@ybotok/loam 0.2.0-alpha.5 → 0.2.0-alpha.7

package/MIGRATING-from-OpenSpec.md

@@ -312,10 +312,13 @@ services, loam frontmatter, Operations/Covers links and feature identity still r
   specs intentionally remain `status: draft`.
 - `Operations:` links to provider OpenAPI `operationId`s, and `Covers:` links where architecture
   requirements are created.
-- `architecture/landscape.likec4`, service `model.likec4`, and explicit fleet relationships — then
-  `loam subsystem sync`, which writes each model's `likec4.config.json` (the staged repo already
-  carries the root one) so the models render beside the map; `validate --all` warns
-  `service.likec4-config-missing` for any model still without one.
+- `architecture/landscape.likec4`, service `model.likec4` (written to extend the map's element —
+  no `specification` block of its own; SCHEMA.md, "Two shapes of a service model"), and explicit
+  fleet relationships — then `loam subsystem sync`, which keeps the root `likec4.config.json`'s
+  `exclude` covering exactly the models that stand alone (the staged repo already carries the
+  root file), so every model that extends the map renders beside it; `validate --all` warns
+  `service.likec4-config-missing` for a standalone model still without a project file of its own,
+  and `service.model-unexcluded` for one the root project does not exclude.
 - Service OpenAPI contracts and provider-before-consumer sequencing where inbound edges already name
   operations.
 - LikeC4 and OpenAPI deltas for the already mapped active feature ids (`FEAT-12`, `BUG-42`, and so

package/QUICKSTART.md

@@ -103,11 +103,16 @@ Or ask naturally: “Create a loam problem report for what just happened.” The
 relevant status and the smallest safe reproduction, and writes a separate file:
 
 ```text
-loam-reports/YYYY-MM-DD-short-symptom.md
+loam-reports/NNN-YYYY-MM-DD-short-symptom.md
 ```
 
-The report records expected versus actual behavior, stable codes, relevant locations, write state,
-classification and missing evidence. It replaces secrets with `<redacted>`, prefers repo-relative
+`NNN` is the report's ordinal — at least three digits, zero-padded, one more than the highest
+already in the directory, which
+`loam doctor` reports together with how many reports are open, sent, fixed or superseded — and a
+`Status: open` line in the header is where the report's own state is kept (`doctor` reads it from
+the header block above the first `##` heading, never from a quoted template inside the body). The report records
+expected versus actual behavior, stable codes, relevant locations, write state, classification and
+missing evidence. It replaces secrets with `<redacted>`, prefers repo-relative
 paths, does not copy source/spec bodies, does not retry a writer merely to reproduce it, and never
 uploads or submits anything automatically. Review the file before sharing or committing it.
 

package/README.md

@@ -7,7 +7,7 @@
 [![CI](https://github.com/ybotok/loam/actions/workflows/ci.yml/badge.svg)](https://github.com/ybotok/loam/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/@ybotok/loam/alpha.svg?label=npm%20alpha)](https://www.npmjs.com/package/@ybotok/loam)
 
-> **Pre-release: `0.2.0-alpha.5`**, the fourth published release of the 0.2 line and the newest published
+> **Pre-release: `0.2.0-alpha.7`**, the sixth published release of the 0.2 line and the newest published
 > version of [`@ybotok/loam`](https://www.npmjs.com/package/@ybotok/loam). It publishes under the
 > `alpha` npm dist-tag — which is what the badge above reads: `npm i @ybotok/loam@alpha`, or the
 > exact version, always installs this line. `latest` is moved onto a release by hand once it has
@@ -71,7 +71,8 @@ Topology changes where loam's checks pay off; it does not change the lifecycle:
   nesting depth, decides which `services/<id>/` owns an element.
 
 For example, the frozen `service` term can name an application while its internal modules remain
-ordinary C4 elements:
+ordinary C4 elements. This is `architecture/landscape.likec4`, the fleet map — the one document
+that declares the kinds:
 
 ```likec4
 specification {
@@ -92,6 +93,11 @@ model {
 }
 ```
 
+The modules can equally live in `services/commerce-app/model.likec4`, which is the ordinary place
+for them once the application has one — as an **extending model**, declaring no kinds of its own and
+saying `extend commerce { … }` on the element above. SCHEMA.md's "Two shapes of a service model" has
+that shape, the older one that parses alone, and the rule that picks between them.
+
 An internal edge normally carries no `metadata { op }`: that key specifically joins a call to the
 governed boundary's OpenAPI contract. An architecture requirement can instead say
 `Covers: commerce.orders -> commerce.billing`. Fleet-level maturity, dependency and scorecard views
@@ -109,7 +115,7 @@ both halves are written down: the question in the brief or the checklist, the an
 
 Most of this category will tell you what it checks. loam ships the other list too, in the binary:
 **[`src/core/brief/unchecked.ts`](https://github.com/ybotok/loam/blob/main/src/core/brief/unchecked.ts)
-is sixteen statements of what no check will ever tell you**, printed into the adoption brief beside
+is seventeen statements of what no check will ever tell you**, printed into the adoption brief beside
 the checks that do run. It says, in loam's own words, that nothing here knows whether the model is
 the architecture the code actually has, whether a requirement is *true*, whether an `operationId` is
 the one the code serves, or whether `sources` names the files anybody read. And it says the one that
@@ -359,7 +365,7 @@ cannot hold.
 | `loam new <FEAT>` | `--title <text>` `--touches <id>` `--new-service <id>` `--capability <id>` | Scaffold a feature: intent, C4 delta, a requirement delta per service named by `--touches`/`--new-service`, and a capability delta per promise named by `--capability` (all repeatable) |
 | `loam show <service\|FEAT>` | `--type <kind>` | Everything loam knows about one service or feature. A feature's JSON includes a semantic `review` pack: intent, exact architecture objects, API/event slices, dependencies, artifacts, verification, blockers and next actions. `--type` forces an ambiguous reading |
 | `loam subsystem <verb> [names...]` | `--into <name>` `--under <name>` `--title <text>` `--description <text>` `--owner <name>` | Manage the grouping tree under `services/` — a navigable tree no identity depends on. `new`/`rm`, `move … --into`, `rename`, `list`, `history`, `sync` |
-| `loam adopt` | `--service <id>` `--subsystem <name>` `--targets` | Brief an agent to write this service's baseline into the docs repo as `draft`: the target paths, the grammar of each, what the landscape already says, and the checks that follow. Writes nothing. `--targets` narrows it to what varies by service — the walk, the 37 checks and the sixteen statements of what nothing checks are the same bytes everywhere, so a `full` field names the one run that carries them: 42,873 bytes to 17,805 |
+| `loam adopt` | `--service <id>` `--subsystem <name>` `--targets` | Brief an agent to write this service's baseline into the docs repo as `draft`: the target paths, the grammar of each, what the landscape already says — and, for an element no edge touches, the edges the service's own model.likec4 attests — and the checks that follow. Writes nothing. `--targets` narrows it to what varies by service — the walk, the 52 checks and the seventeen statements of what nothing checks are the same bytes everywhere, so a `full` field names the one run that carries them: 54,833 bytes to 20,062 on the example fleet's payment-service (measured 2026-09-04) |
 | `loam delta <FEAT>` | `--service <id>` | Project a feature onto one service: the intent, its requirement deltas with every body and Given/When/Then line verbatim, the endpoints it adds or retires, and the edges around it. Doubles as a coding-agent task |
 | `loam gherkin [<FEAT>]` | `--service <id>` `--dry-run` | Emit spec scenarios as digest-stamped Gherkin `.feature` files into the service repo's `<gherkinDir>/loam/` |
 | `loam rebase [<FEAT>]` | `--service <id>` `--dry-run` `--living` | Pin the feature to the living versions it was written against, on the requirement axis and the contract axis. `--living` takes no feature: it pins the living corpus's `Realizes:` entries to the capability requirements they name, which is what makes `capability.realizes-stale` able to fire later |
@@ -487,7 +493,7 @@ always preserved byte for byte, with the entry printed for manual merge.
   maps, what is lost, what must be added.
 - [ROADMAP.md](ROADMAP.md) — the evidence-backed improvement plan, priorities, non-goals and exit
   criteria.
-- [CHANGELOG.md](CHANGELOG.md) — released beta.1–alpha.5 plus the changes on `main` under
+- [CHANGELOG.md](CHANGELOG.md) — released beta.1–alpha.7 plus the changes on `main` under
   `[Unreleased]`.
 - [docs/BENCHMARKS.md](https://github.com/ybotok/loam/blob/main/docs/BENCHMARKS.md) — what a
   fleet-sized run costs, with the method, the machine and the committed runs behind every number.
@@ -523,12 +529,12 @@ authored-capability axes with the `Realizes:` join, use cases graded as `dynamic
 `architecture/obligations.yaml` architectural obligations checked through `#obl-` tags and
 `Covers:`. Known limits, each with its owner in [ROADMAP.md](ROADMAP.md): the scheduled CI
 `stability` job has still to be observed green. Speculative `render`, health composition and UI
-generation come later. Behind that status stand **159 test files** (counted 2026-09-02): the count is graded
+generation come later. Behind that status stand **174 test files** (counted 2026-09-07): the count is graded
 against a live readdir by `test/docs-facts.test.ts`, so this sentence fails the suite the moment it
 trails the tree.
 
 The package is published as [`@ybotok/loam`](https://www.npmjs.com/package/@ybotok/loam), currently
-`0.2.0-alpha.5`: the unscoped `loam` name is taken by an unrelated GDAL wrapper, so the package ships
+`0.2.0-alpha.7`: the unscoped `loam` name is taken by an unrelated GDAL wrapper, so the package ships
 under the maintainer's own npm user scope. Releases are tag-driven and maintainer-only
 ([CONTRIBUTING.md](CONTRIBUTING.md)); the version this line names is pinned to `package.json` by a
 drift test, so it cannot silently trail a release.

package/ROADMAP.md

@@ -18,19 +18,19 @@ acceptance tests, and implementation evidence remain ordinary files in repositor
 state inside a service. The CLI is small enough to audit, and every writer — not only archive — now
 commits through a locked, journaled transaction that a crash cannot leave half-applied.
 
-The tree contains **429 TypeScript modules in 130 source packages**, with an acyclic package graph
+The tree contains **468 TypeScript modules in 144 source packages**, with an acyclic package graph
 checked by
 [scripts/package-graph.mjs](https://github.com/ybotok/loam/blob/main/scripts/package-graph.mjs). The
 CLI exposes **29 commands** from [src/cli.ts](https://github.com/ybotok/loam/blob/main/src/cli.ts),
-and the suite stands at **159 test files**. Those four counts are deliberately stated OUTSIDE the
+and the suite stands at **174 test files**. Those four counts are deliberately stated OUTSIDE the
 dated snapshot below: each derives from the tree in one readdir, so
 [test/docs-facts.test.ts](https://github.com/ybotok/loam/blob/main/test/docs-facts.test.ts) grades
 them live and this paragraph cannot quietly trail the code the way its predecessor did.
 
-_Measured 2026-09-03 at `0.2.0-alpha.5`, and dated because neither number has a cheap derivation:_
+_Measured 2026-09-07 at `0.2.0-alpha.7`, and dated because neither number has a cheap derivation:_
 lint, typecheck, `npm run arch:check` and `npm run meta:check` green; `npm test` passing
-**3,434/3,434 tests**, with two `skipIf(asRoot)` cases the root gate container cannot run; the
-coverage gate passing with **92.30% statements, 84.11% branches, 96.64% functions, and 94.24%
+**3,802/3,802 tests**, with two `skipIf(asRoot)` cases the root gate container cannot run; the
+coverage gate passing with **92.88% statements, 84.83% branches, 97.14% functions, and 94.70%
 lines** against its thresholds of 91 / 82 / 95 / 93; and `npm run release:check` plus
 `npm run test:package` green against the real tarball.
 
@@ -127,9 +127,219 @@ exactly the invented need the non-goals forbid.
 Closed since the 2026-08-18 assessment, each with the commit or commit range that landed it on
 `main`. [CHANGELOG.md](CHANGELOG.md) is the user-facing record; the full item texts — required
 changes, exit criteria, and what each review surfaced — are in this file's history (`git show
-5cd3942:ROADMAP.md`). The three use-case entries below carry no range yet: they are green in the
-working tree and not committed, and the range goes in with the commit rather than being guessed at
-here.
+5cd3942:ROADMAP.md`). The four 2026-09-03 problem-report entries that follow — the extending model
+and the report ordinal, which open the list — landed together in `f751909`, one change built as
+four disjoint workstreams and gated as one; the three before them — the edgeless brief, the
+intra-service use case, and the styling paragraph under the generated views — landed together in
+`0eaa101` the same way.
+
+#### One model, many documents — a service model may extend the fleet map
+
+**Landed 2026-09-04** in `f751909`, from three problem reports that turned out to be one cause,
+with a fourth landing beside it in the same change. #010 measured the cause: a service model must
+parse alone, so it re-declares its own `specification` and every partner it names — 78 double
+declarations in a 56-service fleet with four services adopted, projected to ~448 at full adoption —
+and the copies had already diverged, `#platform` missing from every copy of the broker and the
+identity provider but the map's, with no finding code for "two documents describe one element
+differently" because no check read two documents together. #009 measured the symptom: 57 flat
+entries in the renderer's project picker, 52 of them a single box, forced by the per-service
+project file `0.2.0-alpha.5` had to write **because** the models could not share a project. #011 is
+the structural proposal, every claim of it executed against copies of `examples/docs`: `extend`
+resolves across documents of one project, a model rewritten that way makes its containers visible
+in the fleet project with one copy of the broker in the whole model, and deleting a model's
+`specification` under the old loader is eleven `c4.invalid` errors — so the change had to be
+loam's, not a convention a repository could adopt. (#012, reports having no ordinal and loam never
+reading `loam-reports/`, landed in the same commit and has its own entry below.)
+
+**What landed.** The shape of a model is now read from the file's own grammar — a top-level
+`specification { }` block containing an `element` declaration means STANDALONE, its absence means
+EXTENDING — and each shape gets the grade the other cannot need: `c4.declaration-diverged` for a
+standalone model whose copies of the map's elements disagree with it, `c4.element-unowned` for an
+extending model that declares an element outside its own. Around them, the renderer wiring
+`loam subsystem sync` now owns end to end (`service.likec4-config-stray`, `service.model-excluded`,
+`service.model-unexcluded`, the narrowed `service.likec4-config-missing`, and the root project's
+`exclude` rewritten to cover exactly the models that stand alone), and `c4.fleet-project-invalid`,
+which loads the fleet project the way the renderer builds it and reports what only that load can
+see. `examples/docs` is migrated whole, and its ten deliberate warnings are unchanged. CHANGELOG
+has every code, key and message; SCHEMA's new "Two shapes of a service model" has the rules and the
+migration recipe.
+
+**Rejected, each with the reason.** Migrating repositories automatically — the recipe is documented
+and an agent performs it, because a real model's comments are the team's and not loam's to reflow.
+Making the shape a key in `loam.json` or `likec4.config.json` — the file's grammar already decides
+how it can be read, and a key would be a second answer able to disagree with the first. Widening
+loam's fleet map to the renderer's root project — the map is graded as `architecture/` alone so
+that one broken service model cannot blank the fleet's own picture, which is why a cross-service
+flow in `architecture/usecases/` still names service elements and never a container. Retiring the
+standalone shape — it is what lets a service's docs be validated from the service's own repository,
+and a fleet that wants that keeps it, now with a check on the divergence it costs.
+
+**The deliberate remainder**, stated so nobody reads it as an oversight. A cross-service call still
+exists TWICE: container-level in the model, service-level in the map (#011's item 6). The spine,
+the platform census and every other fleet check read the map alone, and `landscape.service-isolated`
+remains the nudge that carries an attested call up into it. Thinning the map to elements plus
+cross-service edges is the [Later](#later--promote-only-from-evidence) "Landscape scaling" row, and
+it is what would remove the duplication. Beside it sits #011's item 5, also deliberate: a
+cross-service flow cannot name a container, because loam grades the fleet map as its own document
+set. Revisit that one when a fleet asks for a cross-service flow whose hops are containers — the
+renderer already resolves such a hop, so the ask will be concrete when it arrives.
+
+**Verified 2026-09-04**, and three things the verification changed. The report's own "next thing to
+check" was the one that did not compose: `loam archive` spliced a delta's nested additions into the
+fleet map, and the extending model could then never declare them — the service went `c4.invalid`
+(duplicate) the moment it wrote the container the adopt brief prescribed. The merge now ROUTES each
+addition to the document that owns the interior, and proves the merged model parses beside the
+merged map before writing either. Second, the consumer census read `architecture/` alone, so under
+this shape a private store's consuming edges — which live in the models now — counted for nothing:
+`landscape.datastore-private` went silent or named the wrong service, and a nested store two
+services reach was graded nowhere. It reads every extending model's attested calls now, and
+`landscape.datastore-shared` fires for a nested store. (That census still stands; the code named
+here does not — `landscape.datastore-private` was retired on 2026-09-07, because where a store is
+drawn is the team's choice. See the CHANGELOG entry.) Third, the wiring guard this entry landed
+failed open on every root `exclude` spelling except `services/<tree>/**`, `loam subsystem sync`
+never removed the stray per-service project file it told repositories to delete (and that file
+CLAIMS the model, rather than holding nothing as the design note said), and
+`c4.fleet-project-invalid` enumerated three roots rather than the renderer's — a `.likec4` in a
+subsystem directory was in none of them. All three are closed; CHANGELOG's `[Unreleased]` has the
+codes and keys.
+
+**The `import` question is answered.** Reports #010 and #011 left open whether LikeC4's
+cross-project `import` could have delivered this without merging the projects. Measured at the
+1.59.2 pin: an import resolves REFERENCES across projects, and that is all — it carries no
+`specification`, so a kind or tag the other project declares is not usable in this one, and it does
+not support `extend`. A model importing the map could name the map's elements and still not add a
+container to one. So the choice was never between two mechanisms; one project holding both
+documents is what the shape requires.
+
+**Known and carried, 2026-09-04.** The second verification round reproduced these and they were
+NOT fixed. Each is written down with the repro that finds it again, so nobody spends a second
+afternoon rediscovering one. They are carried, not closed.
+
+- **Only the basename `likec4.config.json` is surveyed.** LikeC4 1.59.2 also accepts `.likec4rc` and
+  six other spellings; drop `{"name":"svc-a"}` into `services/svc-a/.likec4rc` on a synced extending
+  fleet and `validate --all`, `doctor` and `subsystem sync` all stay green while the renderer loads
+  three projects and refuses without `--project`. Carried on scope: the survey, the stray grade and
+  `sync`'s delete list are one table, and widening it is the same change as the two rows below —
+  worth doing once, together, with the pin's whole name list measured rather than guessed.
+- **A `likec4.config.json` in a SUBSYSTEM directory claims every model beneath it.** Write one at
+  `services/platform/likec4.config.json` over three extending models and all three go
+  `Could not resolve reference to Element named 'svc_svc_d'` in the renderer, while loam names
+  nothing (`sync` → "nothing to write"). Carried on scope, with the row above: the checks look one
+  directory deep, at a service, and seeing this needs a walk of the whole docs tree.
+- **`sync` keeps a config beside a model that is GONE, and that leftover project is not harmless.**
+  `rm services/svc-c/model.likec4` with its config left behind: loam is green everywhere, and
+  `likec4 validate` — and `likec4 build` — at the docs root then need `--project`. The keep is
+  deliberate ("that one really is the team's"), but its premise, that an empty nested project is
+  invisible to the renderer, is false at the pin. Carried on a design decision pending: deleting a
+  file loam never wrote needs a rule about whose file it is, not a bug fix.
+- **`validate --feature` does not preview a merge refusal.** A delta drawing a cross-interior edge,
+  or naming a kind the map does not declare, validates clean and then refuses at `archive`
+  (`merge-failed`, nothing written). Carried on scope: the preview needs the archive's own merge
+  planner run from the validate path, which is a new seam rather than a message.
+- **In the STANDALONE shape a broken UNTAGGED sibling is invisible to loam.** Make one service
+  standalone, `subsystem sync`, then write an unresolvable `services/<id>/usecases/plain.likec4`:
+  loam prints `c4.valid` and 0 errors while `likec4 validate --project <id> .` is Invalid. The
+  extending shape catches the same file through `c4.fleet-project-invalid`. Carried on scope: the
+  per-service load reads the model, and reading the standalone project the renderer builds is a
+  second loader.
+- **A root `exclude` that no longer covers `features/**` is silent.** Delete that one entry from
+  `examples/docs`' config: loam reports 0 errors and `sync` says "nothing to write", while the
+  renderer's fleet project is at 346 errors. The scaffold always writes the entry, so this is a
+  hand edit, which is why it is carried rather than fixed — on the evidence bar: no repository has
+  hit it, and a grade on an entry loam did not write is a policy claim.
+- **A root config the renderer REJECTS is reported only by `sync`'s note.** `"exclude": "services/**"`
+  as a string, or an array-valued `include`, is "loaded 0 projects out of 1" — nothing renders — and
+  `validate --all` is green; an unparseable file is the same. Carried on scope: loam reads the file
+  for one key, and schema-validating somebody else's config is a dependency on the renderer's own
+  schema at the pin.
+- **`LivingSlice.landscape.modelled` is `false` where `adopt` says `null`.** Over an
+  `architecture/` project that did not parse, `loam context <svc> --json` says `modelled: false` and
+  `loam adopt --service <svc> --json` says `modelled: null` about the same tree. Carried on scope:
+  the field is typed non-nullable in the pack, so agreeing with `adopt` is a contract change.
+- **`loam show` never mentions graded intra-service flows.** With a healthy `#req-…`-tagged flow
+  beside an extending model — `validate --service` prints "· 1 tagged flow(s) graded" — neither
+  `loam show <svc>` nor its `--json` names it anywhere. Carried on scope: `show`'s payload is a
+  frozen shape and the flow needs a section of its own.
+- **`loam status` never names the isolated state.** `landscape.service-isolated` is a warning
+  `validate --all` prints and `status`'s next-action ladder has no rung for. Carried on a design
+  decision pending: the ladder is derived from artifact presence and provenance, and a finding-derived
+  rung is a different rule for what `next[0]` means.
+- **The first ever container-level flow a FEATURE brings.** A cross-service flow cannot name a
+  container, because loam grades the fleet map as its own document set; the renderer already resolves
+  such a hop. Carried deliberately — the [Later](#later--promote-only-from-evidence) "Landscape
+  scaling" row owns it, and it is promoted when a fleet asks, not before.
+
+#### Problem reports carry an ordinal, and loam reads the directory it prescribes
+
+**Landed 2026-09-04**, from one problem report (#012). The `loam-report` protocol prescribed a
+directory, a filename shape and a document structure and then stopped: files were named
+`YYYY-MM-DD-<slug>.md` with a numeric suffix only on collision — a collision breaker, not an
+identifier — so in a directory of eleven reports written in two days, none had one, four shared
+their first eleven characters, and the discriminating part of every name sat far to the right of
+what a terminal, a file picker or a chat message shows. There was no field anywhere in the document
+for the one piece of state a report has (three of the eleven were already closed and one superseded,
+all of it living in whoever remembered), and `validate --all`, `doctor`, `status` and `list`
+mentioned `loam-reports` zero times between them. Landed: an unconditional ordinal at the front of
+the name, which is the computation the protocol already described for its suffix applied where it is
+visible; a `Status:` line in the template with a four-value vocabulary a report closes by editing;
+and `loam doctor` reading the directory — total, per-status counts and the next ordinal — as an
+additive `reports` key and one human row. Rejected: a `loam report list` verb (a new command for a
+count `doctor` was already the place for, on a frozen CLI surface); an index file (the workaround
+this replaces — a second place to keep in step, and the reason the state left the files in the first
+place); grading the corpus (an open report is not a defect in the repository holding it, so `doctor`
+reports it as state and `healthy` never moves); parsing past the first word of the status line (the
+rest is prose an author writes for a reader). Cost: one `readdir` and one small read per report on
+every `loam doctor`, and nothing is transmitted — which is the constraint the protocol is built
+around and the reason the whole fix needed no new state.
+
+#### The adopt brief on an edgeless landscape element
+
+**Landed 2026-09-03**, from one problem report. `loam adopt` decided whether the fleet map still
+owed a service from element EXISTENCE: a bound element with no edge — what
+`loam seed --from fleet.yaml` leaves for every service absent from `calls:` — read as
+`landscape.instruction: null`, no target, `inbound: []`, `outbound: []` in one payload, so an agent
+following the protocol to the letter wrote a validating baseline and never drew one edge, and
+`loam validate --all` stayed green over it. Landed: a fourth landscape state carried by two
+additive keys (`landscape.touched`, and `landscape.attested` — the calls the service's own
+model.likec4 declares across its boundary, derived once in `core/c4/resolve/attested.ts` for the
+brief and the fleet check alike, so the two can never name different edges); a non-null instruction
+in two arms (carry each attested call up as one edge on the existing element, naming the other
+party as the map spells it; or, with nothing attested, draw NOTHING rather than invent — an edgeless
+element that is true is a fact); the landscape target back as an edge-only `edit` whose shape
+refuses a second element; the `EDGELESS` flag in the text view; the evidence-gated
+`landscape.service-isolated` warning under `--all`; and a seventeenth unchecked statement about
+visibility (placeholder tags, curated views, `include *` over a boundary). Rejected: folding the
+state into `landscape.modelled` (an agent told `false` draws a second box); an unconditional "no
+edge touches it" warning (no correct fix for a worker that calls nothing, and every seeded fleet
+red-ish until adoption); grading the SET DIFFERENCE between the attested calls and the drawn edges
+(loam cannot tell a call the map forgot from one the fleet does not draw at its own altitude, so
+the difference reported as an omission is an invented edge with a code beside it — the check stays
+touched/untouched, and the brief says so out loud); a check on placeholder tags or on what a view
+shows (rule 26 — loam never
+computes what a view shows). Cost: one LikeC4 load of `model.likec4`, only in the edgeless state, a
+memo hit under `--all`.
+
+**Corrected 2026-09-04** by the verification of this entry: the brief read
+`architecture/landscape.likec4` alone where the fleet check reads the whole `architecture/` project,
+so a fleet keeping a second `model { }` block in a sibling got a brief demanding edges it had
+already drawn while `validate --all` reported `landscape.matched`. Both now read the project.
+
+#### A home for an intra-service use case
+
+**Landed 2026-09-03.** Measured: `architecture/usecases/` cannot resolve a container (one such file
+is `landscape.invalid` plus a `spine.landscape-invalid` per service), and a view beside the model
+rendered while nothing graded it. Landed: the service's own LikeC4 project as the slot — every
+`.likec4` beside model.likec4 and any tagged view inside it — graded by `validate --service`/`--all`
+with the five existing `usecase.*` codes, `#req-` scoped by the service's own Requirement-IDs,
+`#cap-` refused by placement, a broken sibling one `usecase.flow-invalid` while the model keeps
+grading; plus the tier-2 skip and the fourth `step-unlinked` guard in the shared graders. Rejected:
+a fixed `usecases/` directory alone (the reporter's `views.likec4` would render ungraded),
+`views.likec4` alone (a second file would be invisible), a new code for the broken sibling (nothing
+branches differently), gating the read on `likec4.config.json` (create-only, deletable). Cost: one
+recursive readdir per service; a workspace only where a view in model.likec4 opts in or a sibling
+mentions a reserved prefix anywhere in its bytes — an untagged sibling is never graded, and once
+the workspace is loaded a project that does not read is one `usecase.flow-invalid` whether or not a
+view opted in.
 
 #### The service model, renderable from the fleet root
 
@@ -177,6 +387,13 @@ that project (LikeC4 projects are separate models); and the project name is not
 billing-core, `service-fleet` beside `fleet`), disclosed in SCHEMA rather than escaped away,
 because the picker shows the id.
 
+**Superseded for extending models, one day later.** The last of those costs — one picker entry per
+adopted service — is what report #009 measured at 57 entries, and the entry that opens this list is
+what removed its cause rather than its symptom: a model that extends the fleet map shares the root
+project with it, so it is owed no project file and adds no entry, and `loam subsystem sync` writes
+the file only for a model that stands alone. Everything measured here still holds for that shape,
+and is why it is still supported; it is no longer what a new model is written as.
+
 #### The generated subsystem views — a label, a boundary, and one reader of the map
 
 **Landed 2026-09-03.** Three problem reports from a fleet running loam, one axis. The generated
@@ -197,6 +414,20 @@ use-case document binding one element could produce a `subsystem.views-stale` th
 `loam subsystem sync` reported as `current` — reproduced on `examples/docs`, and fixed by pointing
 both sides at the same read.
 
+**And the repository's palette (2026-09-03).** A generated view can carry no inline `style` rule —
+the file is regenerated wholesale — and the one mechanism LikeC4 gives a view for borrowing a
+repository's styling is a reference to a global style by id, which is a parse error that blanks the
+whole `architecture/` project when nothing declares it. So the convention is one reserved name:
+declare `global { styleGroup subsystems { … } }` anywhere in the `architecture/` project and every
+generated view references it; declare nothing and the file is what it was. Rejected: reading the id
+off a key in `likec4.config.json` (create-only, never re-read, and not a LikeC4 document whose
+contents a parse can check), and "reference the single declared group" (a second group declared for
+a hand-drawn view would silently switch the generated views' styling off and restale the file on a
+change that touched no subsystem). The presence read is a census of the keys of
+`$data.globals.styles`, a declaration read like `specification`; seven tripwire assertions in
+`test/likec4-view-shape.test.ts` pin the shape so a likec4 bump fails there before it reaches a
+generated file.
+
 #### The deployment axis — topology joined to requirements
 
 **Promoted 2026-09-02, and authored as a feature in loam's own docs repo** rather than as an item
@@ -435,9 +666,52 @@ item gets promoted — it went from here to `## Now` and from there to
   for every fleet that never writes one. Promote only on evidence from a second fleet, after living
   with the disclosure — the first report classified itself `inconclusive`, and one fleet is not
   enough to qualify an invariant that says placement is never part of any identity.
-- **Landscape scaling:** retain one landscape while conflicts are exceptional. If same-service
-  conflicts become routine — the current trigger in [SCHEMA.md](SCHEMA.md) is weekly rather than
-  monthly — evaluate service-owned model files plus a thin global cross-service map. Migration must
+- **A feature brings an intra-service flow.** `features/<FEAT>/specs/<svc>/usecases/<name>.likec4`,
+  copied create-only by `loam archive` into `services/<…>/<svc>/usecases/` and taken back by
+  `loam unarchive`, graded before the copy against the service's own LikeC4 project with the
+  feature's `specs/<svc>/` requirement deltas in `#req-` scope — `usecase.flow-exists` and
+  `usecase.flow-invalid` reused, never `--approve`-overridable. Deliberately NOT built with the
+  living slot (2026-09-03): the version-3 snapshot manifest already carries an artifact path with a
+  directory in it, so nothing about the undo changes when it lands, and no model delta exists to
+  preview — what it waits for is one fleet asking for a container-level flow to ship in the same
+  change as the `arch.spec.md` requirement it answers. Until then a service-local flow is written
+  directly into the service directory in the same pull request, where git produces the conflict;
+  building the feature route ahead of that evidence is the invented need the non-goals forbid.
+- **A subsystem-scoped use-case slot.** A flow whose hops all sit inside one subsystem's subtree
+  looks like it wants a home between the two that exist — `architecture/usecases/` is the fleet's
+  slot, `services/<…>/<svc>/usecases/` is one service's. Deliberately NOT built (2026-09-07), and
+  the reason is that the capability is already there: a subsystem-scoped flow IS a fleet use case
+  whose hops happen to share a subtree, `architecture/usecases/<name>.likec4` already grades it, and
+  its view already folds into the same title-path folders as the generated subsystem view above it.
+  A second slot would duplicate the grader, the tag vocabulary and the archive route for no
+  capability that does not exist today. Promote only on evidence that a fleet's subsystem flows are
+  being lost among its fleet flows in the renderer's view list — which is a naming problem before it
+  is a slot problem, and one the title convention answers first.
+- **A flow-untagged check** (it would be spelled usecase.flow-untagged): a `.likec4` beside a
+  service's model that mentions a `req-` prefix while no view in that project carries the tag — an
+  author who reached for the intra-service use-case axis and missed, whose flow renders and is
+  graded by nothing. It grades a view that EXISTS rather than an absence, so docs/DESIGN.md rule 26
+  permits it, unlike the service.usecases-missing nobody may ever build. Not built (2026-09-07) for
+  a mechanical reason worth stating: `core/brief/checks.ts` sits at 399 of 400 lines inside a
+  five-file-capped package, so a new non-ok code forces a split-module commit before any behaviour
+  can land, and that split should be chosen for a seam rather than for a code. Promote when a second
+  fleet reports a flow that rendered and was graded by nothing.
+- **Landscape scaling:** retain one landscape while conflicts are exceptional, and half of what
+  this row once asked for arrived on 2026-09-04. Per-service internals now live in
+  `services/<svc>/model.likec4` by default: `loam archive` routes a delta's fqn-spelled interior
+  into the owning service's extending model, and a team adopting a service adds nothing to
+  `architecture/landscape.likec4` but one element and its cross-service edges. The map holds a
+  service's interior only where a team puts it on purpose — a store nested under its owner so a
+  second service can name it (SCHEMA's "Private stores") — or where a delta spells its parent by
+  title rather than by the map's id (the archive's documented remainder). What is
+  left is the CROSS-SERVICE EDGE, which still exists twice — container-level in the model,
+  service-level in the map — and that duplication is **deliberate**, not a leftover: the spine, the
+  platform census, `landscape.service-isolated` and every other fleet check read the map alone,
+  which is what lets a fleet answer "who calls this service" from one diffable document without
+  parsing sixty. Thinning the map to elements plus cross-service edges means teaching those checks
+  to read the edges out of the models that attest them, and paying the blast radius that comes with
+  it. If same-service conflicts become routine — the current trigger in [SCHEMA.md](SCHEMA.md) is
+  weekly rather than monthly — evaluate that. Migration must
   preserve archive/undo, deterministic resolution, and readable plain files.
 - **Authored business axis — PROMOTED 2026-08-27, and landed in full; see
   [Recently landed](#recently-landed).** The gate asked for evidence of authorship: analyst edits