aontu 0.62.0 → 0.64.0

package/dist/cli.js

@@ -13,8 +13,8 @@ exports.runRelations = runRelations;
 exports.runReaches = runReaches;
 exports.runView = runView;
 exports.runJsonSchema = runJsonSchema;
-exports.runRender = runRender;
 exports.runTemplate = runTemplate;
+exports.runTrace = runTrace;
 exports.runMod = runMod;
 exports.runHash = runHash;
 exports.runGet = runGet;
@@ -32,13 +32,6 @@ exports.runFmt = runFmt;
 exports.watchChange = watchChange;
 exports.watchSignature = watchSignature;
 exports.deprecatedAt = deprecatedAt;
-// Command-line interface for Aontu.
-//
-//   aontu [options] [file]
-//
-// With a file argument, the file is evaluated and the result printed.
-// With no file on an interactive terminal, a REPL is started. With no
-// file and piped input, the source is read from stdin. See HELP below.
 // Named imports, not `import * as`: the namespace form makes tsc emit the
 const query_1 = require("./query");
 // __importStar downlevel helper, whose branches no supported Node takes.
@@ -47,8 +40,8 @@ const node_path_1 = require("node:path");
 const node_os_1 = require("node:os");
 const node_readline_1 = require("node:readline");
 const aontu_1 = require("./aontu");
+const trace_1 = require("./trace");
 const template_1 = require("./template");
-const mcp_1 = require("./mcp");
 const report_sarif_1 = require("./report-sarif");
 const lsp_server_1 = require("./lsp-server");
 const mcp_server_1 = require("./mcp-server");
@@ -74,10 +67,10 @@ const HELP = `Usage: aontu [options] [file]
        aontu view <kind> [options] <file>...
        aontu view --views <path> [--check] [options] <file>
        aontu jsonschema [--at <path>] [--strict] [options] <file>
-       aontu render [--at <path>] [--profile <file>]... [--unit <path>]
-                    [--stdout | --out <dir> | --check <dir> | --coverage]
-                    [--coverage-at <path>] [--strict] <file>
-       aontu template [--resugar] [--check] [--marker <token>] <file>
+       aontu template [--resugar] [--check] [--marker <token>]
+                      [--profile <file>] <file>
+       aontu trace [--at <path>] [--format json] [--marker <token>]
+                   [--profile <file>] <file>
        aontu hash [options] <file>
        aontu mod tidy|verify|vendor|manifest [options] [dir]
        aontu get <path> [options] <file>
@@ -85,7 +78,8 @@ const HELP = `Usage: aontu [options] [file]
        aontu set <path>=<value>... --entry <file> --overlay <file>
        aontu allow --role <role> [--at <path>] <roles-file> <path>...
        aontu agentsmd [--write <AGENTS.md>] [--depth <n>] <file>
-       aontu fmt [-w|-l|--check|-d|--lint] [--marker <token>] <file>...
+       aontu fmt [-w|-l|--check|-d|--lint] [--marker <token>]
+                 [--profile <file>] <file>...
        aontu help [topic] [--format text|json]
        aontu explain <code> | --list [--format text|json]
        aontu init [dir]
@@ -322,36 +316,11 @@ View exit codes: 0 rendered, 1 --check mismatch or lossy under
 --strict, 2 usage or --max-rows exceeded, 4 the document does not stand
 up on its own, or a relation, root or path that names nothing.
 
-Render options:
-  --at <path>       Render the value at this path ($.a.b); the root by
-                    default
-  --profile <file>  A profile document, profile: {lang, ...}, vetted
-                    against aontu:profile; repeatable, one per language
-  --unit <path>     Render only the unit with this path
-  --stdout          One unit's bytes and nothing else (with --unit when
-                    the instance has several)
-  --out <dir>       Write every unit below dir, or nothing; never deletes
-  --check <dir>     Compare every unit with dir/<path>; drift is listed
-  --coverage        Report what the render read and what it did not:
-                    model paths no output consumed, and rendered
-                    declarations no rule produced. Writes nothing
-  --coverage-at <p> Measure coverage under this path only, instead of
-                    the document root
-  --strict          Refuse the opaque escapes (a text declaration, a raw
-                    block)
-  --format <f>      text (default) or json, the whole report; json
-                    carries the dispatch trace, one entry per emitted
-                    piece
-
-Render exit codes: 0 rendered, 1 lossy under --strict or drift under
---check, 2 usage or I/O (a refused unit path included), 4 the document
-does not stand up or the instance is not aontu:code.
-
-A render entry file whose extension is not .aon is a TEMPLATE: a
-generator in the target's own syntax, whose marker lines carry aontu
-and whose other lines are output. It is desugared before it is
-evaluated, and --marker names the marker for a language the table does
-not know.
+A template entry file whose extension is not .aon is a GENERATOR: a
+document in the target's own syntax, whose marker lines carry aontu and
+whose other lines are output. It is desugared before it is evaluated,
+and a language the table does not know names its marker with --marker,
+or declares it once in a profile file that --profile reads.
 
 Template options:
   --resugar       The file is the canonical aontu; print the template
@@ -359,7 +328,9 @@ Template options:
   --check         Desugar and resugar, and exit 1 if the file is not
                   what the round trip answers
   --marker <t>    The marker, when the extension does not name it
-                  (default //-, and #- --- /*- by extension)
+                  (default //-, and #- --- /*- <!--- by extension)
+  --profile <f>   A profile file, whose template.ext names the
+                  extensions it marks and template.marker the marker
 
 The template verb prints the canonical aontu form of a generator
 written in the target's own syntax: a marked line is aontu source, and
@@ -452,16 +423,18 @@ Fmt options:
                   shapes, on standard error, and print nothing else
   --strict        With --lint, and exit 1 when there is a finding
   --marker <t>    The file is a generator, and this is its marker
-                  (default //-, and #- --- /*- by extension)
+                  (default //-, and #- --- /*- <!--- by extension)
+  --profile <f>   A profile file, whose template.ext names the
+                  extensions it marks and template.marker the marker
 
 The fmt verb prints one document in the agreed form; with no file it
 reads standard input. Several files need one of the options above.
 
-A file whose extension is not .aon is a GENERATOR, as it is for render:
-the aontu its marker lines carry is formatted, the marker stands at the
-left margin with the aontu indented after it, and every line of output
-is held on a line of its own. A file with no marker line in it is
-another language's, and is refused.
+A file whose extension is not .aon is a GENERATOR, as it is for
+template: the aontu its marker lines carry is formatted, the marker
+stands at the left margin with the aontu indented after it, and every
+line of output is held on a line of its own. A file with no marker line
+in it is another language's, and is refused.
 
 Fmt exit codes: 0 formatted or clean, 1 a --check file would change or
 a --strict finding, 2 usage, 4 a document does not parse.
@@ -495,30 +468,7 @@ function version() {
         return '0.0.0';
     }
 }
-// The terminal colour escapes the parser puts in its message text. A
-// machine-readable report is no place for them, which is the rule
-// findingOf states in ts/src/vet.ts; the twin here rather than an
-// import because go/cmd/aontu carries its own for the same reason (the
-// engine's is not exported to its command).
 const EVAL_ANSI = new RegExp('\u001b\\[[0-9;]*m', 'g');
-// THE ENGINE'S DIAGNOSIS AS A FINDING (G11 phase 7). The bare command
-// was the one verb whose failure had no machine-readable form, so the
-// default entry point was the one an agent had to parse with a regular
-// expression.
-//
-// THE HEADLINE ONLY, and no `hint`. Both are parity decisions rather
-// than economies: the frames under the headline are drawn for a person
-// reading a terminal and only the first line is held to byte parity
-// between the ports (the rule findingOf states), and the hint TABLES
-// are deliberately not in parity while the code registry is -- so a
-// hint here would make the two ports answer differently for a code
-// only one of them explains. `aontu explain <code>` is where the hint
-// lives, which is what phase 3 built it for.
-//
-// The CLASS comes from the registry rather than from the nil, because
-// the registry is what both ports hold set-equal
-// (test/spec/errcodes.tsv). Mirrors evalFinding in
-// go/cmd/aontu/main.go.
 function evalFinding(code, text) {
     return {
         class: (0, hints_1.codeClass)(code),
@@ -526,10 +476,6 @@ function evalFinding(code, text) {
         message: text.split('\n')[0].replace(EVAL_ANSI, ''),
         path: '$',
         severity: 'error',
-        // NO SITE. The bare command's failure is the whole document not
-        // standing up, and the two sites a conflict names are in the
-        // frames the text form prints; naming one of them here would be a
-        // choice the engine has not made.
         sites: [],
     };
 }
@@ -537,12 +483,6 @@ function evalFinding(code, text) {
 // message, and the failure in the finding shape. Never throws.
 function evalSource(aontu, src, mode) {
     try {
-        // exactJSON, not JSON.stringify: a document using the `0d` exact
-        // leaves generates bigints and Decimals, which JSON.stringify cannot
-        // write (D9). The CLI prints INDENTED JSON and the shared suite's
-        // `gens` mode prints COMPACT JSON, but both go through this one
-        // emitter -- an indent argument rather than a second implementation,
-        // so the two cannot drift from each other or from the Go port.
         const text = 'canon' === mode
             ? aontu.unify(src).canon
             : (0, aontu_1.exactJSON)(aontu.generate(src), 2);
@@ -552,13 +492,6 @@ function evalSource(aontu, src, mode) {
         const msg = (err instanceof aontu_1.AontuError || true === err?.aontu)
             ? err.message
             : String(err?.message ?? err);
-        // WHAT THE ENGINE COLLECTED, when it collected anything: an
-        // AontuError carries the NilVals the run failed on, already
-        // materialised (handleErrors in ts/src/aontu.ts), and their first
-        // is the diagnosis every other verb reports. An error raised
-        // outside the engine's own collection -- exactJSON's circular
-        // refusal, a foreign object claiming to be one -- carries none,
-        // and answers with the text alone rather than an invented code.
         const errs = 'function' === typeof err?.errs ? err.errs() : [];
         const first = errs[0];
         return {
@@ -623,16 +556,6 @@ function trustOpts(trust, entryRoot) {
             return { ...text, trustWarn: makeTrustWarn(), trustWarnRoot: entryRoot };
     }
 }
-// EVERY VERB honours the include capability, not just the bare
-// command. G5 wired `--trust`/`--include-root` to `aontu <file>` alone,
-// so `aontu vet schema.aon data.json` -- the surface an agent actually
-// scripts -- ran the full system resolver with no flag to confine it
-// and no warning (use-cases/REVIEW.md finding G). The flags are
-// stripped here, before each verb parses its own tail, so a verb only
-// has to pass the profile on to its engine.
-//
-// Returns undefined when the spelling is wrong, with the message
-// already printed: the caller answers the usage class.
 function takeTrust(argv) {
     const rest = [];
     let trust = { kind: 'system-warn', textExt: [] };
@@ -727,17 +650,6 @@ function runFile(file, mode, format, trust) {
         src = (0, node_fs_1.readFileSync)(file, 'utf8');
     }
     catch (err) {
-        // A MISTYPED VERB READS AS A FILE NAME, and until G11 phase 2 that
-        // was only said when there were TWO of them. The one-argument case
-        // is the one an agent actually produces -- `aontu help`, `aontu
-        // init`, `aontu ontology` -- and it answered `cannot read help:
-        // ...`, which describes the symptom and hides the cause.
-        //
-        // The test is SHAPE, not existence: a bare word (no separator, no
-        // extension) that cannot be read was meant as a verb, while
-        // `./help`, `help.aon` and `/tmp/help` were meant as paths and keep
-        // the file diagnosis and its exit 1. That is the same escape hatch
-        // the subcommand dispatch documents. Mirrors go/cmd/aontu/main.go.
         if (looksLikeVerb(file)) {
             process.stderr.write(`aontu: \`${file}\` is not a file, and not a verb this port knows\n`);
             const near = nearestVerb(file, KNOWN_VERBS);
@@ -751,12 +663,6 @@ function runFile(file, mode, format, trust) {
         return 1;
     }
     const path = (0, node_path_1.resolve)(file);
-    // `fs` IS WHAT MAKES A FRAME EXCERPT THE FILE IT NAMES. Without it,
-    // err.ts's resolveSrc falls back to the ENTRY text, so a frame whose
-    // arrow says `lib/types.aon:2:6` printed the entry's line 2 under it
-    // -- a real file name over another file's line, which
-    // docs/reference-api.md forbids in the same words it uses to require
-    // the name.
     const aontu = new aontu_1.Aontu({
         path,
         errfs: { existsSync: node_fs_1.existsSync, readFileSync: node_fs_1.readFileSync },
@@ -892,14 +798,6 @@ function runRepl(initialMode, jsonl, trust) {
         rl.prompt();
     });
     rl.on('close', () => {
-        // The closing newline is for a HUMAN, so it is written only for
-        // one: it moves the terminal off the prompt line that `rl` left
-        // hanging. In `--jsonl` there is no prompt, every answer already
-        // ends in its own newline, and this one appended a bare empty line
-        // to the stream -- a record that is not JSON, at the end of a
-        // protocol whose whole contract is one JSON object per line. A
-        // harness parsing every line it receives failed on it, after the
-        // commands had all succeeded. Mirrors go/cmd/aontu/repl.go.
         if (!jsonl) {
             process.stdout.write('\n');
         }
@@ -909,15 +807,6 @@ function runRepl(initialMode, jsonl, trust) {
         process.exitCode = 0;
     });
 }
-// THE VET VERB (G2 phase 3).
-//
-// Exit codes are VERDICT CLASSES, not a pass/fail bit: an agent loop
-// branches on "the data contradicts the truth" (1) differently from
-// "the data has not supplied everything the truth requires" (3), and
-// differently again from "the schema itself is broken" (4), which is
-// never the data's fault. 2 stays what it already was for this CLI --
-// the caller got the invocation wrong -- which is why an unreadable
-// file is a 2 rather than a 4.
 const VET_EXIT = {
     valid: 0,
     invalid: 1,
@@ -961,14 +850,6 @@ function parseVetArgs(argv) {
             format = f;
         }
         else if ('--max-errors' === arg) {
-            // ONE GRAMMAR, spelled the same way in both ports: decimal
-            // digits, one to nine of them, at least 1. `Number()` alone
-            // accepted `1.0`, `1e2`, `0x10` and ` 3`, which Go's parser
-            // refuses -- so the same documented invocation meant different
-            // things in the two shipped commands. The nine-digit ceiling is
-            // where the ports would part company again: beyond it Go's
-            // integer conversion saturates, and a cap nobody can reach is
-            // not worth a divergence.
             const raw = argv[++i];
             if (!/^[0-9]{1,9}$/.test(raw ?? '') || 1 > Number(raw)) {
                 return { err: 'aontu: --max-errors needs a positive whole number' };
@@ -1046,10 +927,6 @@ function renderFinding(f) {
         out.push(`  actual:   ${f.actual}`);
     }
     for (const s of f.sites) {
-        // Every site carries the canon of the value it stands for: that is
-        // what makes the two sides of a conflict readable side by side. A
-        // site's file is always a string -- empty when the value belongs to
-        // neither document -- so there is nothing to coalesce here.
         out.push(`  ${s.role}: ${s.file}:${s.row}:${s.col} (${s.value})`);
     }
     return out.join('\n');
@@ -1141,18 +1018,9 @@ function vetOnce(args, trust) {
         process.stderr.write(`aontu: cannot read ${err.path}: ${err.message}\n`);
         return 2;
     }
-    // Each data file is vetted on its own, because a parsed tree is
-    // single-use (docs/reference-api.md) -- and because two data files
-    // are two candidates for the same truth, not one merged candidate.
     let verdict = 'valid';
     let truncated = false;
     const findings = [];
-    // COVERAGE ACROSS SEVERAL DATA FILES (G11 phase 5). Two data files
-    // are two candidates for one truth, so the schema side is the SAME
-    // for each: `declared` is taken once, and a declaration is unused
-    // only when NO file met it -- the intersection, because a
-    // declaration one file exercised is exercised. The data side adds
-    // up: leaves and checked leaves sum, and `unchecked` is the union.
     let cov;
     // Initialised rather than left undefined: it is filled in the same
     // block that sets `cov`, so a fallback at the read below would be an
@@ -1170,12 +1038,6 @@ function vetOnce(args, trust) {
             maxErrors: args.maxErrors,
             schemaUrl: args.schema,
             dataUrl: source.file,
-            // The paths as well as the labels: a relative `@"file"` load
-            // inside either document resolves from ITS OWN directory, the
-            // way `aontu <file>` already resolves one (runFile above). The
-            // path is passed AS TYPED, not resolved: it doubles as the
-            // label above, and a report that mixed the typed path with an
-            // absolute one would name the same file two ways.
             schemaPath: args.schema,
             dataPath: source.file,
             coverage: args.coverage,
@@ -1204,26 +1066,10 @@ function vetOnce(args, trust) {
                 ? new Set([...unusedEvery].filter((u) => mine.has(u))) : mine;
             unusedSeen = true;
         }
-        // A SCHEMA-SIDE FAULT IS THE SAME FAULT FOR EVERY DATA FILE, so it
-        // is reported ONCE. `error` means exactly that -- the run could not
-        // be set up from the truth's side, never the data's (the exit table
-        // in docs/reference-api.md) -- so the report the first file
-        // produced is the report every later file would produce, character
-        // for character. Concatenating them repeated one broken schema N
-        // times and, past the cap, marked the report `truncated` over a
-        // single underlying fault. It only became visible once the `error`
-        // verdict started carrying findings at all: while the list was
-        // empty there was nothing to duplicate.
         if ('error' === report.verdict) {
             break;
         }
     }
-    // The cap is on the REPORT, not on each file. Capping every file's
-    // list and then concatenating them let `--max-errors 1` emit one
-    // finding PER FILE -- and leave `truncated` false while doing it,
-    // because no single file had been cut. The engine still caps each
-    // run, so a pathological file cannot flood the aggregate before it
-    // gets here; this is the second, honest cut.
     const cap = args.maxErrors ?? vet_1.VET_MAX_ERRORS;
     const kept = cap < findings.length ? findings.slice(0, cap) : findings;
     if (null != cov) {
@@ -1241,12 +1087,6 @@ function vetOnce(args, trust) {
         'sarif' === args.format ? renderVetSarif(report) :
             renderVetText(report);
     process.stdout.write(text + '\n');
-    // A VACUOUS CHECK IS A FAILED GATE UNDER `--strict-coverage`, and
-    // only under it: the verdict WORD is unchanged, so nothing that
-    // passes today starts failing, and a caller who wants the stronger
-    // gate asks for it. The reason goes to stderr, because stdout is a
-    // report contract -- a JSON consumer reads `coverage.vacuous` and a
-    // person reads this.
     if (true === args.strictCoverage && true === report.coverage?.vacuous) {
         process.stderr.write('aontu: no data leaf was constrained by the schema:' +
             ' this run checked nothing\n' +
@@ -1273,19 +1113,6 @@ function watchSignature(files) {
 function sleep(ms) {
     return new Promise((done) => setTimeout(done, ms));
 }
-// Resolve true when any watched file's signature moves off `before`.
-// This is the real waiter: it never resolves false, so a real watch
-// runs until the process is interrupted; tests inject their own waiter
-// to bound the loop, and pass a short pollMs when they drive this one
-// directly. The interval is a required argument (the command passes
-// WATCH_POLL_MS) so there is no defaulting branch a test could never
-// take.
-//
-// The BASELINE is an argument, not a snapshot taken here: the loop
-// records it BEFORE each vet run, so a save landing between the run's
-// reads and the wait still compares as a change. A waiter that
-// snapshotted on entry would adopt that unvetted save as its baseline
-// and wait indefinitely on a stale report.
 async function watchChange(files, before, pollMs) {
     for (;;) {
         await sleep(pollMs);
@@ -1314,9 +1141,6 @@ async function watchVet(args, wait, trust) {
     }
     return code;
 }
-// The vet verb. Non-watch runs are synchronous and return the exit
-// class directly; `--watch` returns a promise that resolves only when
-// the waiter says stop (never, for the real one).
 function runVet(argv, wait) {
     const trusted = takeTrust(argv);
     if (null == trusted) {
@@ -1527,30 +1351,7 @@ function parseBreakingArgs(argv) {
         },
     };
 }
-// A source file the include resolver can actually load. `git#<rev>`
-// materialises these and nothing else: an include names an Aontu
-// document (`.aon`/`.aontu`, the two extensions `@"foo"` tries) or a
-// JSON one, so the rest of a revision's tree cannot be part of any
-// include closure and copying it would be pure cost.
 const INCLUDABLE = /\.(aon|aontu|jsonic|json)$/;
-// Resolve one --against spelling to an old version.
-//
-// A `git#<rev>` spelling is the old version of the WHOLE TREE, not of
-// the entry file alone. It used to be `git show <rev>:./<file>`, whose
-// text was then evaluated with `generalPath`/`specificPath` pointing at
-// the WORKING file -- so every `@"..."` include in the old document
-// resolved against the working tree, and the "old" side was old entry
-// text meeting new includes. A breaking change inside an included file
-// therefore compared against itself and answered `compatible`: the
-// documented CI gate silently un-gated every non-entry file of the
-// multi-file layout real models use (use-cases/BUGS.md §26). The old
-// tree's includable sources are copied into a temporary directory and
-// the old document is evaluated from THERE.
-//
-// Sources outside the revision -- package includes under node_modules,
-// the bundled `std/system` -- still resolve as they do today: they are
-// not in the tree, and their versions travel with the lockfile rather
-// than with this comparison.
 function oldVersion(spec, file) {
     if (!spec.startsWith('git#')) {
         try {
@@ -1578,23 +1379,9 @@ function oldVersion(spec, file) {
     // that only some failures take.
     const temp = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'aontu-against-'));
     try {
-        // THE REPO-RELATIVE PATH COMES FROM GIT, not from path arithmetic.
-        // Relativising `rev-parse --show-toplevel` against `resolve(file)`
-        // puts two DIFFERENT COORDINATE SYSTEMS on either side of the
-        // subtraction: git prints the real path, while the caller's is
-        // whatever they typed. On macOS a temp file under /var is
-        // /private/var to git, and on Windows a TMP short name
-        // (RUNNER~1) is the long form to git -- so the subtraction gave a
-        // `../..` climb, the entry was "not in that revision", and the
-        // documented CI spelling failed on both platforms while passing on
-        // Linux (this PR's own CI). `--show-prefix` is the same question
-        // asked in git's coordinates: the repo-relative directory of the
-        // cwd, already slash-separated and already normalised.
         const prefix = git(['rev-parse', '--show-prefix'], dir).trim();
         const entryRel = prefix + (0, node_path_1.basename)(file);
         const top = git(['rev-parse', '--show-toplevel'], dir).trim();
-        // `-z` so a path with a newline or a quote cannot be mistaken for
-        // two paths (git otherwise quotes such names).
         const listed = git(['ls-tree', '-r', '-z', '--name-only', rev], top)
             .split('\0').filter((p) => '' !== p);
         if (!listed.includes(entryRel)) {
@@ -1624,13 +1411,6 @@ function oldVersion(spec, file) {
 function policyCompat(newSrc, path, include) {
     const aontu = new aontu_1.Aontu();
     const ctx = aontu.ctx({ collect: true });
-    // The declaration is read by EVALUATING the document, so this leg
-    // runs the include resolver too and has to run it under BOTH of the
-    // verb's include options -- a `breaking --trust none` that read its
-    // own mode through an unconfined resolver would confine the
-    // comparison and not the question (use-cases/REVIEW.md finding G),
-    // and one that took the capability alone read no mode at all when
-    // the declaration arrived through a `--text-ext` include.
     const v = aontu.unify(newSrc, { path, ...(0, utility_1.includeOpts)(include) }, ctx);
     if (0 < ctx.err.length || true === v?.isNil) {
         return undefined;
@@ -1649,11 +1429,6 @@ function policyCompat(newSrc, path, include) {
     return 'backward' === m || 'forward' === m || 'full' === m || 'none' === m
         ? m : undefined;
 }
-// Is the evaluated old version's value at the finding path deprecated?
-// The --allow-deprecated-removal downgrade (G3 phase 4): removing (or
-// otherwise changing) a value the old version already deprecated warns
-// instead of breaking. The Go port exports the same reader as
-// aontu.DeprecatedAt.
 function deprecatedAt(oldSrc, path, filePath) {
     const aontu = new aontu_1.Aontu();
     const ctx = aontu.ctx({ collect: true });
@@ -1720,9 +1495,6 @@ function runBreaking(argv) {
         process.stderr.write(`aontu: cannot read ${err.path}: ${err.message}\n`);
         return 2;
     }
-    // The declared mode: --mode overrides the document's own policy;
-    // neither means backward, the index's framing (v1-valid documents
-    // stay valid).
     const mode = args.mode ??
         policyCompat(newSrc, args.file, verbOpts(trust, entryRootOf(args.file))) ??
         'backward';
@@ -1755,8 +1527,6 @@ function runBreaking(argv) {
             if (null != old.temp) {
                 temps.push(old.temp);
             }
-            // backward: the NEW document is the general side — every old
-            // instance must still be admitted. forward: the old one is.
             const checks = [];
             if ('backward' === mode || 'full' === mode) {
                 checks.push({ general: [newSrc, args.file], specific: [oldSrc, spec] });
@@ -1771,17 +1541,9 @@ function runBreaking(argv) {
                     at: args.at,
                     generalUrl: check.general[1],
                     specificUrl: check.specific[1],
-                    // The old side's relative loads resolve from ITS own tree --
-                    // the materialised revision for a git spelling, the named
-                    // file's directory otherwise -- so an included file's change
-                    // is part of the comparison rather than invisible to it.
                     generalPath: check.general[1] === spec ? oldPath : args.file,
                     specificPath: check.specific[1] === spec ? oldPath : args.file,
                 });
-                // The deprecated-removal downgrade: a finding about a value the
-                // OLD version already deprecated becomes a warning, and warnings
-                // do not move the verdict. Deprecate-then-remove is the
-                // supported rename path (the design's own sequencing).
                 let verdict = report.verdict;
                 if (args.allowDeprecatedRemoval) {
                     let liveFindings = 0;
@@ -1832,12 +1594,6 @@ function renderBreakingJson(report, mode) {
         findings: report.findings,
     }, 2);
 }
-// ---------------------------------------------------------------------
-// The trim reporter (G3 phase 6): report redundant entries as paths.
-// Report-only — REWRITING needs G7's format-preserving patch surface —
-// which is why --check is REQUIRED rather than defaulted: `aontu trim
-// f.aon` reads as "trim this file", and doing something else silently
-// is worse than saying so.
 const TRIM_HELP = 'aontu trim --check <file> (try --help)';
 const TRIM_EXIT = {
     clean: 0,
@@ -1907,8 +1663,6 @@ function runTrim(argv) {
 }
 function renderTrimText(report) {
     const head = `verdict: ${report.verdict}`;
-    // WHY, when the document could not be evaluated at all: rendered as
-    // vet renders a finding, because it IS one (the review's finding F).
     const errors = report.errors ?? [];
     if (0 < errors.length) {
         return [head, ''].concat(errors.map(renderFinding)).join('\n');
@@ -1957,27 +1711,10 @@ const VIEW_EDGES = ['upward', 'all', 'none'];
 // is a terminal, which is the CLI's to know and the library's never --
 // the same division err.ts already draws for the error frames.
 const VIEW_STYLES = ['auto', 'none', 'ansi', 'css'];
-// `--style auto` resolved, which only the CLI can do. The mechanism is
-// the PROFILE's and the library knows it -- an SVG carries its
-// stylesheet unless told not to, which is what makes a figure stand
-// alone. What the library cannot know is whether the DESTINATION is a
-// terminal, so that is the only thing decided here: escapes on the
-// text profile when stdout is a terminal and NO_COLOR is unset, the
-// same two conditions the error frames use. `undefined` leaves the
-// profile's own default in place.
 function viewStyleOf(asked, as) {
     if (undefined !== asked && 'auto' !== asked) {
         return asked;
     }
-    // STDOUT'S OWN TERMINAL-NESS, and NO_COLOR read here rather than
-    // through colorActive(). The figure goes to STDOUT and the error
-    // frames go to STDERR, and they are not the same destination: main()
-    // has already called setColor for stderr, so asking colorActive()
-    // would answer the wrong question twice --- no escapes for
-    // `aontu view tree m.aon 2>/dev/null` at a terminal, and escapes
-    // into the pipe for `aontu view tree m.aon | less`. The NO_COLOR
-    // rule is the one no-color.org states and err.ts implements:
-    // set, to anything but empty, means no colour.
     const no = process.env.NO_COLOR;
     return 'text' === as && true === process.stdout.isTTY
         && (null == no || '' === no) ? 'ansi' : undefined;
@@ -1999,25 +1736,13 @@ const VIEW_USAGE_CODES = [
     'view_document_shape', 'view_style_profile', 'view_style_unknown',
 ];
 const MOD_HELP = 'aontu mod tidy|verify|vendor|manifest [dir] (try --help)';
-// The module tooling (G6 phase 3, ts/src/mod-tool.ts). All LOCAL:
-// `tidy` resolves the closure from what is in the stores and rewrites
-// the lockfile, `verify` asks whether the stores still mean what the
-// lockfile pins and changes nothing, `vendor` materialises the locked
-// closure into the project, `manifest` prints what a publish would
-// push.
-//
-// TIDY AND VERIFY ARE DIFFERENT QUESTIONS, and that is why both exist.
-// Tidy recomputes and rewrites by design -- a pin is what a module
-// means NOW -- so it makes the lockfile agree with whatever the store
-// holds, tampering included. Verify is the gate: a CI job runs it
-// BEFORE tidy, or instead of it.
-//
-// `get` and `publish` are the NETWORK half of the design and are not in
-// this build. They are named here rather than left to fall out as an
-// unknown subcommand, because a reader of the design will type them and
-// deserves to be told which half is missing rather than that the word
-// is wrong.
 function runMod(argv) {
+    const trusted = takeTrust(argv);
+    if (null == trusted) {
+        return 2;
+    }
+    argv = trusted.argv;
+    const trust = trusted.trust;
     const rest = [];
     let format = 'text';
     let against;
@@ -2063,10 +1788,6 @@ function runMod(argv) {
         process.stderr.write(`aontu: mod needs tidy, verify, vendor or manifest\n${MOD_HELP}\n`);
         return 2;
     }
-    // THE OLD LAYOUT IS NAMED, NOT READ. The lockfile and the vendored
-    // closure moved under aontu_meta/; a project that still carries them
-    // at its root would otherwise look untouched by any of these verbs,
-    // which is the one silence worth breaking.
     if ((0, node_fs_1.existsSync)((0, node_path_1.join)(dir, 'aon_vendor')) || (0, node_fs_1.existsSync)((0, node_path_1.join)(dir, 'mod-lock.aon'))) {
         process.stderr.write('aontu: aon_vendor/ and mod-lock.aon now live under aontu_meta/: ' +
             'move them, or run aontu mod tidy and aontu mod vendor\n');
@@ -2077,10 +1798,11 @@ function runMod(argv) {
         process.stderr.write('aontu: --against is a manifest option\n');
         return 2;
     }
-    const report = 'tidy' === sub ? (0, mod_tool_1.modTidy)(dir, modToolOptions()) :
-        'verify' === sub ? (0, mod_tool_1.modVerify)(dir, modToolOptions()) :
-            'vendor' === sub ? (0, mod_tool_1.modVendor)(dir, modToolOptions()) :
-                (0, mod_tool_1.modManifest)(dir, modToolOptions(), against);
+    const modopts = modToolOptions(trust, (0, node_path_1.resolve)(dir));
+    const report = 'tidy' === sub ? (0, mod_tool_1.modTidy)(dir, modopts) :
+        'verify' === sub ? (0, mod_tool_1.modVerify)(dir, modopts) :
+            'vendor' === sub ? (0, mod_tool_1.modVendor)(dir, modopts) :
+                (0, mod_tool_1.modManifest)(dir, modopts, against);
     process.stdout.write(('json' === format ?
         (0, aontu_1.exactJSON)({ aontu: { version: version(), verb: 'mod ' + sub }, ...report }, 2) :
         modText(sub, report)) + '\n');
@@ -2090,9 +1812,6 @@ const MOD_SUBS = ['tidy', 'verify', 'vendor', 'manifest'];
 const MOD_EXIT = {
     ok: 0,
     missing: 1,
-    // A REFUSED GATE, with `breaking`: a store that no longer means what
-    // the lockfile pins is the integrity check saying no, and a CI job
-    // reading exit codes should not have to learn a third class for it.
     mismatch: 1,
     // Likewise a lockfile that does not cover the project: the gate has
     // nothing to check, which is a refusal and not a pass.
@@ -2104,11 +1823,16 @@ const MOD_EXIT = {
 // The tooling's evaluator: the same standalone evaluation the module
 // resolver verifies with (ts/src/mod.ts), and for the same reason —
 // only the engine can say what a module MEANS.
-function modToolOptions() {
+function modToolOptions(trust, entryRoot) {
+    const opts = verbOpts(trust, entryRoot);
+    // The user cache lives outside any confinement root, so a confined
+    // run reads the vendor tree only -- as the evaluator's own module
+    // leg already does when a root is set.
+    const rooted = null != opts.trust?.include?.root;
     return {
-        cache: (0, mod_1.modCacheDir)(),
+        ...(rooted ? {} : { cache: (0, mod_1.modCacheDir)() }),
         eval: (src, path) => {
-            const a0 = new aontu_1.Aontu();
+            const a0 = new aontu_1.Aontu(opts);
             const ctx = a0.ctx({ collect: true });
             const val = a0.unify(src, { path }, ctx);
             return {
@@ -2138,11 +1862,6 @@ function modText(sub, report) {
         for (const f of report.findings) {
             lines.push(f.path + ': ' + f.message);
         }
-        // What a manifest lacks is a declaration the module does not make
-        // or an entry file that is not there, and neither is something a
-        // fetch would supply -- so this is not the tail the other two
-        // subcommands share. The name says which kind it is: `mod.version`
-        // is a declaration, `service.aon` is a file.
         for (const miss of report.missing) {
             lines.push(miss + ': missing');
         }
@@ -2152,8 +1871,6 @@ function modText(sub, report) {
         for (const mod of report.verified) {
             lines.push(mod + ': verified');
         }
-        // BOTH HASHES, because the useful question is which way it moved:
-        // an empty `got` is a module that no longer stands up at all.
         for (const m of report.mismatched) {
             lines.push(m.mod + ': pinned ' + m.want + ' but the store means ' +
                 ('' === m.got ? 'nothing (it does not evaluate)' : m.got));
@@ -2186,26 +1903,6 @@ function modText(sub, report) {
     }
     return lines.join('\n');
 }
-// VACUITY SIGNALS (G11 phase 4,
-// docs/capability-review/g11-agent-onramp.md).
-//
-// The same principle phase 5 applied to `vet`: a verb that did NOTHING
-// and a verb that did its job answer the same. `aontu view tree` over a
-// document declaring no relations printed one newline and exited 0;
-// `aontu render` with no profile printed nothing and exited 0; `aontu
-// relations` over a document declaring none answered `verdict: pass`.
-// For a person at a terminal that is a shrug. For an unattended agent
-// it is a green check mark on an empty box.
-//
-// ON STDERR, ALWAYS. stdout is a report contract -- a `--format json`
-// consumer parses it -- and the exit code is a verdict class that
-// callers already branch on. Neither changes here: what changes is
-// that the caller is TOLD. A caller who wants it to be fatal has
-// `vet --strict-coverage`, and the same argument would give the other
-// verbs a flag of their own if one is ever asked for.
-//
-// The repository already ruled this for one verb, in G8 phase 6 on
-// `trim`: "doing something else silently is worse than refusing".
 function vacuous(what, why) {
     process.stderr.write(`aontu: ${what}: ${why}\n`);
 }
@@ -2269,6 +1966,108 @@ function runRelations(argv) {
     }
     return RELATIONS_EXIT[report.verdict];
 }
+const TRACE_HELP = 'aontu trace [--at <path>] [--format json] [--marker <token>] ' +
+    '[--profile <file>] <file>';
+// WHAT WROTE THIS LINE. Every piece a rule stamped, under the
+// component tree, with the file it reached, the rule set that wrote it
+// and the model node the dispatch matched.
+function runTrace(argv) {
+    const trusted = takeTrust(argv);
+    if (null == trusted) {
+        return 2;
+    }
+    argv = trusted.argv;
+    const trust = trusted.trust;
+    const rest = [];
+    const profileFiles = [];
+    let format = 'text';
+    let at = undefined;
+    let marker = undefined;
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if ('-h' === arg || '--help' === arg) {
+            process.stdout.write(HELP);
+            return 0;
+        }
+        if ('--format' === arg) {
+            const f = argv[++i];
+            if ('text' !== f && 'json' !== f) {
+                process.stderr.write('aontu: --format needs text or json\n');
+                return 2;
+            }
+            format = f;
+        }
+        else if ('--at' === arg) {
+            at = argv[++i];
+            if (null == at) {
+                process.stderr.write('aontu: --at needs a path\n');
+                return 2;
+            }
+        }
+        else if ('--marker' === arg) {
+            marker = argv[++i];
+            if (null == marker) {
+                process.stderr.write('aontu: --marker needs a token\n');
+                return 2;
+            }
+        }
+        else if ('--profile' === arg) {
+            const pf = argv[++i];
+            if (null == pf) {
+                process.stderr.write('aontu: --profile needs a file\n');
+                return 2;
+            }
+            profileFiles.push(pf);
+        }
+        else if (arg.startsWith('-')) {
+            process.stderr.write(`aontu: unknown trace option ${arg} (try --help)\n`);
+            return 2;
+        }
+        else {
+            rest.push(arg);
+        }
+    }
+    if (1 !== rest.length) {
+        process.stderr.write(`aontu: trace needs one file\n${TRACE_HELP}\n`);
+        return 2;
+    }
+    let src;
+    try {
+        src = (0, node_fs_1.readFileSync)(rest[0], 'utf8');
+    }
+    catch (err) {
+        process.stderr.write(`aontu: cannot read ${err.path}: ${err.message}\n`);
+        return 2;
+    }
+    const declared = loadProfiles(profileFiles, trust);
+    if ('number' === typeof declared) {
+        return declared;
+    }
+    // A GENERATOR IS AN ENTRY, not a preprocessing step: the file whose
+    // provenance is asked for is the one the author edits.
+    if (!rest[0].endsWith('.aon')) {
+        src = (0, template_1.desugarTemplate)(src, marker ??
+            (0, template_1.markerFromProfiles)(declared, rest[0]) ?? (0, template_1.markerFor)(rest[0]));
+    }
+    const report = (0, trace_1.traceRun)(src, {
+        path: rest[0], at,
+        ...verbOpts(trust, entryRootOf(rest[0])),
+    });
+    if ('error' === report.verdict) {
+        // An error report always carries its findings.
+        const errors = report.errors;
+        process.stderr.write(errors.map(renderFinding).join('\n') + '\n');
+        return 4;
+    }
+    if ('json' === format) {
+        process.stdout.write(JSON.stringify({ trace: report.trace }) + '\n');
+        return 0;
+    }
+    for (const e of report.trace) {
+        process.stdout.write([e.file, e.at, e.node, e.rule].join('\t') + '\n');
+    }
+    return 0;
+}
 function runReaches(argv) {
     const trusted = takeTrust(argv);
     if (null == trusted) {
@@ -2469,12 +2268,6 @@ function runView(argv) {
             rest.push(arg);
         }
     }
-    // ESCAPES NEVER GO INTO A FILE. A pinned golden holding terminal
-    // control codes is not a golden anybody can read, and a byte
-    // comparison against one would fail on the reader's terminal
-    // settings. `auto` resolves to `none` there on its own; asking for
-    // `ansi` explicitly is a usage error rather than a silent downgrade,
-    // so a script that wanted colour is told where it went.
     if ('ansi' === style && (undefined !== out || undefined !== opts.views)) {
         process.stderr.write('aontu: --style ansi writes to a terminal, not to a file\n');
         return 2;
@@ -2482,10 +2275,6 @@ function runView(argv) {
     // THE VIEW DOCUMENT draws every figure a document declares, so it
     // names no kind: the declarations do, one each.
     if (undefined !== opts.views) {
-        // A declaration names its own profile, so the style is left to
-        // each figure's own default; `--style none` still reaches every
-        // one of them, which is how a host page that binds the CSS
-        // variables asks for eight figures without eight stylesheets.
         opts.style = viewStyleOf(style, undefined);
         return runViewSet(rest, opts, trust, { format, check, strict, out });
     }
@@ -2553,17 +2342,6 @@ function runView(argv) {
         docs: files.slice(1).map((path, i) => ({ src: srcs[i + 1], path })),
     };
     const report = (0, view_1.view)(srcs[0], viewOpts);
-    // AN EMPTY FIGURE IS THE SAME BYTES AS A DRAWN ONE MINUS ITS
-    // CONTENT, and every profile spells "empty" differently: text draws
-    // nothing at all, mermaid still draws its `flowchart LR` header, the
-    // matrix still prints its count line. Rather than teach this one
-    // place each of those spellings -- a list that goes stale the first
-    // time a profile gains a header -- ASK THE SAME KIND TO DRAW AN
-    // EMPTY DOCUMENT and compare. Equal texts mean this document
-    // contributed nothing to the figure, whatever the profile.
-    //
-    // It costs one drawing of `{}`, which is the cheapest document
-    // there is, and only on a run that produced a figure at all.
     if ('error' !== report.verdict && null != report.text) {
         const bare = (0, view_1.view)('{}', viewOpts);
         if ('error' !== bare.verdict && bare.text === report.text) {
@@ -2612,13 +2390,6 @@ function runView(argv) {
     }
     return strict && 'lossy' === report.verdict ? 1 : VIEW_EXIT[report.verdict];
 }
-// `aontu view --views <path> <file>`: every figure the document
-// declares, from one evaluation, all or nothing.
-//
-// A declared `out` is resolved against the DOCUMENT's own directory,
-// not the caller's: a view document is committed beside the figures it
-// gates, and a gate that only passes from one working directory is not
-// a gate.
 function runViewSet(rest, opts, trust, how) {
     if (1 !== rest.length) {
         process.stderr.write('aontu: view --views takes one file\n');
@@ -2742,8 +2513,6 @@ function renderViewJson(report) {
 }
 function renderRelationsText(report) {
     const head = `verdict: ${report.verdict}`;
-    // WHY, when the document could not be evaluated at all: rendered as
-    // vet renders a finding, because it IS one (the review's finding F).
     const errors = report.errors ?? [];
     if (0 < errors.length) {
         return [head, ''].concat(errors.map(renderFinding)).join('\n');
@@ -2765,19 +2534,6 @@ function renderRelationsJson(report) {
         ...(null == report.errors ? {} : { errors: report.errors }),
     }, 2);
 }
-// ---------------------------------------------------------------------
-// JSON SCHEMA EXPORT (SUPPORT.md act 2, the review's finding I): the
-// bridge to every structured-output API, which constrains generation to
-// JSON Schema and nothing else. Export the model, let the provider
-// generate under it, then `vet` the result against the model itself --
-// the hybrid an enterprise actually deploys, and impossible without
-// this verb.
-//
-// THE SCHEMA GOES TO STDOUT AND THE LOSSES TO STDERR, so `aontu
-// jsonschema x.aon > schema.json` writes a schema and still tells the
-// reader what it could not carry. `--strict` makes a loss a refusal,
-// for the CI job that would rather fail than ship a schema weaker than
-// its model.
 const JSONSCHEMA_HELP = 'aontu jsonschema [--at <path>] [--strict] <file> (try --help)';
 function runJsonSchema(argv) {
     const trusted = takeTrust(argv);
@@ -2861,331 +2617,19 @@ function runJsonSchema(argv) {
     return 'error' === report.verdict ? 4 :
         strict && 'lossy' === report.verdict ? 1 : 0;
 }
-// ---------------------------------------------------------------------
-// THE RENDER VERB (docs/design/RENDER.0.md D8): evaluate a document,
-// vet the value at --at against aontu:code, fold code.units into bytes,
-// and put them where the flag says -- one unit on stdout, every unit
-// below --out (all or nothing), or compared against --check. Exit codes
-// mirror jsonschema's: 0 ok; 1 lossy under --strict or drift under
-// --check; 2 usage or I/O, a refused unit path included; 4 the
-// document does not stand up or the instance is not aontu:code.
-const RENDER_HELP = 'aontu render [--at <path>] [--profile <file>]... [--unit <path>] ' +
-    '[--stdout | --out <dir> | --check <dir> | --coverage] ' +
-    '[--coverage-at <path>] [--strict] [--marker <token>] <file> (try --help)';
-function runRender(argv) {
+const TEMPLATE_HELP = 'aontu template [--resugar] [--check] [--marker <token>] <file> (try --help)';
+function runTemplate(argv) {
     const trusted = takeTrust(argv);
     if (null == trusted) {
         return 2;
     }
     argv = trusted.argv;
     const trust = trusted.trust;
-    const files = [];
-    const profileFiles = [];
-    let format = 'text';
-    let at = undefined;
-    let unit = undefined;
-    let out = undefined;
-    let check = undefined;
-    let toStdout = false;
-    let strict = false;
-    let coverage = false;
-    let coverageAt = undefined;
-    let marker = undefined;
-    for (let i = 0; i < argv.length; i++) {
-        const arg = argv[i];
-        if ('-h' === arg || '--help' === arg) {
-            process.stdout.write(HELP);
-            return 0;
-        }
-        if ('--format' === arg) {
-            const f = argv[++i];
-            if ('text' !== f && 'json' !== f) {
-                process.stderr.write('aontu: --format needs text or json\n');
-                return 2;
-            }
-            format = f;
-        }
-        else if ('--at' === arg) {
-            at = argv[++i];
-            if (null == at) {
-                process.stderr.write('aontu: --at needs a path\n');
-                return 2;
-            }
-        }
-        else if ('--unit' === arg) {
-            unit = argv[++i];
-            if (null == unit) {
-                process.stderr.write('aontu: --unit needs a unit path\n');
-                return 2;
-            }
-        }
-        else if ('--profile' === arg) {
-            const pf = argv[++i];
-            if (null == pf) {
-                process.stderr.write('aontu: --profile needs a file\n');
-                return 2;
-            }
-            profileFiles.push(pf);
-        }
-        else if ('--out' === arg) {
-            out = argv[++i];
-            if (null == out) {
-                process.stderr.write('aontu: --out needs a directory\n');
-                return 2;
-            }
-        }
-        else if ('--check' === arg) {
-            check = argv[++i];
-            if (null == check) {
-                process.stderr.write('aontu: --check needs a directory\n');
-                return 2;
-            }
-        }
-        else if ('--stdout' === arg) {
-            toStdout = true;
-        }
-        else if ('--coverage' === arg) {
-            coverage = true;
-        }
-        else if ('--marker' === arg) {
-            marker = argv[++i];
-            if (null == marker) {
-                process.stderr.write('aontu: --marker needs a token\n');
-                return 2;
-            }
-        }
-        else if ('--coverage-at' === arg) {
-            coverageAt = argv[++i];
-            if (null == coverageAt) {
-                process.stderr.write('aontu: --coverage-at needs a path\n');
-                return 2;
-            }
-        }
-        else if ('--strict' === arg) {
-            strict = true;
-        }
-        else if (arg.startsWith('-')) {
-            process.stderr.write(`aontu: unknown render option ${arg} (try --help)\n`);
-            return 2;
-        }
-        else {
-            files.push(arg);
-        }
-    }
-    if (1 !== files.length) {
-        process.stderr.write(`aontu: render needs one file\n${RENDER_HELP}\n`);
-        return 2;
-    }
-    const modes = [toStdout, undefined !== out, undefined !== check, coverage]
-        .filter((on) => on).length;
-    if (1 < modes) {
-        process.stderr.write('aontu: render takes one of --stdout, --out, --check or --coverage\n');
-        return 2;
-    }
-    // A NARROWER MEASURE NEEDS SOMETHING TO NARROW. `--coverage-at`
-    // without `--coverage` asks for a report the run does not compute,
-    // and answering silently would be the wrong half of the request.
-    if (undefined !== coverageAt && !coverage) {
-        process.stderr.write('aontu: --coverage-at needs --coverage\n');
-        return 2;
-    }
-    let src;
-    try {
-        src = (0, node_fs_1.readFileSync)(files[0], 'utf8');
-    }
-    catch (err) {
-        process.stderr.write(`aontu: cannot read ${err.path}: ${err.message}\n`);
-        return 2;
-    }
-    // THE ENTRY MAY BE A TEMPLATE (TEMPLATE.0.md; P8), and its EXTENSION
-    // decides, as an include's extension decides what the include is
-    // (ADR-012): a generator is a file in the target's own syntax, so it
-    // carries the target's extension and never `.aon`. Desugared here
-    // rather than anywhere deeper, because a template is an entry
-    // spelling and not a value: an include is still aontu.
-    if (!files[0].endsWith('.aon')) {
-        src = (0, template_1.desugarTemplate)(src, marker ?? (0, template_1.markerFor)(files[0]));
-    }
-    // THE PROFILES (D5): each --profile file is a document whose root is
-    // `profile: {lang, ...}`, evaluated under the verb's trust and vetted
-    // against aontu:profile as a settled value before the fold reads it
-    // (renderProfile, which also fills the defaults). Two files claiming
-    // one lang is a usage error: the fold could not choose.
-    const profiles = [];
-    const langs = new Map();
-    for (const pf of profileFiles) {
-        let text;
-        try {
-            text = (0, node_fs_1.readFileSync)(pf, 'utf8');
-        }
-        catch (err) {
-            process.stderr.write(`aontu: cannot read ${err.path}: ${err.message}\n`);
-            return 2;
-        }
-        const loaded = (0, aontu_1.renderProfile)(text, { path: (0, node_path_1.resolve)(pf), ...verbOpts(trust, entryRootOf(pf)) });
-        if (undefined !== loaded.errors) {
-            process.stderr.write(loaded.errors.map(renderFinding).join('\n') + '\n');
-            return 4;
-        }
-        const profile = loaded.profile;
-        const prev = langs.get(profile.lang);
-        if (undefined !== prev) {
-            process.stderr.write(`aontu: two profiles claim ${profile.lang}: ${prev} and ${pf}\n`);
-            return 2;
-        }
-        langs.set(profile.lang, pf);
-        profiles.push(profile);
-    }
-    // A RENDER WITH NO PROFILE PRODUCES NO UNITS, and said so with zero
-    // bytes and exit 0. The profile is what maps a model onto a
-    // language, so without one there is nothing for the renderer to
-    // write -- which is a usable answer only if the caller is told.
-    const noProfiles = 0 === profiles.length;
-    const report = (0, aontu_1.render)(src, {
-        at, unit, strict, profiles, path: files[0],
-        coverage, coverageAt,
-        // THE JSON REPORT CARRIES THE TRACE (D9), which is what the shape
-        // there has always said; a text run computes it only when the
-        // coverage report needs it.
-        trace: 'json' === format,
-        ...verbOpts(trust, entryRootOf(files[0])),
-    });
-    // Said once, whatever the format: stdout stays the report.
-    if ('error' !== report.verdict && 0 === report.units.length) {
-        vacuous('nothing was rendered', noProfiles
-            ? 'no profile was given, and the document declares none' +
-                ' (see aontu help tasks)'
-            : 'the document produced no units under this profile');
-    }
-    if ('json' === format) {
-        process.stdout.write((0, aontu_1.exactJSON)({
-            aontu: { version: version(), verb: 'render' },
-            verdict: report.verdict,
-            units: report.units,
-            lossy: report.lossy,
-            ...(null == report.errors ? {} : { errors: report.errors }),
-            ...(null == report.trace ? {} : { trace: report.trace }),
-            ...(null == report.coverage ? {} : { coverage: report.coverage }),
-        }, 2) + '\n');
-        return renderExit(report, 0);
-    }
-    if ('error' === report.verdict) {
-        process.stderr.write(report.errors.map(renderFinding).join('\n') + '\n');
-        return renderExit(report, 0);
-    }
-    let drift = 0;
-    if (toStdout) {
-        // ONE UNIT'S BYTES AND NOTHING ELSE, so the output can be piped
-        // into a formatter or a file.
-        if (1 !== report.units.length) {
-            process.stderr.write('aontu: --stdout needs exactly one unit, and the instance has ' +
-                `${report.units.length}; --unit names one\n`);
-            return 2;
-        }
-        process.stdout.write(report.units[0].text);
-    }
-    else if (undefined !== out) {
-        // EVERY UNIT BELOW <dir>, OR NOTHING: every unit rendered first
-        // (the report above), and no file touched unless all did. The
-        // directory is realpath-confined; a unit path is already a relative
-        // descent (render_path refuses the rest), and the check here is
-        // against the symlink inside it. render never deletes.
-        for (const u of report.units) {
-            if ((0, mcp_1.outsideRoot)(out, (0, node_path_1.resolve)(out, u.path))) {
-                process.stderr.write(`aontu: ${u.path} escapes ${out}\n`);
-                return 2;
-            }
-        }
-        for (const u of report.units) {
-            const full = (0, node_path_1.resolve)(out, u.path);
-            try {
-                (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(full), { recursive: true });
-                (0, node_fs_1.writeFileSync)(full, u.text, 'utf8');
-            }
-            catch (err) {
-                process.stderr.write(`aontu: cannot write ${u.path}: ${err.message}\n`);
-                return 2;
-            }
-            process.stderr.write(`wrote ${u.path}\n`);
-        }
-    }
-    else if (undefined !== check) {
-        // RENDER AND COMPARE: a unit whose bytes differ from the file at
-        // <dir>/<path>, or whose file is absent, is drift, listed by path.
-        // The CI form.
-        for (const u of report.units) {
-            let have = undefined;
-            try {
-                have = (0, node_fs_1.readFileSync)((0, node_path_1.resolve)(check, u.path), 'utf8');
-            }
-            catch {
-                // Absent is drift, reported below.
-            }
-            if (undefined === have) {
-                drift++;
-                process.stderr.write(`aontu: ${u.path} is missing from ${check}\n`);
-            }
-            else if (have !== u.text) {
-                drift++;
-                process.stderr.write(`aontu: ${u.path} differs from the rendered unit\n`);
-            }
-        }
-    }
-    else if (coverage) {
-        // THE COVERAGE REPORT (P7), one line per finding and a count at
-        // the end: dead model first, then the declarations no rule
-        // produced. A clean report is the count line alone.
-        const cov = report.coverage;
-        for (const d of cov.dead) {
-            process.stdout.write(`dead: ${d}\n`);
-        }
-        for (const u of cov.unruled) {
-            process.stdout.write(`unruled: ${u.unit} ${u.path}\n`);
-        }
-        process.stdout.write(`coverage: ${cov.read.length} path(s) read, ${cov.dead.length} ` +
-            `no output consumed, ${cov.unruled.length} declaration(s) ` +
-            'no rule produced\n');
-    }
-    else {
-        // THE SUMMARY: one line per unit -- its path, its language and its
-        // size -- since several units have no one text to print.
-        for (const u of report.units) {
-            process.stdout.write(`${u.path}\t${u.lang}\t${u.text.length} bytes\n`);
-        }
-    }
-    for (const l of report.lossy) {
-        process.stderr.write(`lossy: ${l.unit} ${l.path} tier ${l.tier} ${l.construct}: ${l.reason}\n`);
-    }
-    return renderExit(report, drift);
-}
-// D8's exit table over a report: a refused unit path is usage (2), a
-// strict refusal is lossy (1), any other error is the document's (4);
-// drift under --check is 1.
-function renderExit(report, drift) {
-    if ('error' === report.verdict) {
-        const errors = report.errors;
-        if (errors.every((f) => 'render_path' === f.code)) {
-            return 2;
-        }
-        if (errors.every((f) => 'render_strict' === f.code)) {
-            return 1;
-        }
-        return 4;
-    }
-    return 0 < drift ? 1 : 0;
-}
-// ---------------------------------------------------------------------
-// THE TEMPLATE SURFACE (docs/design/TEMPLATE.0.md; RENDER.0.md P8): the
-// two transforms and the round trip between them. `render` reads a
-// template directly, by its extension; this verb is for seeing the
-// canonical form, for writing one by hand and sugaring it, and for the
-// check that keeps a committed template and its meaning in agreement.
-const TEMPLATE_HELP = 'aontu template [--resugar] [--check] [--marker <token>] <file> (try --help)';
-function runTemplate(argv) {
     const files = [];
     let resugar = false;
     let check = false;
     let marker = undefined;
+    const profileFiles = [];
     for (let i = 0; i < argv.length; i++) {
         const arg = argv[i];
         if ('-h' === arg || '--help' === arg) {
@@ -3205,6 +2649,14 @@ function runTemplate(argv) {
                 return 2;
             }
         }
+        else if ('--profile' === arg) {
+            const pf = argv[++i];
+            if (null == pf) {
+                process.stderr.write('aontu: --profile needs a file\n');
+                return 2;
+            }
+            profileFiles.push(pf);
+        }
         else if (arg.startsWith('-')) {
             process.stderr.write(`aontu: unknown template option ${arg} (try --help)\n`);
             return 2;
@@ -3217,10 +2669,6 @@ function runTemplate(argv) {
         process.stderr.write(`aontu: template needs one file\n${TEMPLATE_HELP}\n`);
         return 2;
     }
-    // THE TWO ARE DIRECTIONS, NOT MODES THAT COMPOSE: `--check` reads a
-    // template and asks whether the round trip answers it back, and
-    // `--resugar` reads the canonical form instead. A run cannot be both
-    // at once, because the file is one thing or the other.
     if (resugar && check) {
         process.stderr.write('aontu: template takes one of --resugar or --check\n');
         return 2;
@@ -3233,18 +2681,13 @@ function runTemplate(argv) {
         process.stderr.write(`aontu: cannot read ${err.path}: ${err.message}\n`);
         return 2;
     }
-    const mark = marker ?? (0, template_1.markerFor)(files[0]);
+    const declared = loadProfiles(profileFiles, trust);
+    if ('number' === typeof declared) {
+        return declared;
+    }
+    const mark = marker ?? (0, template_1.markerFromProfiles)(declared, files[0]) ??
+        (0, template_1.markerFor)(files[0]);
     if (check) {
-        // THE ROUND TRIP IS THE CHECK (D6): the file held to the spelling
-        // the two transforms answer. What that names is a marker line the
-        // transform would not have written -- one without its space, or one
-        // whose aontu is indented after the marker rather than before it,
-        // since the marker keeps its own indentation. It does NOT name a
-        // changed body line: a template's whitespace is output, so a
-        // trimmed trailing space is still a valid template and it is
-        // `render --check` against the committed files that catches it.
-        // The first line that differs is the report, since a whole diff of
-        // a generator is the file again.
         const back = (0, template_1.resugarTemplate)((0, template_1.desugarTemplate)(src, mark), mark);
         if (back === src) {
             return 0;
@@ -3255,12 +2698,6 @@ function runTemplate(argv) {
         while (n < want.length && n < have.length && want[n] === have[n]) {
             n++;
         }
-        // THE TWO ARE THE SAME LENGTH, always: each transform maps one
-        // line to one line and applies the same trailing-newline rule, so
-        // `back` has as many lines as `src`. The loop above therefore stops
-        // at a real difference rather than by running out of either -- an
-        // equal prefix all the way to the end IS `back === src`, which
-        // returned above. So both indexes are in range here.
         process.stderr.write(`aontu: ${files[0]}:${n + 1} is not what the round trip answers\n` +
             `  have: ${JSON.stringify(have[n])}\n` +
             `  want: ${JSON.stringify(want[n])}\n`);
@@ -3270,13 +2707,38 @@ function runTemplate(argv) {
         (0, template_1.resugarTemplate)(src, mark) : (0, template_1.desugarTemplate)(src, mark));
     return 0;
 }
-// ---------------------------------------------------------------------
-// The canon-hash (G6 phase 1): the pin an agent, a lockfile or a
-// registry stores for "this module, this meaning". The hash covers the
-// module evaluated STANDALONE -- its own include closure resolved and
-// unified at its own root, before any consumer context -- which is what
-// makes the pin transitive: an edit two includes deep changes the
-// unified root, hence the hash.
+// The profiles named by --profile, vetted, or the exit code that says
+// why not. A profile is a language declared as data: `template` and
+// `fmt` match one to a file by the extensions its `template.ext`
+// names.
+function loadProfiles(profileFiles, trust) {
+    const profiles = [];
+    const langs = new Map();
+    for (const pf of profileFiles) {
+        let text;
+        try {
+            text = (0, node_fs_1.readFileSync)(pf, 'utf8');
+        }
+        catch (err) {
+            process.stderr.write(`aontu: cannot read ${err.path}: ${err.message}\n`);
+            return 2;
+        }
+        const loaded = (0, aontu_1.loadProfile)(text, { path: (0, node_path_1.resolve)(pf), ...verbOpts(trust, entryRootOf(pf)) });
+        if (undefined !== loaded.errors) {
+            process.stderr.write(loaded.errors.map(renderFinding).join('\n') + '\n');
+            return 4;
+        }
+        const profile = loaded.profile;
+        const prev = langs.get(profile.lang);
+        if (undefined !== prev) {
+            process.stderr.write(`aontu: two profiles claim ${profile.lang}: ${prev} and ${pf}\n`);
+            return 2;
+        }
+        langs.set(profile.lang, pf);
+        profiles.push(profile);
+    }
+    return profiles;
+}
 const HASH_HELP = 'aontu hash <file> (try --help)';
 function runHash(argv) {
     const trusted = takeTrust(argv);
@@ -3331,14 +2793,6 @@ function runHash(argv) {
     const ctx = aontu.ctx({ collect: true });
     const v = aontu.unify(src, { path: files[0] }, ctx);
     if (0 < ctx.err.length || true === v?.isNil) {
-        // A document that does not stand up on its own has no meaning to
-        // pin, and a hash of a broken evaluation would be a pin that
-        // silently agrees with every other broken evaluation.
-        // WHY it does not stand up, not just that it does not: the same
-        // diagnosis `aontu <file>` prints (the review's finding F).
-        // evalFailure unconditionally, as every other call site does: it
-        // owns the "ctx.err is never empty here" contract, and a guard
-        // that pretends otherwise is a dead arm asserting nothing.
         process.stderr.write(`aontu: ${files[0]} does not evaluate on its own; nothing to hash\n` +
             renderFinding((0, query_1.evalFailure)(ctx)) + '\n');
         return 4;
@@ -3353,12 +2807,6 @@ function runHash(argv) {
     process.stdout.write(text + '\n');
     return 0;
 }
-// ---------------------------------------------------------------------
-// The query surface (G7 phase 1): one node of an evaluated document,
-// selected by path and rendered. Evaluation is still GLOBAL -- what
-// `get` buys is the size of the ANSWER, not the cost of producing it --
-// and the projections are lattice abstractions, each a valid Aontu
-// document that subsumes the truth it summarises.
 const GET_HELP = 'aontu get <path> <file> (try --help)';
 function runGet(argv) {
     const trusted = takeTrust(argv);
@@ -3527,11 +2975,6 @@ function runWhy(argv) {
     }
     return 'no_path' === report.findings[0]?.code ? 1 : 4;
 }
-// One contribution per line, numbered in source order, each with what
-// was written, where, and how it got here. A siteless contribution
-// prints no location rather than a `-1:-1` that means nothing —
-// exported for the direct test, because the site SHAPE allows one
-// while no document has yet produced one (ADR-002).
 function renderWhyText(record) {
     const head = `${record.path} = ${record.value}`;
     if (0 === record.conjuncts.length) {
@@ -3547,12 +2990,6 @@ function renderWhyText(record) {
             ('literal' === c.role ? '' : `  (${c.role})`);
     })).join('\n');
 }
-// ---------------------------------------------------------------------
-// The overlay patch verb (G7 phase 5): change a document by APPENDING
-// to an overlay, not by rewriting it. An overlay entry is just another
-// conjunct and unification is order-independent, so this needs no
-// rewriter — the format-preserving in-place edit is stage 2, and needs
-// a comment-preserving CST the parser stack does not have.
 const SET_HELP = 'aontu set <path>=<value> --entry <file> --overlay <file> (try --help)';
 function runSet(argv) {
     const trusted = takeTrust(argv);
@@ -3659,27 +3096,10 @@ function runSet(argv) {
         }, 2) + '\n');
     }
     else {
-        // A replacement is REPORTED as the edit it is, not left for the
-        // reader to infer from a changed file: `where: what -> what`, in
-        // source spelling, because the spelling is what changed.
-        //
-        // PAST TENSE ONLY WHERE IT HAPPENED. A refused write leaves the
-        // file exactly as it was, and one assignment can be replaceable
-        // while another makes the whole run invalid — so `replaced:` there
-        // tells an operator the pin was changed when it was not, and unlike
-        // `--dry-run` there is nothing else on the line to say otherwise.
         const verb = wrote ? 'replaced' : 'would replace';
         const edits = report.replaced.map((r) => `${verb}: ${r.file}:${r.row}:${r.col} ${r.from} -> ${r.to}`);
         const head = [`verdict: ${report.verdict}`].concat(edits).join('\n') +
             (wrote ? `\nwrote: ${overlayFile}` : dryRun ? '\n(dry run)' : '');
-        // A SUCCESSFUL COMMAND WRITES ITS STATUS TO STDOUT, findings or
-        // not. Routing on `findings.length` was right while every finding
-        // this verb could produce was an ERROR; `--in-place` made a WARNING
-        // possible, and a run that held, wrote the file and exited 0 then
-        // sent its whole report to stderr — leaving stdout empty, so
-        // `$(aontu set ...)` captured nothing and only the JSON form
-        // behaved like a success. The verdict decides the stream; warnings
-        // are diagnostics and go to stderr beside it.
         const failed = 'invalid' === report.verdict || 'error' === report.verdict;
         const findingText = report.findings.map(renderFinding);
         if (failed) {
@@ -3698,14 +3118,6 @@ function runSet(argv) {
     }
     return VET_EXIT[report.verdict];
 }
-// ---------------------------------------------------------------------
-// The role gate (docs/design/ALLOW.0.md): may the role the caller is
-// operating under modify these subtrees? Asked before `set`, by an
-// agent whose skill names its role, and answered from a role model
-// that is itself an aontu document. The verdict is the exit code, as
-// it is for every gate here: 0 is yes, 1 is no, 4 is "the model that
-// was to decide does not stand up", and an agent branches on nothing
-// else.
 const ALLOW_HELP = 'aontu allow --role <role> <roles-file> <path> [more-paths...] (try --help)';
 const ALLOW_EXIT = {
     allowed: 0,
@@ -3808,14 +3220,6 @@ function runAllow(argv) {
         process.stderr.write('aontu: --role needs one key, without dots\n');
         return 2;
     }
-    // A path may arrive in `set`'s spelling, `$.a.b=1`, so a skill can
-    // hand the gate the very arguments the write will get. The text up
-    // to the first `=` is the path, and it starts with `$`: an empty
-    // argument, or a second file name, would otherwise read as a path
-    // and be answered. The VALUE is checked to be one value. `set`
-    // appends it as source after the flattened path, so a value carrying
-    // a second pair -- `3 secrets: key: "x"` -- writes a sibling of the
-    // overlay root, a subtree the gate was never asked about.
     const paths = [];
     for (const arg of asked) {
         const eq = arg.indexOf('=');
@@ -3949,28 +3353,17 @@ function runAgentsMd(argv) {
     process.stdout.write(`wrote: ${write}\n`);
     return 0;
 }
-// Exit without truncating output.
-//
-// process.exit() terminates immediately, discarding anything still
-// queued on stdout. A write to a PIPE is asynchronous once it exceeds
-// the pipe buffer, so `write(big); exit(0)` silently truncated output at
-// 65536 bytes — while a write to a TTY or a file, being synchronous,
-// looked fine. Setting exitCode instead lets the process end naturally,
-// after the queue drains.
-//
-// This predates the exact leaves but they make it trivially reachable
-// (one long biginteger canon exceeds the buffer), and it lands squarely
-// on the parity-probe discipline in AGENTS.md, which derives expected
-// spec values by piping BOTH CLIs and comparing. A truncated pipe there
-// reads as a port divergence.
-// ---------------------------------------------------------------------
-// The source formatter (docs/design/FMT.0.md): one agreed form, in the
-// tradition of gofmt. The verb prints, lists, checks, diffs or rewrites;
-// the form itself is the library's (ts/src/format.ts), and the two
-// ports agree on it row by row in test/spec/fmt.tsv.
-const FMT_HELP = 'aontu fmt [-w|-l|--check|-d|--lint] [--marker <token>] <file>... (try --help)';
+const FMT_HELP = 'aontu fmt [-w|-l|--check|-d|--lint] [--marker <token>] ' +
+    '[--profile <file>] <file>... (try --help)';
 function runFmt(argv) {
+    const trusted = takeTrust(argv);
+    if (null == trusted) {
+        return 2;
+    }
+    argv = trusted.argv;
+    const trust = trusted.trust;
     const files = [];
+    const profileFiles = [];
     let marker = undefined;
     const flags = {
         write: false, list: false, check: false, diff: false, lint: false, strict: false,
@@ -4002,14 +3395,22 @@ function runFmt(argv) {
         }
         else if ('--marker' === arg) {
             // THE MARKER SAYS THE FILE IS A GENERATOR, whatever its
-            // extension: `render` and `template` take the same option for
-            // the same reason, a language the table has never seen.
+            // extension: `fmt` and `template` take the same option for the
+            // same reason, a language the table has never seen.
             marker = argv[++i];
             if (null == marker) {
                 process.stderr.write('aontu: --marker needs a token\n');
                 return 2;
             }
         }
+        else if ('--profile' === arg) {
+            const pf = argv[++i];
+            if (null == pf) {
+                process.stderr.write('aontu: --profile needs a file\n');
+                return 2;
+            }
+            profileFiles.push(pf);
+        }
         else if (arg.startsWith('-')) {
             process.stderr.write(`aontu: unknown fmt option ${arg} (try --help)\n`);
             return 2;
@@ -4033,6 +3434,10 @@ function runFmt(argv) {
             process.stdin.on('end', () => resolve(fmtOne('<stdin>', src, flags, marker)));
         });
     }
+    const declared = loadProfiles(profileFiles, trust);
+    if ('number' === typeof declared) {
+        return declared;
+    }
     // Several files onto standard output would be one stream nobody can
     // split again (the note's X-6): the verb refuses unless an option
     // says what to do with each.
@@ -4051,32 +3456,18 @@ function runFmt(argv) {
             process.stderr.write(`aontu: cannot read ${err.path}: ${err.message}\n`);
             return 2;
         }
-        const mark = fmtMarker(file, src, marker);
+        const mark = fmtMarker(file, src, marker ?? (0, template_1.markerFromProfiles)(declared, file));
         if (false === mark) {
             process.stderr.write(`aontu: ${file} is not aontu source (.aon, .aontu) and carries no ` +
                 `${(0, template_1.markerFor)(file)} marker line, so there is no aontu in it to ` +
-                'format; --marker names the marker for a language the table does ' +
-                'not know\n');
+                'format; --marker names the marker for a language the table ' +
+                'does not know, and --profile reads one that declares it\n');
             return 2;
         }
         worst = Math.max(worst, fmtOne(file, src, flags, mark));
     }
     return worst;
 }
-// WHAT A FILE IS, BY ITS EXTENSION (ADR-012's rule, and the one
-// `render` reads an entry by): `.aon` and `.aontu` are aontu source,
-// and anything else is a GENERATOR written in the target's own syntax
-// (docs/design/TEMPLATE.0.md), whose marker lines carry the document
-// this formats and whose other lines are output. `undefined` is aontu,
-// a string is the generator's marker, and `false` is neither.
-//
-// A FILE WITH NO MARKER LINE IN IT IS NEITHER, and that is what keeps
-// FMT.0.md §9's boundary where it stood: a `.json`, `.yaml` or `.toml`
-// include is another language's file, and reading one as a generator
-// would answer it back unchanged having understood none of it. The
-// marker is the evidence that a file was written to carry aontu at
-// all. `--marker` says so outright, and then the file is a generator
-// whatever it is called.
 function fmtMarker(file, src, marker) {
     if (undefined !== marker) {
         return marker;
@@ -4132,11 +3523,8 @@ function fmtOne(name, src, flags, marker) {
     }
     return flags.check ? 1 : strict;
 }
-// The real pair takes the process's own stdin and stdout, which no
-// in-process test can lend it; the executable-entry tests in
-// cli.test.ts run each through a child process instead, so these two
-// lines are excluded from the in-process count, as the stdio wiring
-// of lsp-server.ts is.
+// Excluded: the real pair takes the process stdio, so ts/test/cli.test.ts
+// drives each server through a child process instead.
 /* node:coverage ignore next 4 */
 const SERVERS = {
     lsp: () => void (0, lsp_server_1.main)(),
@@ -4176,19 +3564,6 @@ function parseTrustArg(value) {
     }
     return undefined;
 }
-// THE TEACHING PACK, SERVED FROM THE COMMAND (G11 phase 1,
-// docs/capability-review/g11-agent-onramp.md; mirrors
-// go/cmd/aontu/help.go).
-//
-// HELP documents the TOOLCHAIN and says nothing about the LANGUAGE:
-// `&`, the map template and the one construct an ontology cannot be
-// written without, occurs zero times in it, while `template` occurs
-// fourteen times and names an unrelated verb every time. docs/skill/
-// was already the right content and already gated; the gap was
-// DELIVERY, since it reached an installation as
-// node_modules/aontu/skill/ where nothing looks. ts/src/helpdoc.ts is
-// generated from those sources by ts/scripts/helpdoc.cjs and asserted
-// byte-identical with them by ts/test/helpdoc.test.ts.
 const HELP_VERB_HELP = 'aontu help [topic] (try `aontu help` for the topics)';
 const EXPLAIN_HELP = 'aontu explain <code> (try `aontu explain --list`)';
 function helpIndexText(index) {
@@ -4260,22 +3635,6 @@ function runHelp(argv) {
         `aontu: topics are ${helpdoc_1.HELPDOC.map((t) => t.topic).join(', ')}\n`);
     return 2;
 }
-// `aontu explain <code>` (G11 phase 3; mirrors
-// go/cmd/aontu/explain.go).
-//
-// THE REGISTRY IS THE LIST, NOT THE HINT TABLE. test/spec/errcodes.tsv
-// registers 157 codes and the spec suite asserts set equality between
-// the file and codeClasses IN BOTH PORTS, so listing from codeClasses
-// is listing the shared contract. The hint tables are smaller and are
-// NOT in parity -- 130 entries here against 131 in Go, the extra being
-// decimal_syntax, which this port never raises -- so listing from them
-// would make `aontu explain --list` differ between ports over a
-// difference that is not about what either port can report.
-//
-// A REGISTERED CODE WITH NO HINT ANSWERS WITH ITS CLASS AND SAYS SO.
-// Twenty-seven registered codes carry no explanation text here; before
-// this verb their absence was invisible, because a hint is only ever
-// seen beside the error that raises it.
 // The dynamic prefixes a generated code extends (`func:upper`,
 // `op[+]`). Mirrors CODE_PREFIXES in ts/src/hints.ts, which is not
 // exported; a code that extends one is registered through its prefix
@@ -4399,20 +3758,6 @@ function runExplain(argv) {
     process.stdout.write(`code:  ${code}\nclass: ${cls}\n\n${body}\n`);
     return 0;
 }
-// `aontu init` (G11 phase 6,
-// docs/capability-review/g11-agent-onramp.md).
-//
-// NOT SCAFFOLDING CONVENIENCE. The agent's most expensive failure is
-// writing a FIRST document at all: the measurement that opened G11
-// found one reaching for the wildcard its neighbours use and getting
-// `verdict: valid` over data that violates it. A known-good starting
-// document turns generation into editing, which is the operation a
-// model is reliably good at.
-//
-// The trio is real, runnable and tested where it lives
-// (docs/skill/init/, run by ts/test/helpdoc.test.ts), and staged into
-// both ports by the same generator that stages the teaching pack, so
-// the two write the same bytes.
 const INIT_HELP = 'aontu init [dir] (try --help)';
 function runInit(argv) {
     const dirs = [];
@@ -4432,10 +3777,6 @@ function runInit(argv) {
         return 2;
     }
     const dir = dirs[0] ?? '.';
-    // REFUSES TO OVERWRITE, and checks every member BEFORE writing any of
-    // them: a scaffold that wrote two files and then refused the third
-    // would leave a directory in a state neither the caller nor a re-run
-    // can reason about.
     const standing = helpdoc_1.INITDOC.filter((f) => (0, node_fs_1.existsSync)((0, node_path_1.join)(dir, f.name)));
     if (0 < standing.length) {
         process.stderr.write(`aontu: ${dir} already holds ${standing.map((f) => f.name).join(', ')}\n` +
@@ -4459,17 +3800,11 @@ function runInit(argv) {
         'Learn the language:  aontu help language\n');
     return 0;
 }
-// EVERY VERB THIS PORT DISPATCHES, for the nearest-verb suggestion
-// G11 phase 2 prints. A separate list from the if-chain in main()
-// because the chain's arms have three different shapes and cannot be
-// a table; ts/test/cli-help.test.ts keeps the two from drifting by
-// running each name and requiring it not to fall through to the bare
-// command.
 const KNOWN_VERBS = [
     'agentsmd', 'allow', 'breaking', 'explain', 'fmt', 'get', 'hash',
     'help', 'init', 'jsonschema', 'lsp', 'mcp', 'mod', 'reaches',
-    'relations', 'render', 'set', 'subsume', 'template', 'trim', 'vet',
-    'view', 'why',
+    'relations', 'set', 'subsume', 'template', 'trace', 'trim',
+    'vet', 'view', 'why',
 ];
 exports.KNOWN_VERBS = KNOWN_VERBS;
 // looksLikeVerb reports whether an unreadable argument was meant as a
@@ -4481,13 +3816,6 @@ function looksLikeVerb(arg) {
         !/[/\\.]/.test(arg) &&
         !arg.startsWith('-');
 }
-// NEAREST-VERB SUGGESTION (G11 phase 2). Restricted
-// Damerau-Levenshtein with a cap that grows with the word and stops at
-// three: one edit is a convincing suggestion on any length, three is
-// the most that can be believed on a long one, and an UNCAPPED
-// nearest match on a three-letter typo names something unrelated with
-// confidence. Mirrors go/cmd/aontu/help.go, including the sort, so
-// the two ports suggest the same verb on a tie.
 function nearestVerb(word, verbs) {
     let best = '';
     let bestDist = Infinity;
@@ -4501,8 +3829,6 @@ function nearestVerb(word, verbs) {
     }
     return bestDist > limit ? '' : best;
 }
-// Levenshtein with a transposition, iterative over two rows. Mirrors
-// editDistance in go/cmd/aontu/help.go exactly.
 function editDistance(a, b) {
     const ar = [...a];
     const br = [...b];
@@ -4527,25 +3853,12 @@ function editDistance(a, b) {
     return prev[br.length];
 }
 function main(argv, servers = SERVERS) {
-    // COLOUR OFF WHEN THE DESTINATION IS NOT A TERMINAL. Error frames
-    // hardcoded their ANSI escapes, so a piped report and a `--jsonl`
-    // answer carried terminal control codes into whatever read them (the
-    // review's finding F). `NO_COLOR` is honoured by the library itself;
-    // only the CLI can see whether its stderr is a terminal, so only the
-    // CLI can make this call. `undefined` means "leave it to NO_COLOR".
     (0, aontu_1.setColor)(true === process.stderr.isTTY ? undefined : false);
     let mode = 'json';
     // THE REPORT FORM (G11 phase 7), default text: every existing caller
     // reads exactly what it always read, and a caller that asks for json
     // gets the failure in the finding shape every other verb reports.
     let format = 'text';
-    // A LIST, though the bare command evaluates exactly one document.
-    // It used to be one variable and the last argument won, which made a
-    // MISTYPED VERB a silent success: `aontu vet2 schema.aon good.json`
-    // printed good.json and exited 0, because `vet2` matched no
-    // subcommand, fell through to this loop as a file name, and was
-    // overwritten twice. In a tool loop that reads as a passing
-    // validation. Counting them is what lets the refusal below happen.
     const files = [];
     let trust = { kind: 'system-warn', textExt: [] };
     let textExt = [];
@@ -4554,15 +3867,6 @@ function main(argv, servers = SERVERS) {
     // than the design's --json, which would read as the `:json` output
     // mode the REPL already has.
     let jsonl = false;
-    // Subcommand dispatch, and deliberately only for a FIRST argument:
-    // `aontu vet` is the verb, while `aontu somefile vet` keeps meaning
-    // what it always did. A file named `vet` is still reachable as
-    // `aontu ./vet`.
-    //
-    // Promise.resolve either way: a non-watch run returns its exit class
-    // synchronously (and has already written its report), while `--watch`
-    // resolves only when the watch ends — so one await-shaped line serves
-    // both without a branch to keep covered.
     if ('vet' === argv[2]) {
         return void Promise.resolve(runVet(argv.slice(3))).then(finish);
     }
@@ -4620,12 +3924,12 @@ function main(argv, servers = SERVERS) {
     if ('jsonschema' === argv[2]) {
         return finish(runJsonSchema(argv.slice(3)));
     }
-    if ('render' === argv[2]) {
-        return finish(runRender(argv.slice(3)));
-    }
     if ('template' === argv[2]) {
         return finish(runTemplate(argv.slice(3)));
     }
+    if ('trace' === argv[2]) {
+        return finish(runTrace(argv.slice(3)));
+    }
     if ('reaches' === argv[2]) {
         return finish(runReaches(argv.slice(3)));
     }
@@ -4699,23 +4003,12 @@ function main(argv, servers = SERVERS) {
             files.push(arg);
         }
     }
-    // ONE DOCUMENT. The bare form has always been `aontu [options]
-    // [file]`, singular, and anything past the first was silently
-    // discarded rather than refused -- so every way of getting the verb
-    // wrong (a typo, a verb this port does not have, a verb spelled for
-    // another tool) ended in a plausible answer about the wrong file.
-    // Exit 2, the usage class, and the message names the cause rather
-    // than the symptom: nothing here can tell a mistyped verb from a
-    // second file, but the reader can.
     if (1 < files.length) {
         process.stderr.write(`aontu: the bare command evaluates one document, and ${files.length}` +
             ' were given\naontu: a mistyped verb reads as a file name' +
             ' (try --help)\n');
         return finish(2);
     }
-    // The extensions ride with the capability from here on, so the three
-    // entry shapes below (file, REPL, stdin) each get them by threading
-    // the one value they already thread.
     trust = { ...trust, textExt };
     const file = files[0];
     if (null != file) {
@@ -4731,5 +4024,5 @@ function main(argv, servers = SERVERS) {
     else {
         runStdin(mode, format, trust).then((code) => finish(code));
     }
-} /* node:coverage ignore next 20 */
+} /* node:coverage ignore next 21 */
 //# sourceMappingURL=cli.js.map