@ybotok/loam 0.2.0-alpha.5 → 0.2.0-alpha.7

package/dist/core/c4/splice/identity/declared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/declared.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAenE;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAmD,EACnD,OAAwB;IAExB,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACjF,kEAAkE;IAClE,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,wBAAwB;IACxB,MAAM,SAAS,GAAG,CAAC,EAAU,EAA+B,EAAE;QAC5D,KAAK,MAAM,SAAS,IAAI,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACrC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC;QAC5C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;YACrC,0EAA0E;YAC1E,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;gBAAE,SAAS;YAChC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,SAAS;YACpC,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAChC,IAAI,OAAO,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,OAAO;QACL,GAAG;QACH,aAAa,EAAE,CAAC,EAAE,EAAE,KAAK,EAAW,EAAE;YACpC,MAAM,OAAO,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC9B,OAAO,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,QAAQ,CAAC,OAAwB,EAAE,KAAa;IACvD,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,GAAG,KAAK,EAAE,CAAC;AAChD,CAAC","sourcesContent":["/**\n * What the fleet's extending models ALREADY declare — the half of the archive's\n * existence check that does not live on the map.\n *\n * The check has two joins: by id, and by TITLE for a delta that spells an\n * element under its own identifier rather than the map's. Only the id half ever\n * learned about the models the merge now writes into, so a container a service\n * already draws under a different id was spliced in beside itself and the\n * service silently grew two boxes with one name — while the SAME delta against\n * the same title ON THE MAP adds nothing (review of E1). One rule, two\n * documents, two answers.\n *\n * THE MODEL HALF IS SCOPED TO ITS SERVICE, and the map's is deliberately not.\n * The map's global title index is the id-less fallback for documents written\n * before `metadata { service }` existed, and it carries a hazard its own\n * comment states: two services' boxes sharing a title join to each other unless\n * both sides are bound. A service's interior is exactly where that would bite —\n * every extending model in a fleet names a container 'api' — so a model's\n * declaration joins by title only against an addition resolving to the SAME\n * explicitly bound service. Either side unbound means no title join at all: an\n * addition landing beside a namesake is a duplicate the author can see, and a\n * wrongly skipped one is a container that quietly never arrived.\n *\n * The reader is the SCAN and not a parse, for the reason the caller states: ids\n * are exact inside the fqn namespace the map and its models share, and parsing\n * every model here would cost one LikeC4 workspace per service to answer a\n * question about text. Two kinds of declaration therefore carry no title, and\n * neither loses anything: one whose head names no title (LikeC4 titles it after\n * its own name, and a model's default and a delta's differ exactly when their\n * ids do — which the id join already covers) and one writing its title as a\n * body property.\n */\nimport { ancestorIds } from \"../../../kernel/ids/fqn/ancestors.js\";\nimport type { DeclaredService } from \"../../../kernel/ids/service.js\";\nimport type { Elem } from \"../../likec4.js\";\nimport type { ScannedModel } from \"../../source-scan.js\";\n\nexport interface ModelDeclarations {\n  /** Every id an extending model declares — the id join's share, and exact. */\n  ids: string[];\n  /**\n   * True when some model already declares an element titled `title` inside the\n   * service `id` resolves to. False whenever either side is unbound.\n   */\n  declaresTitle: (id: string, title: string) => boolean;\n}\n\n/**\n * Index the scanned models.\n *\n * `bindEls` is the corpus the service binding resolves against — the living\n * map's elements plus the delta's, the same one routing uses, because a model's\n * declaration is bound by an ancestor the MAP owns and a delta's addition by an\n * ancestor either document may.\n */\nexport function modelDeclarations(\n  scans: ReadonlyArray<{ scan: ScannedModel | null }>,\n  bindEls: readonly Elem[],\n): ModelDeclarations {\n  const bound = new Map<string, DeclaredService>();\n  for (const e of bindEls) if (e.service !== undefined) bound.set(e.id, e.service);\n  // An EXPLICIT binding on the id or an ancestor, and nothing else.\n  // `serviceResolver`'s last rung answers with the element's own title or its\n  // raw id — the rung its own comment calls the one that lies — and here that\n  // would file two unbound services' containers under invented names and then\n  // let those names join.\n  const serviceOf = (id: string): DeclaredService | undefined => {\n    for (const candidate of ancestorIds(id)) {\n      const service = bound.get(candidate);\n      if (service !== undefined) return service;\n    }\n    return undefined;\n  };\n  const ids: string[] = [];\n  const titles = new Set<string>();\n  for (const { scan } of scans) {\n    for (const e of scan?.elements ?? []) {\n      // An `extend` frame declares nothing: it reopens an element the map owns.\n      if (e.extend === true) continue;\n      ids.push(e.id);\n      if (e.title === undefined) continue;\n      const service = serviceOf(e.id);\n      if (service !== undefined) titles.add(titleKey(service, e.title));\n    }\n  }\n  return {\n    ids,\n    declaresTitle: (id, title): boolean => {\n      const service = serviceOf(id);\n      return service !== undefined && titles.has(titleKey(service, title));\n    },\n  };\n}\n\n/** Length-prefixed: a service id and a title cannot spell another pair's key. */\nfunction titleKey(service: DeclaredService, title: string): string {\n  return `${service.length}:${service}${title}`;\n}\n"]}

package/dist/core/c4/splice/identity/edges.js

@@ -1,3 +1,20 @@
+/**
+ * Which AUTHORED STATEMENT a parsed addition was written as — the key that
+ * matches a `Rel` back to its bytes in delta.likec4, so the splice carries the
+ * declaration verbatim instead of re-serializing it.
+ *
+ * Stricter than `relKey` below on purpose, and asking a different question:
+ * `relKey` decides whether the living document already HAS this edge, across
+ * two id namespaces, so it joins on titles; this one runs inside ONE document
+ * where ids are exact, and it must tell apart two statements the merge would
+ * otherwise hand each other's bytes. Both endpoints, the title, all three spine
+ * keys and the tags, because a pool entry shared by two additions gives the
+ * second one the first one's authored source.
+ */
+export function relStatementKey(r) {
+    const spine = [r.op ?? "", r.publishes ?? "", r.consumes ?? ""];
+    return JSON.stringify([r.source, r.target, r.title ?? "", ...spine, [...r.tags].sort()]);
+}
 /**
  * The order of loam-inserted relationships that share a landing region:
  * (source title, target title, the three spine keys, title) as one comparable

package/dist/core/c4/splice/identity/edges.js.map

@@ -1 +1 @@
-{"version":3,"file":"edges.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/edges.ts"],"names":[],"mappings":"AAoBA;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,GAAW,EACX,CAAyG;IAEzG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,CAAM;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,EAAU;IAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;AACxD,CAAC","sourcesContent":["/**\n * How the landscape merge decides that two relationships are the SAME EDGE,\n * and in what order equal ones are written.\n *\n * A subject of its own, and not a corner of placement: everything in\n * `../placement.ts` answers *where in the text* a statement goes, in byte\n * offsets, while everything here answers *which statement this is*, as a\n * comparable string. The merge asks the identity question first and the\n * placement question second, and getting the first one wrong is the failure\n * mode that is silent — a delta edge that hashes the same as a living one is\n * counted as already present and dropped at exit 0, with `+0 relationship(s)`\n * printed over a binding that never reached the map.\n *\n * Both keys are built from fields BOTH `Rel` and `ScannedRel` carry, because\n * the same edge must key identically as today's addition and as a statement in\n * the next archive's scan of the file it was written into. A field only one of\n * them has would make the merge disagree with itself one archive later.\n */\nimport type { Elem, Rel } from \"../../likec4.js\";\n\n/**\n * The order of loam-inserted relationships that share a landing region:\n * (source title, target title, the three spine keys, title) as one comparable\n * string. Titles, not ids — the namespaces differ. The same edge must sort\n * identically as today's addition and as a statement in the next archive's\n * scan, so every field is one BOTH `Rel` and `ScannedRel` carry.\n */\nexport function relSortKey(\n  els: Elem[],\n  r: { source: string; target: string; title?: string; op?: string; publishes?: string; consumes?: string },\n): string {\n  const spine = [r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\"];\n  return JSON.stringify([titleOf(els, r.source), titleOf(els, r.target), ...spine, r.title ?? \"\"]);\n}\n\n/**\n * What makes two edges the same edge. Endpoints are compared by TITLE, which is\n * stable across the delta's and the landscape's id namespaces.\n *\n * An edge carrying a SPINE KEY — `op`, `publishes` or `consumes` — IS that call\n * or that message, whatever it is titled: retitling it must not merge a second\n * copy. An edge with none has only its title. Separate namespaces, because they\n * are separate things: an op-less edge titled `authorizePayment` is not the edge\n * whose operationId is authorizePayment, and keying on `op ?? title` quietly\n * merged only one of them.\n *\n * ALL THREE keys, not just `op`. While the other two were out, a delta edge differing from a\n * living one only by `metadata { publishes 'x' }` hashed the same, counted as already present,\n * and was dropped — `+0 relationship(s)` at exit 0 over a binding that never reached the map.\n */\nexport function relKey(els: Elem[], r: Rel): string {\n  const src = titleOf(els, r.source);\n  const tgt = titleOf(els, r.target);\n  const spine = [r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\"];\n  return JSON.stringify(spine.some((v) => v !== \"\") ? [\"spine\", src, tgt, ...spine] : [\"title\", src, tgt, r.title ?? \"\"]);\n}\n\nexport function titleOf(elements: Elem[], id: string): string {\n  return elements.find((e) => e.id === id)?.title ?? id;\n}\n"]}
+{"version":3,"file":"edges.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/edges.ts"],"names":[],"mappings":"AAqBA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,CAAmB;IACjD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,GAAW,EACX,CAAyG;IAEzG,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,CAAM;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1H,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,QAAgB,EAAE,EAAU;IAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;AACxD,CAAC","sourcesContent":["/**\n * How the landscape merge decides that two relationships are the SAME EDGE,\n * and in what order equal ones are written.\n *\n * A subject of its own, and not a corner of placement: everything in\n * `../placement.ts` answers *where in the text* a statement goes, in byte\n * offsets, while everything here answers *which statement this is*, as a\n * comparable string. The merge asks the identity question first and the\n * placement question second, and getting the first one wrong is the failure\n * mode that is silent — a delta edge that hashes the same as a living one is\n * counted as already present and dropped at exit 0, with `+0 relationship(s)`\n * printed over a binding that never reached the map.\n *\n * Both keys are built from fields BOTH `Rel` and `ScannedRel` carry, because\n * the same edge must key identically as today's addition and as a statement in\n * the next archive's scan of the file it was written into. A field only one of\n * them has would make the merge disagree with itself one archive later.\n */\nimport type { Elem, Rel } from \"../../likec4.js\";\nimport type { ScannedRel } from \"../../source-scan.js\";\n\n/**\n * Which AUTHORED STATEMENT a parsed addition was written as — the key that\n * matches a `Rel` back to its bytes in delta.likec4, so the splice carries the\n * declaration verbatim instead of re-serializing it.\n *\n * Stricter than `relKey` below on purpose, and asking a different question:\n * `relKey` decides whether the living document already HAS this edge, across\n * two id namespaces, so it joins on titles; this one runs inside ONE document\n * where ids are exact, and it must tell apart two statements the merge would\n * otherwise hand each other's bytes. Both endpoints, the title, all three spine\n * keys and the tags, because a pool entry shared by two additions gives the\n * second one the first one's authored source.\n */\nexport function relStatementKey(r: Rel | ScannedRel): string {\n  const spine = [r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\"];\n  return JSON.stringify([r.source, r.target, r.title ?? \"\", ...spine, [...r.tags].sort()]);\n}\n\n/**\n * The order of loam-inserted relationships that share a landing region:\n * (source title, target title, the three spine keys, title) as one comparable\n * string. Titles, not ids — the namespaces differ. The same edge must sort\n * identically as today's addition and as a statement in the next archive's\n * scan, so every field is one BOTH `Rel` and `ScannedRel` carry.\n */\nexport function relSortKey(\n  els: Elem[],\n  r: { source: string; target: string; title?: string; op?: string; publishes?: string; consumes?: string },\n): string {\n  const spine = [r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\"];\n  return JSON.stringify([titleOf(els, r.source), titleOf(els, r.target), ...spine, r.title ?? \"\"]);\n}\n\n/**\n * What makes two edges the same edge. Endpoints are compared by TITLE, which is\n * stable across the delta's and the landscape's id namespaces.\n *\n * An edge carrying a SPINE KEY — `op`, `publishes` or `consumes` — IS that call\n * or that message, whatever it is titled: retitling it must not merge a second\n * copy. An edge with none has only its title. Separate namespaces, because they\n * are separate things: an op-less edge titled `authorizePayment` is not the edge\n * whose operationId is authorizePayment, and keying on `op ?? title` quietly\n * merged only one of them.\n *\n * ALL THREE keys, not just `op`. While the other two were out, a delta edge differing from a\n * living one only by `metadata { publishes 'x' }` hashed the same, counted as already present,\n * and was dropped — `+0 relationship(s)` at exit 0 over a binding that never reached the map.\n */\nexport function relKey(els: Elem[], r: Rel): string {\n  const src = titleOf(els, r.source);\n  const tgt = titleOf(els, r.target);\n  const spine = [r.op ?? \"\", r.publishes ?? \"\", r.consumes ?? \"\"];\n  return JSON.stringify(spine.some((v) => v !== \"\") ? [\"spine\", src, tgt, ...spine] : [\"title\", src, tgt, r.title ?? \"\"]);\n}\n\nexport function titleOf(elements: Elem[], id: string): string {\n  return elements.find((e) => e.id === id)?.title ?? id;\n}\n"]}

package/dist/core/c4/splice/identity/existing.js

@@ -0,0 +1,80 @@
+import { scanModel } from "../../source-scan.js";
+import { modelDeclarations } from "./declared.js";
+import { relKey } from "./edges.js";
+/**
+ * Report (never guess) when a title join would cross two bound services: with
+ * both sides carrying an explicit `metadata { service }` binding and every
+ * binding disagreeing, they are provably DIFFERENT services' boxes sharing a
+ * title ('API', 'Database'). Skipping would silently drop the addition, and any
+ * delta edge into it would then refuse the whole archive at the merge's parse
+ * net with a message about nothing.
+ */
+export function newAdditions(req) {
+    const { livingEls, livingRels, bindEls, deltaElements, candidates, models } = req;
+    const modelScans = models.map((model) => ({ scan: scanModel(model.text) }));
+    const declared = modelDeclarations(modelScans, bindEls);
+    const haveIds = new Set([...livingEls.map((e) => e.id), ...declared.ids]);
+    // The title join needs the matched element back, not just membership: the
+    // cross-service guard below compares service BINDINGS across the join.
+    const byTitle = new Map();
+    const seeTitle = (el) => {
+        byTitle.set(el.title, [...(byTitle.get(el.title) ?? []), el]);
+    };
+    for (const el of livingEls)
+        seeTitle(el);
+    const els = [];
+    for (const e of candidates.els) {
+        if (haveIds.has(e.id))
+            continue;
+        // The addition's OWN service first, and before the map's global title
+        // index: a box this service's model already draws is existence, whoever
+        // else on the map happens to share the title.
+        if (declared.declaresTitle(e.id, e.title))
+            continue;
+        const sameTitle = byTitle.get(e.title);
+        if (sameTitle !== undefined) {
+            // A title match is the id-less fallback join, and skipping on it is only
+            // safe when the two sides could be the same box.
+            if (e.service !== undefined && sameTitle.every((m) => m.service !== undefined && m.service !== e.service)) {
+                return { els, rels: [], declaredIds: new Set(declared.ids), collision: { addition: e, living: sameTitle[0] } };
+            }
+            // KNOWN (narrowed by the guard above): with EITHER side unbound the title
+            // join stays trusting — the unbound title-fallback is the legal legacy
+            // pattern — so a cross-service collision hiding behind an unbound element
+            // is still silently skipped here. Scoping titles per service is backlog.
+            continue;
+        }
+        haveIds.add(e.id);
+        seeTitle(e);
+        els.push(e);
+    }
+    // An edge already in the landscape consumes one delta edge of the same
+    // identity, which is what keeps re-archiving idempotent.
+    const have = new Map();
+    for (const r of livingRels) {
+        const k = relKey(livingEls, r);
+        have.set(k, (have.get(k) ?? 0) + 1);
+    }
+    // An edge an extending model already draws consumes a delta edge exactly as a
+    // living map edge does — keyed through the DELTA's elements, because the
+    // model spells its endpoints in the map's fqn namespace and the delta must
+    // too for the nesting to resolve at all.
+    for (const { scan } of modelScans) {
+        for (const r of scan?.rels ?? []) {
+            const k = relKey(deltaElements, r);
+            have.set(k, (have.get(k) ?? 0) + 1);
+        }
+    }
+    const rels = [];
+    for (const r of candidates.rels) {
+        const k = relKey(deltaElements, r);
+        const n = have.get(k) ?? 0;
+        if (n > 0) {
+            have.set(k, n - 1);
+            continue;
+        }
+        rels.push(r);
+    }
+    return { els, rels, declaredIds: new Set(declared.ids) };
+}
+//# sourceMappingURL=existing.js.map

package/dist/core/c4/splice/identity/existing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"existing.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/existing.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AA8CpC;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,GAAoB;IAC/C,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IAClF,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,EAAQ,EAAQ,EAAE;QAClC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,SAAS;QAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;IACzC,MAAM,GAAG,GAAW,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,GAAG,EAAE,CAAC;QAC/B,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAChC,sEAAsE;QACtE,wEAAwE;QACxE,8CAA8C;QAC9C,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC;YAAE,SAAS;QACpD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,yEAAyE;YACzE,iDAAiD;YACjD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1G,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC;YAClH,CAAC;YACD,0EAA0E;YAC1E,uEAAuE;YACvE,0EAA0E;YAC1E,yEAAyE;YACzE,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClB,QAAQ,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,yDAAyD;IACzD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,8EAA8E;IAC9E,yEAAyE;IACzE,2EAA2E;IAC3E,yCAAyC;IACzC,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAU,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACV,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACnB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3D,CAAC","sourcesContent":["/**\n * Which of a delta's tagged declarations the living fleet does NOT already have\n * — the third identity question of the archive's C4 merge, beside `./edges.ts`'s\n * \"which statement is this\" and `./owner.ts`'s \"which document owns it\".\n *\n * It moved out of `../landscape-merge.ts` when that file crossed the 400-line\n * limit, and this is the seam it wanted: everything here runs BEFORE a single\n * byte is placed, over parsed views and scans alone, and answers one question\n * that has nothing to do with where anything lands. What is left behind is the\n * splice itself.\n *\n * TWO JOINS, and the asymmetry between them is the whole subject. Ids are exact\n * and are checked against the map AND against every extending model, so\n * re-archiving is idempotent whichever document an addition landed in. Titles\n * are the id-less fallback every repository written before\n * `metadata { service }` relies on: global on the map (with the cross-service\n * collision refused rather than silently skipped) and scoped to one service in\n * the models, for the reason `./declared.ts` states.\n *\n * Relationships are matched by COUNT, not by membership: two edges the model\n * cannot tell apart are still two edges, and dropping the second one silently\n * loses a call the author drew.\n */\nimport type { Elem, Rel } from \"../../likec4.js\";\nimport { scanModel } from \"../../source-scan.js\";\nimport type { ExtendingModel } from \"../contract.js\";\nimport { modelDeclarations } from \"./declared.js\";\nimport { relKey } from \"./edges.js\";\n\nexport interface ExistingRequest {\n  /** The living map's parsed elements. */\n  livingEls: Elem[];\n  /** The living map's parsed relationships. */\n  livingRels: Rel[];\n  /**\n   * The corpus a service binding resolves against — the living map's elements\n   * plus the delta's, so a declaration the delta introduces resolves the moment\n   * its bytes would land.\n   */\n  bindEls: Elem[];\n  /** EVERY element the delta declares — edge identity reads past the tagged ones. */\n  deltaElements: Elem[];\n  /** The delta's tagged elements and relationships: the candidate additions. */\n  candidates: { els: Elem[]; rels: Rel[] };\n  /** The fleet's extending models, whose declarations count as existence too. */\n  models: readonly ExtendingModel[];\n}\n\nexport interface Additions {\n  /** The tagged elements no living document already declares. */\n  els: Elem[];\n  /** The tagged relationships no living document already draws. */\n  rels: Rel[];\n  /**\n   * Every id the extending models declare. Routing needs it as well: an\n   * `extend` block's children are map fqns, so a container a model already draws\n   * anchors an addition's id chain in the map's namespace exactly as a living\n   * element does (`./owner.ts`).\n   */\n  declaredIds: Set<string>;\n  /**\n   * A title join the merge must refuse rather than take, present only when one\n   * was found — the caller stops there and nothing is written.\n   *\n   * REPORTED, not thrown, and that is a package rule rather than a style\n   * preference: `LandscapeSpliceError` lives in `../contract.ts`, and importing\n   * it as a VALUE from here would make `splice/` and `splice/identity/` import\n   * each other (`scripts/package-graph.mjs` refuses the cycle). The refusal text\n   * belongs to the merge anyway — it is the one that decides to write.\n   */\n  collision?: { addition: Elem; living: Elem };\n}\n\n/**\n * Report (never guess) when a title join would cross two bound services: with\n * both sides carrying an explicit `metadata { service }` binding and every\n * binding disagreeing, they are provably DIFFERENT services' boxes sharing a\n * title ('API', 'Database'). Skipping would silently drop the addition, and any\n * delta edge into it would then refuse the whole archive at the merge's parse\n * net with a message about nothing.\n */\nexport function newAdditions(req: ExistingRequest): Additions {\n  const { livingEls, livingRels, bindEls, deltaElements, candidates, models } = req;\n  const modelScans = models.map((model) => ({ scan: scanModel(model.text) }));\n  const declared = modelDeclarations(modelScans, bindEls);\n  const haveIds = new Set([...livingEls.map((e) => e.id), ...declared.ids]);\n  // The title join needs the matched element back, not just membership: the\n  // cross-service guard below compares service BINDINGS across the join.\n  const byTitle = new Map<string, Elem[]>();\n  const seeTitle = (el: Elem): void => {\n    byTitle.set(el.title, [...(byTitle.get(el.title) ?? []), el]);\n  };\n  for (const el of livingEls) seeTitle(el);\n  const els: Elem[] = [];\n  for (const e of candidates.els) {\n    if (haveIds.has(e.id)) continue;\n    // The addition's OWN service first, and before the map's global title\n    // index: a box this service's model already draws is existence, whoever\n    // else on the map happens to share the title.\n    if (declared.declaresTitle(e.id, e.title)) continue;\n    const sameTitle = byTitle.get(e.title);\n    if (sameTitle !== undefined) {\n      // A title match is the id-less fallback join, and skipping on it is only\n      // safe when the two sides could be the same box.\n      if (e.service !== undefined && sameTitle.every((m) => m.service !== undefined && m.service !== e.service)) {\n        return { els, rels: [], declaredIds: new Set(declared.ids), collision: { addition: e, living: sameTitle[0]! } };\n      }\n      // KNOWN (narrowed by the guard above): with EITHER side unbound the title\n      // join stays trusting — the unbound title-fallback is the legal legacy\n      // pattern — so a cross-service collision hiding behind an unbound element\n      // is still silently skipped here. Scoping titles per service is backlog.\n      continue;\n    }\n    haveIds.add(e.id);\n    seeTitle(e);\n    els.push(e);\n  }\n\n  // An edge already in the landscape consumes one delta edge of the same\n  // identity, which is what keeps re-archiving idempotent.\n  const have = new Map<string, number>();\n  for (const r of livingRels) {\n    const k = relKey(livingEls, r);\n    have.set(k, (have.get(k) ?? 0) + 1);\n  }\n  // An edge an extending model already draws consumes a delta edge exactly as a\n  // living map edge does — keyed through the DELTA's elements, because the\n  // model spells its endpoints in the map's fqn namespace and the delta must\n  // too for the nesting to resolve at all.\n  for (const { scan } of modelScans) {\n    for (const r of scan?.rels ?? []) {\n      const k = relKey(deltaElements, r);\n      have.set(k, (have.get(k) ?? 0) + 1);\n    }\n  }\n  const rels: Rel[] = [];\n  for (const r of candidates.rels) {\n    const k = relKey(deltaElements, r);\n    const n = have.get(k) ?? 0;\n    if (n > 0) {\n      have.set(k, n - 1);\n      continue;\n    }\n    rels.push(r);\n  }\n  return { els, rels, declaredIds: new Set(declared.ids) };\n}\n"]}

package/dist/core/c4/splice/identity/interior.js

@@ -0,0 +1,80 @@
+/**
+ * `./owner.ts`'s question one construct up: not "whose interior is this id" but
+ * "does this whole NEW BLOCK hand its interior over" — decided ONCE per block,
+ * and read by BOTH halves of the archive's routing.
+ *
+ * A service the feature INTRODUCES arrives as one tagged element whose authored
+ * bytes already hold its containers. Those containers carry no feature tag of
+ * their own — LikeC4 does not inherit tags — so per-addition routing cannot see
+ * them: they rode onto the map inside their parent, and the service's extending
+ * model could then never declare them, because writing the container the adopt
+ * brief prescribes made the map's copy a duplicate and the service `c4.invalid`
+ * (verification 2026-09-04, refutation of E1). So the box lands on the map
+ * without its interior and the children go into the model's `extend <fqn> { }`
+ * block, which `../model/merge.ts` creates.
+ *
+ * ONE DECISION, NOT TWO, and that is the whole reason this is a module rather
+ * than a closure inside `../landscape-merge.ts`. A child of such a block CAN
+ * carry the feature tag, and then both halves see it: per-addition routing reads
+ * its tag and sends it to the model, while the block decision leaves the same
+ * child's bytes on the map. Each half was right on its own and the merge
+ * declared the child twice — `merge-failed`, exit 1, nothing written, on a delta
+ * neither half was wrong about (re-verification 2026-09-04). `covering` is what
+ * makes the routing defer: a declaration written inside a block is the BLOCK's
+ * to place, whether or not it is tagged.
+ *
+ * A block holding a RELATIONSHIP statement rides whole. Such an edge names its
+ * endpoints by their LOCAL names inside the block, and the model merge anchors a
+ * relationship at the model block's top level — splitting the two apart would
+ * leave the map naming children it no longer declares, and `api -> worker` at a
+ * model's top level resolves to nothing. The edge rides with its block, for the
+ * same reason its siblings do.
+ */
+import { parentIdOf } from "../../../kernel/ids/fqn/ancestors.js";
+export function planInteriors(req) {
+    const { scan, deltaElements, owner, addedEls } = req;
+    const byId = new Map(scan.elements.map((e) => [e.id, e]));
+    const blocks = [];
+    const routed = [];
+    const omit = [];
+    for (const e of addedEls) {
+        // A block is an addition that lands on the MAP (nothing owns its parent)
+        // and whose own interior belongs to a model. An addition routed away is not
+        // a block: its children ride inside its bytes into the same model, which is
+        // `../model/merge.ts`'s own `rides` rule.
+        if (owner(parentIdOf(e.id)) !== undefined)
+            continue;
+        const model = owner(e.id);
+        if (model === undefined)
+            continue;
+        // Not in the scan: the splice loop refuses on its own, with the message that
+        // names the declaration it could not locate.
+        const src = byId.get(e.id);
+        if (src === undefined)
+            continue;
+        const kids = scan.elements.filter((c) => parentIdOf(c.id) === e.id);
+        if (kids.length === 0)
+            continue;
+        const els = kids
+            .map((c) => deltaElements.find((x) => x.id === c.id))
+            .filter((x) => x !== undefined);
+        // A child the parse does not carry is one the model merge could not splice
+        // either (it splices by id), so the whole block rides rather than losing it.
+        const splits = els.length === kids.length && !scan.rels.some((r) => r.start >= src.start && r.end <= src.end);
+        blocks.push({ range: { start: src.start, end: src.end }, fate: splits ? "split" : "whole" });
+        if (!splits)
+            continue;
+        routed.push({ model, els });
+        omit.push(...kids.map((c) => ({ start: c.start, end: c.end })));
+    }
+    return {
+        omit,
+        routed,
+        covering: (at) => blocks.find((b) => inside(at, b.range))?.fate ?? null,
+    };
+}
+/** Strictly inside: the ranges of two declarations nest or are disjoint, never overlap. */
+function inside(at, block) {
+    return at.start >= block.start && at.end <= block.end && (at.start !== block.start || at.end !== block.end);
+}
+//# sourceMappingURL=interior.js.map

package/dist/core/c4/splice/identity/interior.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interior.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/interior.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAC;AAuClE,MAAM,UAAU,aAAa,CAAC,GAAoB;IAChD,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAmD,EAAE,CAAC;IAClE,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAkB,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,yEAAyE;QACzE,4EAA4E;QAC5E,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,SAAS;YAAE,SAAS;QACpD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,6EAA6E;QAC7E,6CAA6C;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3B,IAAI,GAAG,KAAK,SAAS;YAAE,SAAS;QAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,MAAM,GAAG,GAAG,IAAI;aACb,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;aACpD,MAAM,CAAC,CAAC,CAAC,EAAa,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAC7C,2EAA2E;QAC3E,6EAA6E;QAC7E,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9G,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM;QACN,QAAQ,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI;KACxE,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAS,MAAM,CAAC,EAAe,EAAE,KAAkB;IACjD,OAAO,EAAE,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC;AAC9G,CAAC","sourcesContent":["/**\n * `./owner.ts`'s question one construct up: not \"whose interior is this id\" but\n * \"does this whole NEW BLOCK hand its interior over\" — decided ONCE per block,\n * and read by BOTH halves of the archive's routing.\n *\n * A service the feature INTRODUCES arrives as one tagged element whose authored\n * bytes already hold its containers. Those containers carry no feature tag of\n * their own — LikeC4 does not inherit tags — so per-addition routing cannot see\n * them: they rode onto the map inside their parent, and the service's extending\n * model could then never declare them, because writing the container the adopt\n * brief prescribes made the map's copy a duplicate and the service `c4.invalid`\n * (verification 2026-09-04, refutation of E1). So the box lands on the map\n * without its interior and the children go into the model's `extend <fqn> { }`\n * block, which `../model/merge.ts` creates.\n *\n * ONE DECISION, NOT TWO, and that is the whole reason this is a module rather\n * than a closure inside `../landscape-merge.ts`. A child of such a block CAN\n * carry the feature tag, and then both halves see it: per-addition routing reads\n * its tag and sends it to the model, while the block decision leaves the same\n * child's bytes on the map. Each half was right on its own and the merge\n * declared the child twice — `merge-failed`, exit 1, nothing written, on a delta\n * neither half was wrong about (re-verification 2026-09-04). `covering` is what\n * makes the routing defer: a declaration written inside a block is the BLOCK's\n * to place, whether or not it is tagged.\n *\n * A block holding a RELATIONSHIP statement rides whole. Such an edge names its\n * endpoints by their LOCAL names inside the block, and the model merge anchors a\n * relationship at the model block's top level — splitting the two apart would\n * leave the map naming children it no longer declares, and `api -> worker` at a\n * model's top level resolves to nothing. The edge rides with its block, for the\n * same reason its siblings do.\n */\nimport { parentIdOf } from \"../../../kernel/ids/fqn/ancestors.js\";\nimport type { Elem } from \"../../likec4.js\";\nimport type { ScannedModel } from \"../../source-scan.js\";\nimport type { SourceRange } from \"../authored-source.js\";\nimport type { ExtendingModel } from \"../contract.js\";\n\n/** What one block decided about everything written inside it. */\nexport type BlockFate = \"whole\" | \"split\";\n\nexport interface InteriorRequest {\n  /** The delta's declarations located in source — the bytes every decision is about. */\n  scan: ScannedModel;\n  /** EVERY element the delta declares: a child the parse does not carry cannot be routed. */\n  deltaElements: readonly Elem[];\n  /** Which document owns a given parent id's interior (`./owner.ts`). */\n  owner: (parentId: string) => ExtendingModel | undefined;\n  /** The delta's declarations this merge is adding — where the blocks are found. */\n  addedEls: readonly Elem[];\n}\n\n/** One split block's share: what its service's model takes, and what the map must drop. */\nexport interface RoutedInterior {\n  model: ExtendingModel;\n  els: Elem[];\n}\n\nexport interface Interiors {\n  /** Delta ranges the map's spliced bytes must leave behind — the split blocks' children. */\n  readonly omit: readonly SourceRange[];\n  /** What each split block hands the model that owns it. */\n  readonly routed: readonly RoutedInterior[];\n  /**\n   * The decision of the block a statement is written INSIDE, or null when no\n   * block holds it and ordinary routing applies. A block's own declaration is\n   * not inside itself and answers null.\n   */\n  covering: (at: SourceRange) => BlockFate | null;\n}\n\nexport function planInteriors(req: InteriorRequest): Interiors {\n  const { scan, deltaElements, owner, addedEls } = req;\n  const byId = new Map(scan.elements.map((e) => [e.id, e]));\n  const blocks: Array<{ range: SourceRange; fate: BlockFate }> = [];\n  const routed: RoutedInterior[] = [];\n  const omit: SourceRange[] = [];\n\n  for (const e of addedEls) {\n    // A block is an addition that lands on the MAP (nothing owns its parent)\n    // and whose own interior belongs to a model. An addition routed away is not\n    // a block: its children ride inside its bytes into the same model, which is\n    // `../model/merge.ts`'s own `rides` rule.\n    if (owner(parentIdOf(e.id)) !== undefined) continue;\n    const model = owner(e.id);\n    if (model === undefined) continue;\n    // Not in the scan: the splice loop refuses on its own, with the message that\n    // names the declaration it could not locate.\n    const src = byId.get(e.id);\n    if (src === undefined) continue;\n    const kids = scan.elements.filter((c) => parentIdOf(c.id) === e.id);\n    if (kids.length === 0) continue;\n    const els = kids\n      .map((c) => deltaElements.find((x) => x.id === c.id))\n      .filter((x): x is Elem => x !== undefined);\n    // A child the parse does not carry is one the model merge could not splice\n    // either (it splices by id), so the whole block rides rather than losing it.\n    const splits = els.length === kids.length && !scan.rels.some((r) => r.start >= src.start && r.end <= src.end);\n    blocks.push({ range: { start: src.start, end: src.end }, fate: splits ? \"split\" : \"whole\" });\n    if (!splits) continue;\n    routed.push({ model, els });\n    omit.push(...kids.map((c) => ({ start: c.start, end: c.end })));\n  }\n\n  return {\n    omit,\n    routed,\n    covering: (at) => blocks.find((b) => inside(at, b.range))?.fate ?? null,\n  };\n}\n\n/** Strictly inside: the ranges of two declarations nest or are disjoint, never overlap. */\nfunction inside(at: SourceRange, block: SourceRange): boolean {\n  return at.start >= block.start && at.end <= block.end && (at.start !== block.start || at.end !== block.end);\n}\n"]}

package/dist/core/c4/splice/identity/owner.js

@@ -0,0 +1,50 @@
+/**
+ * Which DOCUMENT owns the home of a new declaration — the other identity
+ * question the archive's C4 merge asks, beside `./edges.ts`'s "which statement
+ * is this".
+ *
+ * A declaration nested under a service's element belongs to that service's
+ * `model.likec4` when the model EXTENDS the fleet map: that is the only
+ * document allowed to declare the service's interior (SCHEMA.md, "the map holds
+ * no service's interior"), and the map's copy becomes a duplicate the moment
+ * the model writes its own — which is exactly what the adopt brief tells a
+ * service to do, and exactly the failure this closes (verification 2026-09-04,
+ * E1).
+ *
+ * The PARENT is what resolves, never the element itself, so the caller hands in
+ * the parent id and this answers "whose interior is that". A service's own
+ * element on the map has a parent that stands for nothing — a grouping box, or
+ * the model root — so it resolves to no service with a model, stays on the map,
+ * and every service-level edge between two of them stays with it. Asking about a
+ * service element's OWN id is the same question one level down, and that is how
+ * the landscape merge learns where a NEW service's interior belongs.
+ *
+ * A service with a STANDALONE model, or none at all, is simply absent from the
+ * list and therefore owns nothing here: the map draws its containers, which is
+ * legal and is what every repository did before the extending shape existed.
+ */
+import { ancestorIds } from "../../../kernel/ids/fqn/ancestors.js";
+import { serviceResolver } from "../../resolve/service.js";
+export function ownerOf(req) {
+    const { bindEls, living, declared, added, models } = req;
+    if (models.length === 0)
+        return () => undefined;
+    const byService = new Map(models.map((m) => [m.service, m]));
+    const resolve = serviceResolver(bindEls);
+    return (parentId) => {
+        if (parentId === "")
+            return undefined;
+        // Walk up until the chain reaches an id the map's namespace already holds.
+        // Everything below that point has to be a declaration this delta ADDS —
+        // a child of a container the same delta introduces, or the new service
+        // element itself — because those ids will exist once the merge lands.
+        for (const a of ancestorIds(parentId)) {
+            if (living.has(a) || declared.has(a))
+                break;
+            if (!added.has(a))
+                return undefined;
+        }
+        return byService.get(resolve(parentId));
+    };
+}
+//# sourceMappingURL=owner.js.map

package/dist/core/c4/splice/identity/owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner.js","sourceRoot":"","sources":["../../../../../src/core/c4/splice/identity/owner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAEnE,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAsC3D,MAAM,UAAU,OAAO,CAAC,GAAiB;IACvC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC;IACzD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,CAAC,QAAgB,EAA8B,EAAE;QACtD,IAAI,QAAQ,KAAK,EAAE;YAAE,OAAO,SAAS,CAAC;QACtC,2EAA2E;QAC3E,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,MAAM;YAC5C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC;QACtC,CAAC;QACD,OAAO,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Which DOCUMENT owns the home of a new declaration — the other identity\n * question the archive's C4 merge asks, beside `./edges.ts`'s \"which statement\n * is this\".\n *\n * A declaration nested under a service's element belongs to that service's\n * `model.likec4` when the model EXTENDS the fleet map: that is the only\n * document allowed to declare the service's interior (SCHEMA.md, \"the map holds\n * no service's interior\"), and the map's copy becomes a duplicate the moment\n * the model writes its own — which is exactly what the adopt brief tells a\n * service to do, and exactly the failure this closes (verification 2026-09-04,\n * E1).\n *\n * The PARENT is what resolves, never the element itself, so the caller hands in\n * the parent id and this answers \"whose interior is that\". A service's own\n * element on the map has a parent that stands for nothing — a grouping box, or\n * the model root — so it resolves to no service with a model, stays on the map,\n * and every service-level edge between two of them stays with it. Asking about a\n * service element's OWN id is the same question one level down, and that is how\n * the landscape merge learns where a NEW service's interior belongs.\n *\n * A service with a STANDALONE model, or none at all, is simply absent from the\n * list and therefore owns nothing here: the map draws its containers, which is\n * legal and is what every repository did before the extending shape existed.\n */\nimport { ancestorIds } from \"../../../kernel/ids/fqn/ancestors.js\";\nimport type { Elem } from \"../../likec4.js\";\nimport { serviceResolver } from \"../../resolve/service.js\";\nimport type { ExtendingModel } from \"../contract.js\";\n\nexport interface OwnerRequest {\n  /**\n   * The corpus the parent id resolves against — the LIVING map's elements plus\n   * the delta's own, so an element the delta introduces resolves the moment its\n   * bytes would land.\n   */\n  bindEls: Elem[];\n  /**\n   * The ids the LIVING map declares. Reaching one is what proves the id chain is\n   * spelled in the map's own namespace.\n   */\n  living: ReadonlySet<string>;\n  /**\n   * The ids the fleet's extending models declare inside their `extend` blocks.\n   * Those are map fqns too — an `extend` frame reopens an element the map owns —\n   * so a container already drawn in a model anchors the chain exactly as a living\n   * one does, and an edge into a child of it still routes.\n   */\n  declared: ReadonlySet<string>;\n  /**\n   * The ids this merge is ADDING: the delta's declarations that survived the\n   * existence joins. An id that is neither living, declared, nor added is one the\n   * delta spells under its OWN name for an element the map already holds under\n   * another — the legacy title join, which the landscape merge still merges for.\n   * Routing it would open an `extend` block on an fqn the map has never heard of,\n   * and the model's parse net would refuse an archive that used to merge\n   * (verification 2026-09-04, refutation of E1: the guard used to accept any\n   * chain whose ANCESTOR was living, so a title-joined name inside a group the\n   * map declares — `marketplace.orderSvc` under the living `marketplace` — passed\n   * it and every grouped fleet's legacy delta became `merge-failed`).\n   */\n  added: ReadonlySet<string>;\n  models: readonly ExtendingModel[];\n}\n\nexport function ownerOf(req: OwnerRequest): (parentId: string) => ExtendingModel | undefined {\n  const { bindEls, living, declared, added, models } = req;\n  if (models.length === 0) return () => undefined;\n  const byService = new Map(models.map((m) => [m.service, m]));\n  const resolve = serviceResolver(bindEls);\n  return (parentId: string): ExtendingModel | undefined => {\n    if (parentId === \"\") return undefined;\n    // Walk up until the chain reaches an id the map's namespace already holds.\n    // Everything below that point has to be a declaration this delta ADDS —\n    // a child of a container the same delta introduces, or the new service\n    // element itself — because those ids will exist once the merge lands.\n    for (const a of ancestorIds(parentId)) {\n      if (living.has(a) || declared.has(a)) break;\n      if (!added.has(a)) return undefined;\n    }\n    return byService.get(resolve(parentId));\n  };\n}\n"]}