSES first, `move-uncommitted`,\n * until the files `sync` created are committed — the refusal names them, and\n * `sync`'s own output says to commit them), and `rm` never reaches one,\n * because it refuses any subsystem that still holds a member\n * (`subsystem-not-empty`, `../edit.ts`). No verb can\n * therefore leave a project file stale or orphaned, and a verb that filled\n * gaps in passing would silently write files a `--json` reader of `new` or\n * `rename` was never told to expect. The one state a verb can leave is a\n * model with no file beside it, and that is the state `validate --all` names\n * as `service.likec4-config-missing`, with `loam subsystem sync` as the\n * repair — one writer, so the create-only rule has one place to hold.\n */\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport type { DocsDir } from \"../../../core/kernel/ids/dirs.js\";\nimport { fail, type ErrorCode } from \"../../../core/envelope/json.js\";\nimport { subsystemViewsPath } from \"../../../core/repo/paths.js\";\nimport { listFleetTree } from \"../../../core/repo/repo.js\";\nimport type { FleetTree } from \"../../../core/repo/tree/walk.js\";\nimport { stageWrites } from \"../../../core/staging/commit.js\";\nimport { type CommitRecovery, InterruptedCommitError } from \"../../../core/staging/interrupted.js\";\nimport { acquireDocsLock, DocsBusyError } from \"../../../core/staging/lock.js\";\nimport { recoverInterruptedCommit } from \"../../../core/staging/recovery/recover.js\";\nimport { commitStaged } from \"../../../core/staging/txn/transaction.js\";\nimport { type PlannedWrite } from \"../../../core/staging/writes.js\";\nimport { viewsAgree } from \"../../../core/repo/tree/render/views.js\";\nimport { expectedViews, LANDSCAPE_UNREADABLE_NOTE } from \"./views.js\";\n\nexport type ViewsAction = \"created\" | \"updated\" | \"removed\" | \"current\";\n\n/** The text tail a verb's success line carries about the generated file. */\nexport function reportViews(views: ViewsAction): string {\n  return views === \"current\" ? \"\" : ` — architecture/subsystems.likec4 ${views}`;\n}\n\n/** What one subsystem verb asks the shared commit window to land. */\nexport interface SubsystemTxn {\n  /** The journal's `target` — what this commit is FOR. */\n  target: string;\n  /** Marker writes (create/delete); the views write is derived and appended. */\n  writes: PlannedWrite[];\n  /** The tree AS THE COMMIT LEAVES IT — the views file is rendered from this. */\n  tree: FleetTree;\n  /** Directory renames, performed after the swaps, in this order. */\n  moves?: { from: string; to: string }[];\n  /** Remap of a RACED commit failure (new: a lost marker create is `already-exists`). */\n  racedCode?: ErrorCode;\n  /** Remap of a rolled-back commit failure (move: `move-failed` — no merge was computed). */\n  failedCode?: ErrorCode;\n  /** The rollback sentence's verb for half-state files. */\n  what: string;\n  report: (views: ViewsAction, recovered: CommitRecovery | null) => void | Promise<void>;\n}\n\n/**\n * Lock → recover → plan → stage (views included) → journaled commit → report.\n * `plan` returning null means it already reported a refusal; nothing was\n * staged and nothing is written.\n */\nexport async function commitWindow(\n  docsDir: DocsDir,\n  json: boolean,\n  plan: (tree: FleetTree) => Promise<SubsystemTxn | null>,\n): Promise<void> {\n  let releaseLock: () => Promise<void>;\n  try {\n    releaseLock = await acquireDocsLock(docsDir);\n  } catch (err) {\n    if (!(err instanceof DocsBusyError)) throw err;\n    fail(json, \"docs-busy\", err.message);\n    return;\n  }\n  try {\n    let recovered: CommitRecovery | null;\n    try {\n      recovered = await recoverInterruptedCommit(docsDir);\n    } catch (err) {\n      if (!(err instanceof InterruptedCommitError)) throw err;\n      fail(json, \"commit-interrupted\", err.message);\n      return;\n    }\n    const txn = await plan(await listFleetTree(docsDir));\n    if (txn === null) return;\n\n    const path = subsystemViewsPath(docsDir);\n    const expected = await expectedViews(docsDir, txn.tree);\n    const bytes = expected.content === null ? null : Buffer.from(expected.content, \"utf8\");\n    // Content, not bytes — `viewsAgree` carries the reason. Without it every\n    // subsystem move on a Windows clone folded a rewrite of this file into its\n    // transaction that changed not one fact, and journalled it.\n    const current = existsSync(path) ? await readFile(path, \"utf8\") : null;\n    let views: ViewsAction = \"current\";\n    const writes = [...txn.writes];\n    if (!viewsAgree(current, expected.content)) {\n      views = current === null ? \"created\" : bytes === null ? \"removed\" : \"updated\";\n      writes.push({ path, content: bytes });\n    }\n    const staged = await stageWrites(writes);\n    const committed = await commitStaged(\n      {\n        root: docsDir,\n        command: \"subsystem\",\n        rerun: \"loam subsystem sync\",\n        target: txn.target,\n        ...(txn.moves === undefined ? {} : { moves: txn.moves }),\n      },\n      staged,\n      txn.what,\n    );\n    if (!committed.ok) {\n      const code =\n        committed.code === \"rollback-incomplete\"\n          ? committed.code\n          : committed.raced\n            ? (txn.racedCode ?? txn.failedCode ?? committed.code)\n            : (txn.failedCode ?? committed.code);\n      fail(json, code, committed.message);\n      return;\n    }\n    await txn.report(views, recovered);\n    // A verb CANNOT leave this file behind the tree — its bytes depend on the\n    // placement the verb just changed, so the tolerant render lands even when the\n    // map is unreadable and the file loses its includes. `sync` may decline that\n    // rewrite (`action: \"blocked\"`); a verb may not, so the person is told\n    // instead, and the same note names the run that puts the includes back.\n    if (!json && !expected.known) console.log(LANDSCAPE_UNREADABLE_NOTE);\n  } finally {\n    await releaseLock();\n  }\n}\n"]}

package/dist/commands/subsystem/txn/views.js

@@ -6,19 +6,16 @@
  * disagree with `validate`'s staleness check.
  */
 import { existsSync } from "node:fs";
-import { relative, sep } from "node:path";
-import {} from "../../../core/c4/likec4.js";
-import { loadArchitecture } from "../../../core/c4/project/architecture.js";
+import { relative, resolve, sep } from "node:path";
+import { loadFile } from "../../../core/c4/likec4.js";
+import { architectureProjectDocuments, loadArchitecture } from "../../../core/c4/project/architecture.js";
 import { serviceDirOf } from "../../../core/kernel/ids/dirs.js";
 import { landscapePath } from "../../../core/repo/paths.js";
 import { renderSubsystemViews } from "../../../core/repo/tree/render/views.js";
 /**
- * The elements of the whole `architecture/` PROJECT for the member join, or
- * the empty list when the map is absent or does not parse. Tolerant on
- * purpose: sync must stay runnable in a repo whose landscape is broken — it
- * renders what the committed bytes resolve (no includes), deterministically,
- * and the next sync after the landscape is repaired catches the file up.
- * `validate` skips the staleness question in exactly those states.
+ * The elements and declared global style ids of the whole `architecture/`
+ * PROJECT — the member join, and the one line a view may borrow a palette
+ * with — with the provenance of that answer beside it.
  *
  * The PROJECT, not the landscape file alone, and that is a correctness rule
  * rather than a preference: `validate` grades this file against
@@ -31,22 +28,122 @@ import { renderSubsystemViews } from "../../../core/repo/tree/render/views.js";
  * could clear, reproduced on `examples/docs` before this call changed. Two
  * readers of "what should the views say" must read the same documents, or the
  * shared render in `core/repo/tree/render/views.ts` is shared in name only.
+ *
+ * WHY THE FALLBACK AND THE FLAG ARE TWO ANSWERS RATHER THAN ONE. The fallback
+ * exists because one broken use-case document must not cost the render its
+ * member join: the landscape's own elements are still the truth about who
+ * belongs in which subsystem, and re-rendering the file without them takes every
+ * `include` line off it (verification 2026-09-04, W5). But the STYLE CENSUS is
+ * not the landscape file's alone — SCHEMA blesses a palette in any `.likec4`
+ * under `architecture/` — so the fallback takes it over EVERY document that
+ * parses on its own (`declaredStyles`). Reading it off the landscape alone was
+ * enough to drop `global style subsystems` from a good generated file whenever
+ * the palette sat in a sibling and an unrelated sibling was broken
+ * (re-verification 2026-09-04, area C item 8).
+ *
+ * `known` still means the PROJECT parsed, and nothing weaker, because the MEMBER
+ * JOIN is what it licences: a use-case document that binds an element of its own
+ * contributes to the join and cannot be read document by document. It is
+ * `../sync.ts`'s licence to leave an existing file alone.
+ *
+ * An ABSENT map is not a failure: there is nothing to read, the empty facts are
+ * the truth, and the tolerant render is what a fleet being scaffolded needs. An
+ * EMPTY project is no longer reachable here — `architectureProjectDocuments`
+ * keeps the landscape whatever the root `exclude` says, and its banner records
+ * what an empty one cost.
  */
-export async function landscapeElements(docsDir) {
-    if (!existsSync(landscapePath(docsDir)))
-        return [];
+export async function landscapeFacts(docsDir) {
+    const path = landscapePath(docsDir);
+    if (!existsSync(path))
+        return { facts: { elements: [] }, known: true };
     try {
         const doc = await loadArchitecture(docsDir);
-        return doc.errors.length > 0 ? [] : doc.elements;
+        // The whole document on success, so the render reads the same record
+        // `validate --all` grades against; `globalStyles` rides along without
+        // being named here, and a field the loaders add later does too.
+        if (doc.errors.length === 0)
+            return { facts: doc, known: true };
     }
     catch {
-        return [];
+        // A throw and a parse error are the same evidence: fall through to the file.
+    }
+    try {
+        const file = await loadFile(path);
+        // THE STYLE CENSUS IS TAKEN OVER EVERY DOCUMENT, not over the landscape, and
+        // that is what makes the fallback safe for a verb that has to write. A
+        // palette declared in a SIBLING under `architecture/` is invisible to a read
+        // of the landscape alone, so a `subsystem new` run standing beside one
+        // unrelated broken sibling silently dropped `global style subsystems` from a
+        // good generated file — the landscape parsed, the element join survived, and
+        // nothing graded the loss because `sync` answers `blocked` for as long as the
+        // broken file stands (re-verification 2026-09-04, area C item 8). Reading
+        // each document ON ITS OWN is the widening the fallback is entitled to: it
+        // cannot merge them (that is what failed one line up), but a document that
+        // parses alone certainly declares the style groups it declares.
+        if (file.errors.length === 0) {
+            return { facts: { elements: file.elements, globalStyles: await declaredStyles(docsDir, file) }, known: false };
+        }
     }
+    catch {
+        // Unreadable bytes; the caller is told loam could not say.
+    }
+    return { facts: null, known: false };
+}
+/**
+ * Every global style id declared by an `architecture/` document that parses ON
+ * ITS OWN, the landscape's included — the union, sorted, so the render is a
+ * function of the set rather than of readdir order.
+ *
+ * The document set is `architectureProjectDocuments`: the same list the PROJECT
+ * read uses, so the fallback can never consider a file the merged read would
+ * have excluded — the generated views file itself, or one the root `exclude`
+ * hides from the renderer. A document that does not parse alone contributes
+ * nothing and is not an error here: it is named by `loam validate --all`, and
+ * the note this module carries already tells the reader the census came from
+ * outside a project read.
+ */
+async function declaredStyles(docsDir, landscape) {
+    const ids = new Set(landscape.globalStyles ?? []);
+    let paths;
+    try {
+        paths = await architectureProjectDocuments(docsDir);
+    }
+    catch {
+        return [...ids].sort();
+    }
+    const map = resolve(landscapePath(docsDir));
+    for (const path of paths) {
+        if (resolve(path) === map)
+            continue;
+        try {
+            const doc = await loadFile(path);
+            if (doc.errors.length === 0)
+                for (const id of doc.globalStyles ?? [])
+                    ids.add(id);
+        }
+        catch {
+            // One unreadable sibling costs its own styles and nothing else.
+        }
+    }
+    return [...ids].sort();
 }
-/** The bytes the views file must hold for this tree, or null for "must be absent". */
 export async function expectedViews(docsDir, tree) {
-    return renderSubsystemViews(tree, await landscapeElements(docsDir));
+    const read = await landscapeFacts(docsDir);
+    return { known: read.known, content: renderSubsystemViews(tree, read.facts ?? { elements: [] }) };
 }
+/**
+ * The one line a person is owed when the map cannot be read — the same sentence
+ * from `../sync.ts` (which then leaves an existing file alone) and from a
+ * tree-changing verb (which renders the tolerant shape anyway, because its own
+ * contract is that the file lands in the verb's commit). It names the gating
+ * surface rather than repeating its findings: `loam validate --all` is where the
+ * broken document is named. It lives here, beside the facts it is about, because
+ * both callers are on this side of the `txn/` boundary and a constant in
+ * `../sync.ts` would point the package edge back up.
+ */
+export const LANDSCAPE_UNREADABLE_NOTE = "note: architecture/ does not parse as one project, so the element join is whatever " +
+    "architecture/landscape.likec4 alone says and the style census is the union of the documents that parse on " +
+    "their own — fix the map (`loam validate --all` names the file), then re-run `loam subsystem sync`.";
 /**
  * The tree AS THE RENAMES LEAVE IT, computed in memory: every dir under a
  * moved root is remapped by prefix, and each entry's placement chain is

package/dist/commands/subsystem/txn/views.js.map

@@ -1 +1 @@
-{"version":3,"file":"views.js","sourceRoot":"","sources":["../../../../src/commands/subsystem/txn/views.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAa,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAgB,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAG/E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAgB;IACtD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,IAAe;IACnE,OAAO,oBAAoB,CAAC,IAAI,EAAE,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,IAAe,EAAE,OAAuC,EAAE,YAAoB;IACtG,MAAM,KAAK,GAAG,CAAC,GAAW,EAAU,EAAE;QACpC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAW,EAAY,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClF,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACzB,iEAAiE;YACjE,gEAAgE;YAChE,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,CAAC,CAAC;QACF,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACpC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,CAAC,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["/**\n * What the generated views file MUST say — the shared answer every subsystem\n * writer and `subsystem sync` render from. A module beneath the verbs (in the\n * txn/ subpackage) because the commit window and sync both consume it, and a\n * second spelling of \"what should the views say\" would be a second chance to\n * disagree with `validate`'s staleness check.\n */\nimport { existsSync } from \"node:fs\";\nimport { relative, sep } from \"node:path\";\nimport { type Elem } from \"../../../core/c4/likec4.js\";\nimport { loadArchitecture } from \"../../../core/c4/project/architecture.js\";\nimport { serviceDirOf, type DocsDir } from \"../../../core/kernel/ids/dirs.js\";\nimport { landscapePath } from \"../../../core/repo/paths.js\";\nimport { renderSubsystemViews } from \"../../../core/repo/tree/render/views.js\";\nimport type { FleetTree } from \"../../../core/repo/tree/walk.js\";\n\n/**\n * The elements of the whole `architecture/` PROJECT for the member join, or\n * the empty list when the map is absent or does not parse. Tolerant on\n * purpose: sync must stay runnable in a repo whose landscape is broken — it\n * renders what the committed bytes resolve (no includes), deterministically,\n * and the next sync after the landscape is repaired catches the file up.\n * `validate` skips the staleness question in exactly those states.\n *\n * The PROJECT, not the landscape file alone, and that is a correctness rule\n * rather than a preference: `validate` grades this file against\n * `loadArchitecture` — the landscape merged with every\n * `architecture/usecases/*.likec4`, which may `extend` the model and bind\n * elements of its own. While this side read the landscape alone, a use-case\n * document declaring one element bound to a filed service was enough to make\n * `sync` answer `current` while `validate --all` reported\n * `subsystem.views-stale` and named `sync` as the repair — a loop no command\n * could clear, reproduced on `examples/docs` before this call changed. Two\n * readers of \"what should the views say\" must read the same documents, or the\n * shared render in `core/repo/tree/render/views.ts` is shared in name only.\n */\nexport async function landscapeElements(docsDir: DocsDir): Promise<Elem[]> {\n  if (!existsSync(landscapePath(docsDir))) return [];\n  try {\n    const doc = await loadArchitecture(docsDir);\n    return doc.errors.length > 0 ? [] : doc.elements;\n  } catch {\n    return [];\n  }\n}\n\n/** The bytes the views file must hold for this tree, or null for \"must be absent\". */\nexport async function expectedViews(docsDir: DocsDir, tree: FleetTree): Promise<string | null> {\n  return renderSubsystemViews(tree, await landscapeElements(docsDir));\n}\n\n/**\n * The tree AS THE RENAMES LEAVE IT, computed in memory: every dir under a\n * moved root is remapped by prefix, and each entry's placement chain is\n * re-derived from its remapped dir. The views file is rendered from this, so\n * the commit lands file and renames agreeing — never from a re-walk that\n * would have to happen between two states. Beside `expectedViews` because the\n * two are one promise: what the commit renames and what the file says must\n * come from the same in-memory answer.\n */\nexport function movedTree(tree: FleetTree, renames: { from: string; to: string }[], servicesRoot: string): FleetTree {\n  const remap = (dir: string): string => {\n    for (const r of renames) {\n      if (dir === r.from || dir.startsWith(r.from + sep)) return r.to + dir.slice(r.from.length);\n    }\n    return dir;\n  };\n  const chainOf = (dir: string): string[] => relative(servicesRoot, dir).split(sep);\n  return {\n    findings: tree.findings,\n    services: tree.services.map((s) => {\n      const dir = remap(s.dir);\n      // The constructor call records provenance: a readdir-established\n      // directory carried through a rename this same commit performs.\n      return { ...s, dir: serviceDirOf(dir), subsystem: chainOf(dir).slice(0, -1) };\n    }),\n    subsystems: tree.subsystems.map((s) => {\n      const dir = remap(s.dir);\n      return { ...s, dir, path: chainOf(dir) };\n    }),\n  };\n}\n"]}
+{"version":3,"file":"views.js","sourceRoot":"","sources":["../../../../src/commands/subsystem/txn/views.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAgB,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAiB,oBAAoB,EAAE,MAAM,yCAAyC,CAAC;AAgB9F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC5C,qEAAqE;QACrE,sEAAsE;QACtE,gEAAgE;QAChE,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAClC,6EAA6E;QAC7E,uEAAuE;QACvE,6EAA6E;QAC7E,uEAAuE;QACvE,6EAA6E;QAC7E,6EAA6E;QAC7E,8EAA8E;QAC9E,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,gEAAgE;QAChE,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACjH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,SAAmB;IACjE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,GAAG;YAAE,SAAS;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,YAAY,IAAI,EAAE;oBAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAuBD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,IAAe;IACnE,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;AACpG,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,yBAAyB,GACpC,qFAAqF;IACrF,4GAA4G;IAC5G,oGAAoG,CAAC;AAEvG;;;;;;;;GAQG;AACH,MAAM,UAAU,SAAS,CAAC,IAAe,EAAE,OAAuC,EAAE,YAAoB;IACtG,MAAM,KAAK,GAAG,CAAC,GAAW,EAAU,EAAE;QACpC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,GAAW,EAAY,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClF,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAChC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACzB,iEAAiE;YACjE,gEAAgE;YAChE,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,CAAC,CAAC;QACF,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACpC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACzB,OAAO,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,CAAC,CAAC;KACH,CAAC;AACJ,CAAC","sourcesContent":["/**\n * What the generated views file MUST say — the shared answer every subsystem\n * writer and `subsystem sync` render from. A module beneath the verbs (in the\n * txn/ subpackage) because the commit window and sync both consume it, and a\n * second spelling of \"what should the views say\" would be a second chance to\n * disagree with `validate`'s staleness check.\n */\nimport { existsSync } from \"node:fs\";\nimport { relative, resolve, sep } from \"node:path\";\nimport { loadFile } from \"../../../core/c4/likec4.js\";\nimport { architectureProjectDocuments, loadArchitecture } from \"../../../core/c4/project/architecture.js\";\nimport { serviceDirOf, type DocsDir } from \"../../../core/kernel/ids/dirs.js\";\nimport { landscapePath } from \"../../../core/repo/paths.js\";\nimport { type MapFacts, renderSubsystemViews } from \"../../../core/repo/tree/render/views.js\";\nimport type { FleetTree } from \"../../../core/repo/tree/walk.js\";\n\n/** What one read of the map yielded, and whether it came from the whole project. */\nexport interface LandscapeRead {\n  /** The element join and the style census, or null when neither reading was available. */\n  facts: MapFacts | null;\n  /**\n   * The `architecture/` PROJECT parsed. FALSE means the facts below, if there\n   * are any, were assembled document by document — the member join from the\n   * landscape file alone (so an element a use-case document binds is missing\n   * from it), the style census from every document that parses on its own.\n   */\n  known: boolean;\n}\n\n/**\n * The elements and declared global style ids of the whole `architecture/`\n * PROJECT — the member join, and the one line a view may borrow a palette\n * with — with the provenance of that answer beside it.\n *\n * The PROJECT, not the landscape file alone, and that is a correctness rule\n * rather than a preference: `validate` grades this file against\n * `loadArchitecture` — the landscape merged with every\n * `architecture/usecases/*.likec4`, which may `extend` the model and bind\n * elements of its own. While this side read the landscape alone, a use-case\n * document declaring one element bound to a filed service was enough to make\n * `sync` answer `current` while `validate --all` reported\n * `subsystem.views-stale` and named `sync` as the repair — a loop no command\n * could clear, reproduced on `examples/docs` before this call changed. Two\n * readers of \"what should the views say\" must read the same documents, or the\n * shared render in `core/repo/tree/render/views.ts` is shared in name only.\n *\n * WHY THE FALLBACK AND THE FLAG ARE TWO ANSWERS RATHER THAN ONE. The fallback\n * exists because one broken use-case document must not cost the render its\n * member join: the landscape's own elements are still the truth about who\n * belongs in which subsystem, and re-rendering the file without them takes every\n * `include` line off it (verification 2026-09-04, W5). But the STYLE CENSUS is\n * not the landscape file's alone — SCHEMA blesses a palette in any `.likec4`\n * under `architecture/` — so the fallback takes it over EVERY document that\n * parses on its own (`declaredStyles`). Reading it off the landscape alone was\n * enough to drop `global style subsystems` from a good generated file whenever\n * the palette sat in a sibling and an unrelated sibling was broken\n * (re-verification 2026-09-04, area C item 8).\n *\n * `known` still means the PROJECT parsed, and nothing weaker, because the MEMBER\n * JOIN is what it licences: a use-case document that binds an element of its own\n * contributes to the join and cannot be read document by document. It is\n * `../sync.ts`'s licence to leave an existing file alone.\n *\n * An ABSENT map is not a failure: there is nothing to read, the empty facts are\n * the truth, and the tolerant render is what a fleet being scaffolded needs. An\n * EMPTY project is no longer reachable here — `architectureProjectDocuments`\n * keeps the landscape whatever the root `exclude` says, and its banner records\n * what an empty one cost.\n */\nexport async function landscapeFacts(docsDir: DocsDir): Promise<LandscapeRead> {\n  const path = landscapePath(docsDir);\n  if (!existsSync(path)) return { facts: { elements: [] }, known: true };\n  try {\n    const doc = await loadArchitecture(docsDir);\n    // The whole document on success, so the render reads the same record\n    // `validate --all` grades against; `globalStyles` rides along without\n    // being named here, and a field the loaders add later does too.\n    if (doc.errors.length === 0) return { facts: doc, known: true };\n  } catch {\n    // A throw and a parse error are the same evidence: fall through to the file.\n  }\n  try {\n    const file = await loadFile(path);\n    // THE STYLE CENSUS IS TAKEN OVER EVERY DOCUMENT, not over the landscape, and\n    // that is what makes the fallback safe for a verb that has to write. A\n    // palette declared in a SIBLING under `architecture/` is invisible to a read\n    // of the landscape alone, so a `subsystem new` run standing beside one\n    // unrelated broken sibling silently dropped `global style subsystems` from a\n    // good generated file — the landscape parsed, the element join survived, and\n    // nothing graded the loss because `sync` answers `blocked` for as long as the\n    // broken file stands (re-verification 2026-09-04, area C item 8). Reading\n    // each document ON ITS OWN is the widening the fallback is entitled to: it\n    // cannot merge them (that is what failed one line up), but a document that\n    // parses alone certainly declares the style groups it declares.\n    if (file.errors.length === 0) {\n      return { facts: { elements: file.elements, globalStyles: await declaredStyles(docsDir, file) }, known: false };\n    }\n  } catch {\n    // Unreadable bytes; the caller is told loam could not say.\n  }\n  return { facts: null, known: false };\n}\n\n/**\n * Every global style id declared by an `architecture/` document that parses ON\n * ITS OWN, the landscape's included — the union, sorted, so the render is a\n * function of the set rather than of readdir order.\n *\n * The document set is `architectureProjectDocuments`: the same list the PROJECT\n * read uses, so the fallback can never consider a file the merged read would\n * have excluded — the generated views file itself, or one the root `exclude`\n * hides from the renderer. A document that does not parse alone contributes\n * nothing and is not an error here: it is named by `loam validate --all`, and\n * the note this module carries already tells the reader the census came from\n * outside a project read.\n */\nasync function declaredStyles(docsDir: DocsDir, landscape: MapFacts): Promise<string[]> {\n  const ids = new Set(landscape.globalStyles ?? []);\n  let paths: string[];\n  try {\n    paths = await architectureProjectDocuments(docsDir);\n  } catch {\n    return [...ids].sort();\n  }\n  const map = resolve(landscapePath(docsDir));\n  for (const path of paths) {\n    if (resolve(path) === map) continue;\n    try {\n      const doc = await loadFile(path);\n      if (doc.errors.length === 0) for (const id of doc.globalStyles ?? []) ids.add(id);\n    } catch {\n      // One unreadable sibling costs its own styles and nothing else.\n    }\n  }\n  return [...ids].sort();\n}\n\n/**\n * The bytes the views file must hold for this tree, and whether the map they\n * were computed from was read as a PROJECT.\n *\n * The content is always renderable — from the landscape file alone, or from\n * nothing — because a fleet with no generated file yet must still get one, and\n * the tree-changing verbs must still land theirs in the commit that changes the\n * tree. `known: false` is the caller's licence to leave an EXISTING file alone\n * instead (`../sync.ts`, `action: \"blocked\"`).\n */\nexport interface ExpectedViews {\n  /**\n   * The `architecture/` PROJECT was read. False means the content was rendered\n   * from the landscape file alone — or from nothing at all — so its style census\n   * is not one an existing file may be rewritten from.\n   */\n  known: boolean;\n  /** The bytes the file must hold, or null for \"must be absent\". */\n  content: string | null;\n}\n\nexport async function expectedViews(docsDir: DocsDir, tree: FleetTree): Promise<ExpectedViews> {\n  const read = await landscapeFacts(docsDir);\n  return { known: read.known, content: renderSubsystemViews(tree, read.facts ?? { elements: [] }) };\n}\n\n/**\n * The one line a person is owed when the map cannot be read — the same sentence\n * from `../sync.ts` (which then leaves an existing file alone) and from a\n * tree-changing verb (which renders the tolerant shape anyway, because its own\n * contract is that the file lands in the verb's commit). It names the gating\n * surface rather than repeating its findings: `loam validate --all` is where the\n * broken document is named. It lives here, beside the facts it is about, because\n * both callers are on this side of the `txn/` boundary and a constant in\n * `../sync.ts` would point the package edge back up.\n */\nexport const LANDSCAPE_UNREADABLE_NOTE =\n  \"note: architecture/ does not parse as one project, so the element join is whatever \" +\n  \"architecture/landscape.likec4 alone says and the style census is the union of the documents that parse on \" +\n  \"their own — fix the map (`loam validate --all` names the file), then re-run `loam subsystem sync`.\";\n\n/**\n * The tree AS THE RENAMES LEAVE IT, computed in memory: every dir under a\n * moved root is remapped by prefix, and each entry's placement chain is\n * re-derived from its remapped dir. The views file is rendered from this, so\n * the commit lands file and renames agreeing — never from a re-walk that\n * would have to happen between two states. Beside `expectedViews` because the\n * two are one promise: what the commit renames and what the file says must\n * come from the same in-memory answer.\n */\nexport function movedTree(tree: FleetTree, renames: { from: string; to: string }[], servicesRoot: string): FleetTree {\n  const remap = (dir: string): string => {\n    for (const r of renames) {\n      if (dir === r.from || dir.startsWith(r.from + sep)) return r.to + dir.slice(r.from.length);\n    }\n    return dir;\n  };\n  const chainOf = (dir: string): string[] => relative(servicesRoot, dir).split(sep);\n  return {\n    findings: tree.findings,\n    services: tree.services.map((s) => {\n      const dir = remap(s.dir);\n      // The constructor call records provenance: a readdir-established\n      // directory carried through a rename this same commit performs.\n      return { ...s, dir: serviceDirOf(dir), subsystem: chainOf(dir).slice(0, -1) };\n    }),\n    subsystems: tree.subsystems.map((s) => {\n      const dir = remap(s.dir);\n      return { ...s, dir, path: chainOf(dir) };\n    }),\n  };\n}\n"]}

package/dist/commands/validate/arch-coverage.js

@@ -31,6 +31,11 @@ import { coversEntries, coversUnknownFindings } from "./checks/requirements.js";
 export async function deltaArchCoverage(delta) {
     const { docsDir, elements, relationships, taggedEls, taggedRels, archDeltas, featureServices, scenarioText, preloadedLand, fleet, } = delta;
     const findings = [];
+    // The read index the service models below are read through. A feature target
+    // may arrive without one (`validate --feature` builds no fleet), and it gets
+    // its own for `validateService`'s reason: `serviceModel` needs the enumeration
+    // and a document memo to answer at all.
+    const context = fleet ?? new FleetContext();
     // The delta's own element→service resolver, built once for the whole feature.
     // `serviceOf` is a one-shot wrapper that rebuilds its index on every call, and
     // the two loops below ask it up to five times per tagged edge — so a delta
@@ -171,16 +176,18 @@ export async function deltaArchCoverage(delta) {
             };
             const unresolved = coversUnknownFindings(reqs, { where: `${svc}: arch.spec.md`, subject: svc }, scope, health.unreadable);
             if (unresolved.length > 0) {
-                const modelPath = (await locateServicePaths(docsDir, svc, fleet)).model;
-                const model = existsSync(modelPath)
-                    ? fleet === undefined
-                        ? await loadFile(modelPath)
-                        : await fleet.loadLikeC4(modelPath)
-                    : null;
-                if (model !== null && model.errors.length === 0) {
+                // Through the ONE reader of `model.likec4`: a model that EXTENDS the map
+                // is not a file this could open, and reading it as one would answer with
+                // a pile of parse errors — which this arm reads as "no widening", so
+                // every `Covers:` line naming a container of a migrated service would be
+                // convicted as a typo. `mapUnreadable` is the same silence for the same
+                // reason: nothing may widen a scope out of a document nobody could read.
+                const svcPaths = await locateServicePaths(docsDir, svc, fleet);
+                const model = existsSync(svcPaths.model) ? await context.serviceModel(docsDir, svcPaths) : null;
+                if (model !== null && !model.mapUnreadable && model.doc.errors.length === 0) {
                     scope = {
-                        elements: [...baseElements, ...model.elements],
-                        relationships: [...baseRels, ...model.relationships],
+                        elements: [...baseElements, ...model.doc.elements],
+                        relationships: [...baseRels, ...model.doc.relationships],
                         health: health.ids,
                         known,
                     };