arkgate 4.8.22 → 4.8.24

package/bin/ark-layer-match.mjs

@@ -9,6 +9,26 @@
  * CLI-only layerForFile (Node path resolution) is appended below the pure core.
  */
 
+/** The mode of a `sharedImportsSlice` value. Never compare the raw value to a string. */
+export function sharedImportsSliceMode(setting) {
+    if (setting === 'deny' || setting === 'deny-cross-parent')
+        return setting;
+    if (setting !== null && typeof setting === 'object') {
+        const mode = setting.mode;
+        if (mode === 'deny-cross-parent')
+            return mode;
+    }
+    return undefined;
+}
+/** Composition roots the deny-cross-parent walk stops at. Empty for the string forms. */
+export function sharedImportsSliceStopAt(setting) {
+    if (setting === null || typeof setting !== 'object')
+        return [];
+    const stopAt = setting.stopAt;
+    if (!Array.isArray(stopAt))
+        return [];
+    return stopAt.filter((entry) => typeof entry === 'string' && entry.length > 0);
+}
 const regexpCache = new Map();
 function escapeLiteral(ch) {
     return /[.*+?^${}()|[\]\\]/.test(ch) ? `\\${ch}` : ch;
@@ -223,13 +243,25 @@ export function layerForRelativePath(relPath, layers) {
  * With `sliceIdentity` `"path"` (the default) the slice id includes the
  * literal prefix plus the star bindings (`lib/features/projects/rfi`), so
  * parallel trees get different ids. With `"stars"` it is the last literal
- * plus those star bindings. A star never binds the filename; a file directly
+ * plus every star binding, including one before the last literal. A star never binds the filename; a file directly
  * under the last bound directory keeps that directory as its slice.
  */
 export function sliceIdForPath(relPath, sliceFolders, sliceIdentity) {
+    return sliceIdWithBinding(relPath, sliceFolders, sliceIdentity === 'stars' ? 'stars' : 'path');
+}
+/**
+ * The 4.8.23 `stars` id: bound segments from the last literal on, so a star
+ * before the last literal was dropped (`modules` / `*` / `api` / `*` bound `api/v1`).
+ * Kept for one release so config written against that id keeps its verdict.
+ */
+export function legacyStarsSliceIdForPath(relPath, sliceFolders) {
+    return sliceIdWithBinding(relPath, sliceFolders ? [...sliceFolders] : undefined, LEGACY_STARS);
+}
+/** Internal binding mode for {@link legacyStarsSliceIdForPath}; never a config value. */
+const LEGACY_STARS = 'stars-4.8.23';
+function sliceIdWithBinding(relPath, sliceFolders, identity) {
     if (!sliceFolders?.length)
         return undefined;
-    const identity = sliceIdentity === 'stars' ? 'stars' : 'path';
     const parts = String(relPath)
         .split(/[/\\]/)
         .filter(Boolean);
@@ -239,18 +271,41 @@ export function sliceIdForPath(relPath, sliceFolders, sliceIdentity) {
     for (const raw of sliceFolders) {
         if (typeof raw !== 'string' || raw.length === 0)
             continue;
-        if (isAnchoredSliceEntry(raw)) {
-            const anchored = anchoredSliceId(parts, raw, identity);
+        const entry = parsedSliceFolder(raw);
+        if (entry.anchored) {
+            const anchored = anchoredSliceIdFromPattern(parts, entry.anchored, identity);
             if (anchored)
                 return anchored;
             continue;
         }
-        if (!raw.includes('/') && !raw.includes('\\') && !raw.includes('*')) {
-            bare.add(raw.toLowerCase());
-        }
+        if (entry.bare !== undefined)
+            bare.add(entry.bare);
     }
     return bareSliceId(parts, bare);
 }
+const parsedSliceFolders = new Map();
+/**
+ * `sliceIdForPath` runs for every edge endpoint under every peerIsolation rule.
+ * Re-splitting the same declared entries per call dominated the allocation of
+ * a large-repo analysis; the parse depends only on the entry text.
+ */
+function parsedSliceFolder(raw) {
+    const cached = parsedSliceFolders.get(raw);
+    if (cached)
+        return cached;
+    let parsed = {};
+    if (isAnchoredSliceEntry(raw)) {
+        parsed = { anchored: anchoredSlicePattern(raw) };
+    }
+    else if (!raw.includes('/') && !raw.includes('\\') && !raw.includes('*')) {
+        parsed = { bare: raw.toLowerCase() };
+    }
+    // Bounded: entries come from contracts, but a long-lived process may see many.
+    if (parsedSliceFolders.size >= 1024)
+        parsedSliceFolders.clear();
+    parsedSliceFolders.set(raw, parsed);
+    return parsed;
+}
 /** A starred prefix with a real leading directory, not a bare name and not `*`. */
 function isAnchoredSliceEntry(entry) {
     const segments = entry.split(/[/\\]/).filter((part) => part.length > 0);
@@ -260,11 +315,13 @@ function isAnchoredSliceEntry(entry) {
         return false;
     return segments.some((part) => part === '*');
 }
-function anchoredSliceId(parts, raw, identity) {
-    const pattern = raw
+function anchoredSlicePattern(raw) {
+    return raw
         .split(/[/\\]/)
         .filter((part) => part.length > 0)
         .map((part) => part.toLowerCase());
+}
+function anchoredSliceIdFromPattern(parts, pattern, identity) {
     const offsets = anchorOffsets(parts, pattern[0] ?? '');
     for (const offset of offsets) {
         const id = bindAnchoredSlice(parts, pattern, offset, identity);
@@ -283,11 +340,14 @@ function anchoredSliceId(parts, raw, identity) {
  *
  * `path` returns every bound segment (literal prefix plus star bindings), so
  * a parallel tree (`components` / `features` / `*` / `*`) gets a different
- * id. `stars` drops the literal prefix before the last literal and keeps
- * that literal plus the star bindings.
+ * id. `stars` drops only the literals before the last literal. It keeps that
+ * literal and every star binding, including a star before it: `modules` /
+ * `*` / `api` / `*` binds `orders/api/v1`, never a bare `api/v1` that two
+ * modules would share.
  */
 function bindAnchoredSlice(parts, pattern, offset, identity = 'path') {
     const bound = [];
+    const fromStar = [];
     let lastLiteralAt = -1;
     let index = offset;
     for (let pi = 0; pi < pattern.length; pi += 1) {
@@ -301,6 +361,7 @@ function bindAnchoredSlice(parts, pattern, offset, identity = 'path') {
                 break;
             }
             bound.push(parts[index].toLowerCase());
+            fromStar.push(true);
             index += 1;
             continue;
         }
@@ -309,18 +370,44 @@ function bindAnchoredSlice(parts, pattern, offset, identity = 'path') {
         if (parts[index].toLowerCase() !== segment)
             return undefined;
         bound.push(parts[index].toLowerCase());
+        fromStar.push(false);
         lastLiteralAt = bound.length - 1;
         index += 1;
     }
     if (bound.length === 0)
         return undefined;
-    if (identity === 'stars') {
+    if (identity === LEGACY_STARS) {
         if (lastLiteralAt < 0)
             return undefined;
         return bound.slice(lastLiteralAt).join('/');
     }
+    if (identity === 'stars') {
+        if (lastLiteralAt < 0)
+            return undefined;
+        return bound.filter((_, at) => at >= lastLiteralAt || fromStar[at]).join('/');
+    }
     return bound.join('/');
 }
+/**
+ * Indexes of the pattern segments a `stars` id keeps: every `*`, the last
+ * literal, and everything after it. Literals before the last literal drop.
+ * Returns null when the pattern has no literal.
+ */
+export function starsKeptSegmentIndexes(segments) {
+    let lastLiteral = -1;
+    for (let at = 0; at < segments.length; at += 1) {
+        if (segments[at] !== '*')
+            lastLiteral = at;
+    }
+    if (lastLiteral < 0)
+        return null;
+    const kept = [];
+    for (let at = 0; at < segments.length; at += 1) {
+        if (at >= lastLiteral || segments[at] === '*')
+            kept.push(at);
+    }
+    return kept;
+}
 /**
  * Doctor warning input. Silent unless `sliceIdentity` is `"stars"` and two
  * different anchored prefixes share a stem (last literal plus the stars after it).
@@ -362,7 +449,10 @@ export function sliceIdentityCollisions(rules) {
     }
     return out;
 }
-/** Last literal plus the stars that follow it. `**` never forms a stem. */
+/**
+ * The segments a `stars` id keeps: every star, the last literal, and the stars
+ * after it. Literals before the last literal drop. `**` never forms a stem.
+ */
 function starsIdentityStem(raw) {
     if (!isAnchoredSliceEntry(raw))
         return undefined;
@@ -370,20 +460,12 @@ function starsIdentityStem(raw) {
         .split(/[/\\]/)
         .filter((part) => part.length > 0)
         .map((part) => part.toLowerCase());
-    let lastLiteral = -1;
-    for (let i = 0; i < segments.length; i += 1) {
-        const part = segments[i] ?? '';
-        if (part === '**')
-            return undefined;
-        if (part !== '*')
-            lastLiteral = i;
-    }
-    if (lastLiteral < 0)
+    if (segments.some((part) => part === '**'))
         return undefined;
-    const tail = segments.slice(lastLiteral);
-    if (tail.some((part, index) => index > 0 && part !== '*'))
+    const kept = starsKeptSegmentIndexes(segments);
+    if (!kept)
         return undefined;
-    return tail.join('/');
+    return kept.map((at) => segments[at]).join('/');
 }
 function formatSliceIdentityCollision(from, to, paths, stem) {
     const named = paths.length === 2
@@ -598,6 +680,332 @@ export function peerIsolationDecision(input) {
 export function peerIsolationMustDeny(input) {
     return peerIsolationDecision(input).denied;
 }
+export const SLICE_ALIAS_DEBT = 'Aliases are an owed move, not a destination. These files are not finished.';
+function aliasGlobPattern(glob) {
+    return trimTrailingSlashes(glob.trim().replace(/\\/g, '/')).toLowerCase();
+}
+/** Existing path glob matcher. Also accepts a leading src/ or app/, and a plain folder covers its subtree. */
+function aliasGlobMatches(glob, relPath) {
+    const pattern = aliasGlobPattern(glob);
+    if (!pattern || pattern === '*' || pattern === '**')
+        return false;
+    const file = String(relPath).replace(/\\/g, '/').replace(/^\/+/, '').toLowerCase();
+    const rooted = stripSrcOrApp(file);
+    const re = globToRegExp(pattern);
+    // A folder form (no wildcard in the last segment) also covers its subtree,
+    // as sharedRoots does: `lib/compliance` matches `lib/compliance/x.ts`.
+    const last = pattern.split('/').pop() ?? '';
+    const under = last.includes('*') ? null : globToRegExp(`${pattern}/**`);
+    const hit = (candidate) => re.test(candidate) || (under !== null && under.test(candidate));
+    return hit(file) || (rooted !== file && hit(rooted));
+}
+/**
+ * Does `relPath` match a `sharedImportsSlice.stopAt` entry? An entry matches
+ * the way a shared root does (anchored, optional leading src/ or app/, a plain
+ * folder covers its subtree) or the way an alias glob does (`kernel/registrations/**`
+ * against `src/kernel/registrations/x.ts`). A blanket `*` / `**` never matches.
+ */
+export function pathMatchesSharedWalkStop(relPath, stopAt) {
+    if (!relPath || !stopAt?.length)
+        return false;
+    if (pathUnderSharedRoot(relPath, [...stopAt]))
+        return true;
+    return stopAt.some((glob) => typeof glob === 'string' && aliasGlobMatches(glob, relPath));
+}
+function splitAliasTarget(to) {
+    const parts = aliasGlobPattern(to).split('/').filter(Boolean);
+    if (parts.length < 2 || parts.some((part) => part.includes('*') || part === '.' || part === '..')) {
+        return null;
+    }
+    return { universeId: parts.slice(0, -1).join('/'), childId: parts.join('/') };
+}
+function firstSliceAliasEntry(relPath, rule) {
+    for (const alias of rule.childSlices?.sliceAliases ?? []) {
+        if (!alias || typeof alias.from !== 'string' || typeof alias.to !== 'string')
+            continue;
+        if (aliasGlobMatches(alias.from, relPath))
+            return alias;
+    }
+    return null;
+}
+function firstSliceAlias(relPath, rule) {
+    const alias = firstSliceAliasEntry(relPath, rule);
+    return alias ? splitAliasTarget(alias.to) : null;
+}
+/**
+ * Universe id and child id for one file. An alias runs only when both walls
+ * leave the path unclassified, so a real slice folder is never overridden.
+ */
+export function resolveGovernedSlice(relPath, rule, sliceFolders) {
+    if (!relPath)
+        return {};
+    const folders = sliceFolders ?? rule.sliceFolders;
+    const universeId = sliceIdForPath(relPath, folders ? [...folders] : undefined, rule.sliceIdentity);
+    const resolved = resolveChildSliceId(relPath, universeId, rule.childSlices);
+    if (universeId || resolved.childId || resolved.mismatched) {
+        return resolved.childId ? { universeId, childId: resolved.childId } : { universeId };
+    }
+    const alias = firstSliceAlias(relPath, rule);
+    return alias ? { universeId: alias.universeId, childId: alias.childId } : {};
+}
+/** Universe shapes of a stars rule, with the 4.8.23 id shape beside each new one. */
+function starsUniverseShapes(folders) {
+    const shapes = [];
+    for (const raw of folders ?? []) {
+        if (typeof raw !== 'string' || raw.length === 0)
+            continue;
+        const segments = raw.split(/[/\\]/).filter(Boolean).map((part) => part.toLowerCase());
+        if (segments.length === 1 && segments[0] && !segments[0].includes('*')) {
+            shapes.push({ literals: [segments[0], null], legacy: [segments[0], null] });
+            continue;
+        }
+        if (segments.some((part) => part === '**' || (part.includes('*') && part !== '*')))
+            continue;
+        const kept = starsKeptSegmentIndexes(segments);
+        if (!kept || !segments.includes('*'))
+            continue;
+        const star = (part) => (part === '*' ? null : part);
+        const lastLiteral = kept.find((at) => segments[at] !== '*') ?? 0;
+        shapes.push({
+            literals: kept.map((at) => star(segments[at] ?? '')),
+            legacy: segments.slice(lastLiteral).map(star),
+        });
+    }
+    return shapes;
+}
+function literalsMatch(shape, parts) {
+    return (shape.length === parts.length &&
+        shape.every((literal, at) => literal === null || parts[at] === '*' || literal === parts[at]));
+}
+/**
+ * New-id shapes (`*` for a star) that a 4.8.23 stars id maps to. Empty when the id is
+ * already a new id or no shape takes it. Config load rejects more than one.
+ */
+export function legacyStarsIdTargets(folders, id) {
+    const parts = id.split('/').filter(Boolean).map((part) => part.toLowerCase());
+    const shapes = starsUniverseShapes(folders);
+    if (parts.length === 0 || shapes.some((shape) => literalsMatch(shape.literals, parts)))
+        return [];
+    const targets = new Set();
+    for (const shape of shapes) {
+        if (shape.legacy.length === shape.literals.length)
+            continue;
+        if (literalsMatch(shape.legacy, parts)) {
+            const tail = [...parts];
+            // Fill the kept literals and trailing stars from the legacy id; pre-literal stars stay `*`.
+            const lead = shape.literals.length - shape.legacy.length;
+            targets.add([...shape.literals.slice(0, lead).map(() => '*'), ...tail].join('/'));
+        }
+    }
+    return [...targets].sort();
+}
+/** The legacy universe id when this alias target is a 4.8.23 stars child id. */
+function legacyAliasUniverse(rule, to) {
+    if (rule.sliceIdentity !== 'stars')
+        return undefined;
+    const target = splitAliasTarget(to);
+    if (!target)
+        return undefined;
+    return legacyStarsIdTargets(rule.sliceFolders, target.universeId).length === 1
+        ? target.universeId
+        : undefined;
+}
+function placeForPair(relPath, rule, folders) {
+    const place = resolveGovernedSlice(relPath, rule, folders);
+    if (!relPath || rule.sliceIdentity !== 'stars')
+        return place;
+    if (place.universeId) {
+        const alias = firstSliceAliasEntry(relPath, rule);
+        const fromFolders = sliceIdForPath(relPath, [...folders], rule.sliceIdentity);
+        if (!fromFolders && alias && legacyAliasUniverse(rule, alias.to) !== undefined) {
+            return { ...place, legacyAlias: true, legacyUniverse: place.universeId, legacyChild: place.childId };
+        }
+        const legacyUniverse = legacyStarsSliceIdForPath(relPath, folders);
+        const child = rule.childSlices;
+        const legacyChild = child?.sliceIdentity === 'stars' ? legacyStarsSliceIdForPath(relPath, child.sliceFolders) : undefined;
+        return {
+            ...place,
+            ...(legacyUniverse ? { legacyUniverse } : {}),
+            ...(legacyChild && place.childId ? { legacyChild } : {}),
+        };
+    }
+    return place;
+}
+/**
+ * Both endpoints of one edge under a peerIsolation rule, with the one-release 4.8.23
+ * `stars` compatibility: a `sliceAliases` target written as a 4.8.23 stars id joins
+ * the universe of the other endpoint whose 4.8.23 id it names, and an
+ * `allowedCrossSlice` entry written against 4.8.23 ids still clears the edge it cleared
+ * then. ark-check warns CONFIG_SLICE_LEGACY_STARS_ID for both.
+ */
+export function resolveGovernedSlicePair(rule, folders, fromPath, toPath) {
+    const from = placeForPair(fromPath, rule, folders);
+    const to = placeForPair(toPath, rule, folders);
+    const legacyFrom = from.legacyUniverse;
+    const legacyTo = to.legacyUniverse;
+    const adopt = (alias, other) => {
+        if (!alias.legacyAlias || other.legacyAlias || !other.universeId)
+            return alias;
+        if (other.legacyUniverse?.toLowerCase() !== alias.universeId?.toLowerCase())
+            return alias;
+        const childSegment = alias.childId?.split('/').pop();
+        return {
+            ...alias,
+            universeId: other.universeId,
+            ...(childSegment ? { childId: `${other.universeId}/${childSegment}` } : {}),
+        };
+    };
+    const fromPlace = adopt(from, to);
+    const toPlace = adopt(to, from);
+    const crossSliceAllowed = crossSliceEdgeAllowed(rule.allowedCrossSlice, fromPlace.universeId, toPlace.universeId) ||
+        (rule.sliceIdentity === 'stars' &&
+            (legacyFrom !== fromPlace.universeId || legacyTo !== toPlace.universeId) &&
+            crossSliceEdgeAllowed(rule.allowedCrossSlice, legacyFrom, legacyTo));
+    const legacyChildAllowed = rule.childSlices?.sliceIdentity === 'stars' &&
+        from.legacyChild !== undefined &&
+        to.legacyChild !== undefined &&
+        from.legacyChild !== to.legacyChild &&
+        childCrossSliceAllowed(rule.childSlices.allowedCrossSlice, from.legacyChild, to.legacyChild);
+    const strip = (place) => ({
+        ...(place.universeId ? { universeId: place.universeId } : {}),
+        ...(place.childId ? { childId: place.childId } : {}),
+    });
+    return { from: strip(fromPlace), to: strip(toPlace), crossSliceAllowed, legacyChildAllowed };
+}
+function childPatternDirectory(pattern, childId, identity) {
+    const segments = pattern.split(/[/\\]/).filter(Boolean).map((part) => part.toLowerCase());
+    const idParts = childId.split('/').filter(Boolean).map((part) => part.toLowerCase());
+    if (segments.length === 0 || idParts.length === 0)
+        return null;
+    if (segments.some((part) => part === '**' || (part.includes('*') && part !== '*')))
+        return null;
+    if (identity === 'stars') {
+        const kept = starsKeptSegmentIndexes(segments);
+        if (!kept || kept.length !== idParts.length)
+            return null;
+        const dir = [...segments];
+        for (let index = 0; index < kept.length; index += 1) {
+            const at = kept[index] ?? 0;
+            if (segments[at] !== '*' && segments[at] !== idParts[index])
+                return null;
+            dir[at] = idParts[index] ?? '';
+        }
+        return dir.join('/');
+    }
+    if (segments.length !== idParts.length)
+        return null;
+    for (let index = 0; index < segments.length; index += 1) {
+        if (segments[index] === '*')
+            continue;
+        if (segments[index] !== idParts[index])
+            return null;
+    }
+    return idParts.join('/');
+}
+function sharedDirectoryPrefix(file, dir) {
+    const left = stripSrcOrApp(file.replace(/\\/g, '/').replace(/^\/+/, '').toLowerCase()).split('/');
+    const right = dir.split('/');
+    let count = 0;
+    while (count < left.length && count < right.length && left[count] === right[count])
+        count += 1;
+    return count;
+}
+function withSourcePrefix(file, dir) {
+    const norm = file.replace(/\\/g, '/').replace(/^\/+/, '').toLowerCase();
+    if (norm.startsWith('src/') && !dir.startsWith('src/'))
+        return `src/${dir}`;
+    if (norm.startsWith('app/') && !dir.startsWith('app/'))
+        return `app/${dir}`;
+    return dir;
+}
+/** Folder the aliased file should move into. Parallel trees pick the closest prefix. */
+export function sliceAliasDestination(file, childId, child) {
+    let best = null;
+    for (const pattern of child.sliceFolders) {
+        if (typeof pattern !== 'string')
+            continue;
+        const dir = childPatternDirectory(pattern, childId, child.sliceIdentity);
+        if (!dir)
+            continue;
+        const score = sharedDirectoryPrefix(file, dir);
+        if (!best || score > best.score || (score === best.score && dir.length < best.dir.length)) {
+            best = { dir, score };
+        }
+    }
+    return best ? withSourcePrefix(file, best.dir) : '';
+}
+export function anySliceAlias(rules) {
+    return (rules ?? []).some((rule) => (rule?.childSlices?.sliceAliases?.length ?? 0) > 0);
+}
+/** Doctor list. Absent when no rule sets sliceAliases, so the key stays off. */
+export function sliceAliasReport(rules, files) {
+    if (!anySliceAlias(rules))
+        return null;
+    const moves = new Map();
+    for (const rule of rules ?? []) {
+        const child = rule?.childSlices;
+        if (!child?.sliceAliases)
+            continue;
+        for (const alias of child.sliceAliases) {
+            if (!alias || typeof alias.from !== 'string' || typeof alias.to !== 'string')
+                continue;
+            const key = `${aliasGlobPattern(alias.from)}\0${aliasGlobPattern(alias.to)}`;
+            let move = moves.get(key);
+            if (!move) {
+                move = { from: alias.from, to: alias.to, destination: '', files: [] };
+                moves.set(key, move);
+            }
+            const seen = new Set(move.files);
+            for (const file of files) {
+                if (typeof file !== 'string' || !aliasGlobMatches(alias.from, file) || seen.has(file))
+                    continue;
+                seen.add(file);
+                move.files.push(file);
+                if (!move.destination)
+                    move.destination = sliceAliasDestination(file, alias.to, child);
+            }
+        }
+    }
+    const universes = knownUniverseIds(rules, files);
+    const listed = [...moves.values()].map((move) => {
+        const target = splitAliasTarget(move.to);
+        const unknown = universes !== null && target !== null && !universes.has(target.universeId);
+        return {
+            ...move,
+            files: [...move.files].sort(),
+            ...(unknown
+                ? {
+                    unknownUniverse: true,
+                    advisory: `alias target ${move.to} names universe ${target.universeId}, which no file belongs to. Check for a typo.`,
+                }
+                : {}),
+        };
+    });
+    listed.sort((left, right) => left.from.localeCompare(right.from) || left.to.localeCompare(right.to));
+    return { notAScore: true, finished: false, debt: SLICE_ALIAS_DEBT, moves: listed };
+}
+/**
+ * Universe ids that real (non-aliased) files resolve to, across rules that set
+ * sliceAliases. Null when a rule has no explicit sliceFolders (the universe
+ * would come from layer patterns this report does not see): no claim then.
+ */
+function knownUniverseIds(rules, files) {
+    const ids = new Set();
+    for (const rule of rules ?? []) {
+        if (!rule?.childSlices?.sliceAliases?.length)
+            continue;
+        if (!rule.sliceFolders?.length)
+            return null;
+        for (const file of files) {
+            if (typeof file !== 'string')
+                continue;
+            const id = sliceIdForPath(file, rule.sliceFolders, rule.sliceIdentity);
+            if (id)
+                ids.add(id.toLowerCase());
+        }
+    }
+    return ids;
+}
 /**
  * One human sentence naming which peerIsolation reason fired — so the denial
  * reports a fact about their code (`cross-slice`) or a fact about our evidence
@@ -624,6 +1032,663 @@ export function peerIsolationDenyExplanation(reason, context) {
             return 'no path evidence for this edge — peerIsolation needs the importer and importee paths.';
     }
 }
+function crossParentExplanation(fromSlice, toSlice) {
+    return `cross-parent slice ${fromSlice ?? '?'} → ${toSlice ?? '?'}. The child wall cannot allow another universe.`;
+}
+function crossSiblingExplanation(fromChild, toChild, universe) {
+    return `cross-sibling slice ${fromChild} → ${toChild} inside ${universe}.`;
+}
+function parentImportsChildExplanation(toChild) {
+    return `universe common imports child ${toChild}. parentMayImportChild is off.`;
+}
+/** Last path segment of a universe slice id (`features/projects` → `projects`). */
+export function universePairLabel(sliceId) {
+    if (!sliceId)
+        return undefined;
+    const parts = sliceId.split('/').filter(Boolean);
+    return parts.length > 0 ? parts[parts.length - 1] : undefined;
+}
+function isCommonFolderName(segment, commonFolders) {
+    if (!segment || !commonFolders?.length)
+        return false;
+    const want = segment.toLowerCase();
+    return commonFolders.some((raw) => typeof raw === 'string' && raw.length > 0 && raw.toLowerCase() === want);
+}
+/**
+ * Child id for one path. A flat file (the starred id does not grow past the
+ * universe id) is universe common. So is a `commonFolders` directory, but only
+ * at the child position: the segment directly under the universe id
+ * (`features/projects/domain/**`). A folder of the same name inside a child
+ * (`features/projects/rfi/domain/**`) belongs to that child. A child id that
+ * does not extend the universe id is not used; the caller warns.
+ */
+export function resolveChildSliceId(relPath, universeId, child) {
+    if (!relPath || !child?.sliceFolders?.length)
+        return {};
+    const raw = sliceIdForPath(relPath, child.sliceFolders, child.sliceIdentity);
+    if (!raw || !universeId)
+        return {};
+    const childKey = raw.toLowerCase();
+    const universeKey = universeId.toLowerCase();
+    if (childKey === universeKey)
+        return {};
+    if (!childKey.startsWith(`${universeKey}/`))
+        return { mismatched: { childId: raw, universeId } };
+    const firstChildSegment = childKey.slice(universeKey.length + 1).split('/')[0];
+    if (isCommonFolderName(firstChildSegment, child.commonFolders))
+        return {};
+    return { childId: raw };
+}
+function siblingEntryKey(entry) {
+    return trimTrailingSlashes(entry.trim().replace(/\\/g, '/')).toLowerCase();
+}
+function stripSrcOrApp(value) {
+    return value.replace(/^(?:src|app)\//, '');
+}
+/** True when the importer file sits in this directory, with or without src/ or app/. */
+function pathUnderSubtree(filePath, entry) {
+    const file = filePath.replace(/\\/g, '/').replace(/^\/+/, '').toLowerCase();
+    const prefix = stripSrcOrApp(entry);
+    if (!prefix)
+        return false;
+    const rooted = stripSrcOrApp(file);
+    return (file === prefix ||
+        file.startsWith(`${prefix}/`) ||
+        rooted === prefix ||
+        rooted.startsWith(`${prefix}/`));
+}
+/**
+ * Child slice id matches exactly. A path matches the importer file's directory.
+ * Bare names do not match. `*` is not a wildcard.
+ */
+export function importerInEnforcedSubtree(fromPath, fromChild, entries) {
+    if (!fromChild || !entries?.length)
+        return false;
+    const child = fromChild.toLowerCase();
+    for (const raw of entries) {
+        if (typeof raw !== 'string')
+            continue;
+        const entry = siblingEntryKey(raw);
+        if (!entry || entry.includes('*'))
+            continue;
+        if (child === entry)
+            return true;
+        if (fromPath && pathUnderSubtree(fromPath, entry))
+            return true;
+    }
+    return false;
+}
+/**
+ * String `advisory` warns every sibling crossing. String `deny` and an absent
+ * value deny every one. An object denies the importer only when it is listed,
+ * unless `default` is already `deny`.
+ */
+export function siblingCrossingAdvisory(siblings, fromPath, fromChild) {
+    if (siblings == null || siblings === 'deny')
+        return false;
+    if (siblings === 'advisory')
+        return true;
+    if (siblings.default === 'deny')
+        return false;
+    return !importerInEnforcedSubtree(fromPath, fromChild, siblings.enforce);
+}
+/**
+ * Segments of a child-slice pattern. `*` is one whole segment.
+ * A bare name, `**`, or a partial segment does not match.
+ */
+function childSlicePatternSegments(raw) {
+    if (typeof raw !== 'string')
+        return null;
+    const trimmed = trimTrailingSlashes(raw.trim().replace(/\\/g, '/')).toLowerCase();
+    if (!trimmed.includes('/'))
+        return null;
+    const parts = trimmed.split('/');
+    for (const part of parts) {
+        if (part.length === 0 || part === '.' || part === '..')
+            return null;
+        if (part.includes('*') && part !== '*')
+            return null;
+    }
+    return parts;
+}
+/** Whole-segment match. The universe list does not call this. */
+export function childSlicePatternMatches(pattern, sliceId) {
+    const want = childSlicePatternSegments(pattern);
+    const have = childSlicePatternSegments(sliceId);
+    if (!want || !have || want.length !== have.length)
+        return false;
+    for (let index = 0; index < want.length; index += 1) {
+        const segment = want[index];
+        if (segment === '*')
+            continue;
+        if (segment !== have[index])
+            return false;
+    }
+    return true;
+}
+function childCrossSliceAllowed(edges, fromChild, toChild) {
+    if (!edges?.length)
+        return false;
+    for (const edge of edges) {
+        if (!edge || typeof edge.from !== 'string' || typeof edge.to !== 'string')
+            continue;
+        if (childSlicePatternMatches(edge.from, fromChild) && childSlicePatternMatches(edge.to, toChild)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * True when the two patterns can name child ids in different universes.
+ * The universe is every segment but the last. A `*` there, or two different
+ * literals, means the entry cannot be a same-universe sibling allowance.
+ */
+function childAllowanceSpansUniverses(from, to) {
+    const fromParts = childSlicePatternSegments(from);
+    const toParts = childSlicePatternSegments(to);
+    if (!fromParts || !toParts)
+        return false;
+    const fromPrefix = fromParts.slice(0, -1);
+    const toPrefix = toParts.slice(0, -1);
+    if (fromPrefix.length !== toPrefix.length)
+        return true;
+    for (let index = 0; index < fromPrefix.length; index += 1) {
+        const left = fromPrefix[index];
+        const right = toPrefix[index];
+        if (left === '*' || right === '*')
+            return true;
+        if (left !== right)
+            return true;
+    }
+    return false;
+}
+/**
+ * Universe wall, then the child wall. An allow from the child wall never
+ * overturns a universe deny: that deny returns before the child wall runs.
+ */
+export function evaluateNestedSliceWall(input) {
+    const universe = peerIsolationDecision({
+        fromPath: input.fromPath,
+        toPath: input.toPath,
+        folderCount: input.folderCount,
+        fromSlice: input.fromSlice,
+        toSlice: input.toSlice,
+        fromShared: input.fromShared,
+        toShared: input.toShared,
+        crossSliceAllowed: input.crossSliceAllowed,
+        sharedImportsSlice: sharedImportsSliceMode(input.rule.sharedImportsSlice),
+    });
+    if (universe.denied) {
+        const crossParent = Boolean(input.rule.childSlices) && universe.reason === 'cross-slice';
+        return {
+            crossing: universe.reason === 'cross-slice' ? 'cross-parent' : 'fail-closed',
+            decision: 'deny',
+            ...(crossParent ? { reasonId: 'CROSS_PARENT_SLICE' } : {}),
+            explanation: crossParent
+                ? crossParentExplanation(input.fromSlice, input.toSlice)
+                : peerIsolationDenyExplanation(universe.reason ?? 'missing-path', {
+                    fromPath: input.fromPath,
+                    toPath: input.toPath,
+                    fromSlice: input.fromSlice,
+                    toSlice: input.toSlice,
+                }),
+            peerIsolationReason: universe.reason,
+            fromUniverse: input.fromSlice,
+            toUniverse: input.toSlice,
+        };
+    }
+    const child = input.rule.childSlices;
+    if (!child || !input.fromSlice || !input.toSlice || input.fromSlice !== input.toSlice || !input.toPath) {
+        return {
+            crossing: 'none',
+            decision: 'allow',
+            fromUniverse: input.fromSlice,
+            toUniverse: input.toSlice,
+        };
+    }
+    const fromChild = input.fromChild ?? resolveChildSliceId(input.fromPath, input.fromSlice, child).childId;
+    const toChild = input.toChild ?? resolveChildSliceId(input.toPath, input.toSlice, child).childId;
+    const allowSameUniverse = {
+        crossing: 'none',
+        decision: 'allow',
+        fromUniverse: input.fromSlice,
+        toUniverse: input.toSlice,
+    };
+    if (fromChild && toChild && fromChild !== toChild) {
+        if (input.legacyChildAllowed || childCrossSliceAllowed(child.allowedCrossSlice, fromChild, toChild)) {
+            return allowSameUniverse;
+        }
+        const advisory = siblingCrossingAdvisory(child.siblings, input.fromPath, fromChild);
+        return {
+            crossing: 'cross-sibling',
+            decision: advisory ? 'advisory' : 'deny',
+            reasonId: 'CROSS_SIBLING_SLICE',
+            explanation: crossSiblingExplanation(fromChild, toChild, input.fromSlice),
+            fromUniverse: input.fromSlice,
+            toUniverse: input.toSlice,
+        };
+    }
+    if (!fromChild && toChild && child.parentMayImportChild !== true) {
+        return {
+            crossing: 'parent-imports-child',
+            decision: 'deny',
+            explanation: parentImportsChildExplanation(toChild),
+            fromUniverse: input.fromSlice,
+            toUniverse: input.toSlice,
+        };
+    }
+    return allowSameUniverse;
+}
+/** Did the child (inner) wall produce this finding, not the universe wall? */
+export function isChildWallCrossing(verdict) {
+    return verdict?.crossing === 'cross-sibling' || verdict?.crossing === 'parent-imports-child';
+}
+/**
+ * The consumer text for one slice finding. `rule.message` is the universe-wall
+ * text. `childSlices.message` is the inner-wall text. An inner-wall finding
+ * never falls back to the rule message; undefined means "use ArkGate's default".
+ */
+export function sliceConsumerMessage(rule, verdict) {
+    return isChildWallCrossing(verdict) ? rule?.childSlices?.message : rule?.message;
+}
+/**
+ * Finding message. Import sites always append the explanation. Intent sites
+ * keep today's wording when there is no reasonId: a plain cross-slice deny
+ * does not gain a clause, and any other universe-wall reason does.
+ * `ruleMessage` is only used for universe-wall findings; an inner-wall finding
+ * uses `childMessage` or ArkGate's default text.
+ */
+export function composeSliceDenialMessage(input) {
+    const explanation = input.verdict.explanation;
+    const inner = isChildWallCrossing(input.verdict);
+    const consumer = inner ? input.childMessage : input.ruleMessage;
+    if (input.surface === 'intent') {
+        const defaultMessage = input.defaultMessage ?? `${input.fromLayer} must not reference ${input.toLayer} intent.`;
+        if (inner && explanation)
+            return `${input.childMessage ?? defaultMessage} ${explanation}`;
+        if (input.verdict.reasonId && explanation)
+            return `${defaultMessage} ${explanation}`;
+        if (explanation && input.verdict.peerIsolationReason !== 'cross-slice') {
+            return `${defaultMessage} ${explanation}`;
+        }
+        if (consumer) {
+            return explanation ? `${consumer} (${explanation})` : consumer;
+        }
+        return defaultMessage;
+    }
+    if (consumer) {
+        return explanation ? `${consumer} (${explanation})` : consumer;
+    }
+    if (explanation) {
+        const kind = input.kind ?? 'import';
+        return `${input.fromLayer} must not ${kind} another slice of ${input.toLayer} (${input.fromPath} → ${input.toPath}): ${explanation}`;
+    }
+    return `${input.fromLayer} must not ${input.kind ?? 'import'} ${input.toLayer}.`;
+}
+/** Fields a reporting site copies onto a finding. Absent when the verdict allows. */
+export function sliceFindingExtras(verdict) {
+    if (!verdict || verdict.decision === 'allow')
+        return {};
+    const from = universePairLabel(verdict.fromUniverse);
+    const to = universePairLabel(verdict.toUniverse);
+    return {
+        ...(verdict.reasonId ? { reasonId: verdict.reasonId } : {}),
+        ...(verdict.reasonId && from && to ? { universeFrom: from, universeTo: to } : {}),
+        ...(verdict.decision === 'advisory'
+            ? { failsStrict: false, severity: 'warning' }
+            : {}),
+    };
+}
+/** True when this siblings value still leaves some crossings advisory. An enforce list does not finish the house. */
+export function childWallSiblingsAdvisory(siblings) {
+    if (siblings === 'advisory')
+        return true;
+    if (siblings !== null && typeof siblings === 'object') {
+        return siblings.default !== 'deny';
+    }
+    return false;
+}
+export function anyChildWallAdvisory(rules) {
+    return (rules ?? []).some((rule) => rule?.childSlices != null && childWallSiblingsAdvisory(rule.childSlices.siblings));
+}
+/** Doctor counts. Null when this scan has no nested-wall reason, so the key stays absent. */
+export function sliceCountReport(violations) {
+    let crossParent = 0;
+    let crossSibling = 0;
+    const pairs = new Map();
+    for (const row of violations ?? []) {
+        if (row.reasonId === 'CROSS_PARENT_SLICE') {
+            crossParent += 1;
+            if (typeof row.universeFrom === 'string' && typeof row.universeTo === 'string') {
+                const key = `${row.universeFrom}\0${row.universeTo}`;
+                const prev = pairs.get(key);
+                if (prev)
+                    prev.count += 1;
+                else
+                    pairs.set(key, { from: row.universeFrom, to: row.universeTo, count: 1 });
+            }
+        }
+        else if (row.reasonId === 'CROSS_SIBLING_SLICE') {
+            crossSibling += 1;
+        }
+    }
+    if (crossParent === 0 && crossSibling === 0)
+        return null;
+    return {
+        crossParent,
+        crossSibling,
+        pairs: [...pairs.values()].sort((left, right) => left.from.localeCompare(right.from) || left.to.localeCompare(right.to)),
+    };
+}
+/**
+ * Doctor advisory: a shared file that sits on many CROSS_PARENT_VIA_SHARED
+ * paths is often a composition root. Null below `minFindings` findings or when
+ * no file reaches `minShare` of them. Not a finding and not in the baseline.
+ */
+export function crossParentViaSharedHubs(violations, options) {
+    const minFindings = options?.minFindings ?? 10;
+    const minShare = options?.minShare ?? 0.5;
+    let total = 0;
+    const counts = new Map();
+    for (const row of violations ?? []) {
+        if (row?.reasonId !== 'CROSS_PARENT_VIA_SHARED')
+            continue;
+        total += 1;
+        if (!Array.isArray(row.via))
+            continue;
+        const once = new Set(row.via.filter((file) => typeof file === 'string'));
+        for (const file of once)
+            counts.set(file, (counts.get(file) ?? 0) + 1);
+    }
+    if (total < minFindings)
+        return null;
+    const hubs = [...counts.entries()]
+        .map(([file, count]) => ({ file, count, share: Math.round((count / total) * 100) / 100 }))
+        .filter((hub) => hub.count / total >= minShare)
+        .sort((left, right) => right.count - left.count || left.file.localeCompare(right.file));
+    if (hubs.length === 0)
+        return null;
+    const first = hubs[0]?.file ?? '';
+    return {
+        notAScore: true,
+        total,
+        hubs,
+        nextAction: `If ${first} is a composition root, add it to sharedImportsSlice.stopAt. Otherwise these findings are real.`,
+    };
+}
+/**
+ * One warning per directed rule when a path's child id does not extend its
+ * universe id, and one per child allowance that spans universes. The version
+ * floor lives in configVersionFloor.ts and needs pin evidence (#338).
+ */
+export function childSliceConfigFindings(rules, files) {
+    const out = [];
+    const seenMismatch = new Set();
+    const seenSpan = new Set();
+    for (const rule of rules ?? []) {
+        if (rule?.peerIsolation && rule.allowed === false)
+            out.push(...legacyStarsIdFindings(rule, files));
+        if (!rule?.childSlices)
+            continue;
+        if (!rule.peerIsolation || rule.allowed !== false) {
+            out.push({
+                ruleId: 'CONFIG_CHILD_SLICES_INERT',
+                failsStrict: false,
+                fromLayer: rule.from,
+                toLayer: rule.to,
+                message: `${rule.from} → ${rule.to}: childSlices is inert on this rule and enforces nothing. The child wall runs only inside a universe wall. Add "peerIsolation": true and "allowed": false to the same rule, or remove childSlices.`,
+            });
+            continue;
+        }
+        for (const file of files) {
+            const universeId = sliceIdForPath(file, rule.sliceFolders, rule.sliceIdentity);
+            const resolved = resolveChildSliceId(file, universeId, rule.childSlices);
+            if (!resolved.mismatched)
+                continue;
+            const key = `${rule.from}\0${rule.to}\0${resolved.mismatched.universeId}\0${resolved.mismatched.childId}`;
+            if (seenMismatch.has(key))
+                continue;
+            seenMismatch.add(key);
+            out.push({
+                ruleId: 'CONFIG_CHILD_SLICE_EXTENDS',
+                failsStrict: false,
+                fromLayer: rule.from,
+                toLayer: rule.to,
+                path: file,
+                message: `${rule.from} → ${rule.to}: child id ${resolved.mismatched.childId} does not extend universe id ${resolved.mismatched.universeId} (${file}).`,
+            });
+        }
+        for (const edge of rule.childSlices.allowedCrossSlice ?? []) {
+            if (!edge || typeof edge.from !== 'string' || typeof edge.to !== 'string')
+                continue;
+            if (!childAllowanceSpansUniverses(edge.from, edge.to))
+                continue;
+            const key = `${edge.from.trim().toLowerCase()}\0${edge.to.trim().toLowerCase()}`;
+            if (seenSpan.has(key))
+                continue;
+            seenSpan.add(key);
+            out.push({
+                ruleId: 'CONFIG_CHILD_SLICE_CROSS_UNIVERSE',
+                failsStrict: false,
+                fromLayer: rule.from,
+                toLayer: rule.to,
+                message: `childSlices.allowedCrossSlice ${edge.from} → ${edge.to} cannot cross the universe wall. The universe wall still denies that edge.`,
+            });
+        }
+    }
+    return out;
+}
+/** Observed new ids per 4.8.23 stars id, from real files (for the warning text). */
+function observedIdsByLegacy(folders, files) {
+    const byLegacy = new Map();
+    if (!folders?.length)
+        return byLegacy;
+    for (const file of files) {
+        if (typeof file !== 'string')
+            continue;
+        const id = sliceIdForPath(file, [...folders], 'stars');
+        const legacy = legacyStarsSliceIdForPath(file, folders);
+        if (!id || !legacy || id === legacy)
+            continue;
+        const set = byLegacy.get(legacy) ?? new Set();
+        set.add(id);
+        byLegacy.set(legacy, set);
+    }
+    return byLegacy;
+}
+function newIdHint(legacyId, shapes, observed, childSegment) {
+    const suffix = childSegment ? `/${childSegment}` : '';
+    const shape = `${shapes[0] ?? legacyId}${suffix}`;
+    const seen = [...(observed.get(legacyId.toLowerCase()) ?? [])].sort().map((id) => `${id}${suffix}`);
+    if (seen.length === 1)
+        return `${seen[0]}`;
+    if (seen.length > 1)
+        return `${shape} (one entry per module: ${seen.join(', ')})`;
+    return shape;
+}
+/**
+ * CONFIG_SLICE_LEGACY_STARS_ID: under sliceIdentity "stars", a sliceAliases target or an
+ * allowedCrossSlice entry written against the 4.8.23 stars id (star bindings before the
+ * last literal dropped). It keeps its 4.8.23 verdict for one release; the warning names
+ * the new id.
+ */
+function legacyStarsIdFindings(rule, files) {
+    const out = [];
+    const push = (message) => out.push({
+        ruleId: 'CONFIG_SLICE_LEGACY_STARS_ID',
+        failsStrict: false,
+        fromLayer: rule.from,
+        toLayer: rule.to,
+        message: `${rule.from} → ${rule.to}: ${message} It keeps its 4.8.23 meaning for this release only.`,
+    });
+    const child = rule.childSlices;
+    if (rule.sliceIdentity === 'stars') {
+        const observed = observedIdsByLegacy(rule.sliceFolders, files);
+        for (const alias of child?.sliceAliases ?? []) {
+            if (!alias || typeof alias.to !== 'string')
+                continue;
+            const target = splitAliasTarget(alias.to);
+            if (!target || legacyAliasUniverse(rule, alias.to) === undefined)
+                continue;
+            const shapes = legacyStarsIdTargets(rule.sliceFolders, target.universeId);
+            const segment = target.childId.split('/').pop();
+            push(`sliceAliases to "${alias.to}" is a 4.8.23 stars id (the star before the last literal was dropped). The id is now ${newIdHint(target.universeId, shapes, observed, segment)}; write that instead.`);
+        }
+        for (const edge of rule.allowedCrossSlice ?? []) {
+            if (!edge || typeof edge.from !== 'string' || typeof edge.to !== 'string')
+                continue;
+            const legacySides = [edge.from, edge.to].filter((id) => id.includes('/') && legacyStarsIdTargets(rule.sliceFolders, id).length > 0);
+            if (legacySides.length === 0)
+                continue;
+            const rename = (id) => legacySides.includes(id)
+                ? newIdHint(id, legacyStarsIdTargets(rule.sliceFolders, id), observed)
+                : id;
+            push(`allowedCrossSlice ${edge.from} → ${edge.to} names a 4.8.23 stars id. The ids are now ${rename(edge.from)} → ${rename(edge.to)}; write those instead.`);
+        }
+    }
+    if (child?.sliceIdentity === 'stars') {
+        const observed = observedIdsByLegacy(child.sliceFolders, files);
+        for (const edge of child.allowedCrossSlice ?? []) {
+            if (!edge || typeof edge.from !== 'string' || typeof edge.to !== 'string')
+                continue;
+            const legacySides = [edge.from, edge.to].filter((id) => legacyStarsIdTargets(child.sliceFolders, id).length > 0);
+            if (legacySides.length === 0)
+                continue;
+            const rename = (id) => legacySides.includes(id)
+                ? newIdHint(id, legacyStarsIdTargets(child.sliceFolders, id), observed)
+                : id;
+            push(`childSlices.allowedCrossSlice ${edge.from} → ${edge.to} names a 4.8.23 stars id. The ids are now ${rename(edge.from)} → ${rename(edge.to)}; write those instead.`);
+        }
+    }
+    return out;
+}
+/** `ratchet: true` → always, `ratchet: false` → never, anything else → auto. */
+export function siblingRatchetMode(siblings) {
+    if (siblings !== null && typeof siblings === 'object') {
+        const ratchet = siblings.ratchet;
+        if (ratchet === true)
+            return 'always';
+        if (ratchet === false)
+            return 'never';
+    }
+    return 'auto';
+}
+/**
+ * How many advisory sibling crossings of one rule the baseline records. A key
+ * still present counts when its current row is in the group. A stale key (the
+ * crossing was removed) counts when the rule still classifies that edge as an
+ * advisory sibling crossing, so replacing a recorded crossing neither disarms
+ * the ratchet nor looks like growth.
+ */
+function recordedAdvisorySiblingCount(input) {
+    const { rule } = input;
+    let recorded = 0;
+    for (const key of input.recordedKeys) {
+        if (input.groupKeys.has(key)) {
+            recorded += 1;
+            continue;
+        }
+        if (!rule || input.currentKeys.has(key))
+            continue;
+        const parts = key.split('|');
+        if (parts.length !== 5)
+            continue;
+        const [ruleId = '', file = '', fromLayer = '', toLayer = '', rawTarget = ''] = parts;
+        if (!input.ruleIds.has(ruleId) || fromLayer !== rule.from || toLayer !== rule.to)
+            continue;
+        const target = rawTarget.replace(/#\d+$/, '');
+        if (!file || !target)
+            continue;
+        const verdict = findDeniedEdgeDecision([rule], fromLayer, toLayer, {
+            fromPath: file,
+            toPath: target,
+            layers: input.layers,
+        })?.sliceVerdict;
+        if (verdict?.reasonId === 'CROSS_SIBLING_SLICE' && verdict.decision === 'advisory')
+            recorded += 1;
+    }
+    return recorded;
+}
+/**
+ * Advisory sibling crossings past the recorded baseline become blocking, per
+ * directed rule. Only advisory (`failsStrict: false`) crossings count; an
+ * enforced crossing never switches the ratchet on. For each rule:
+ *
+ * - `ratchet` absent (every string form too): on only when the baseline
+ *   records at least one advisory sibling crossing of that rule (a key still
+ *   present, or a stale key that the rule still classifies as one), and only
+ *   when that rule's current advisory count grew past the recorded count.
+ *   Swapping a recorded crossing for a new one keeps the count and stays a
+ *   warning. An empty baseline, or one frozen before the child wall, promotes
+ *   nothing.
+ * - `ratchet: true`: any unrecorded advisory crossing of the rule is promoted.
+ * - `ratchet: false`: never promoted.
+ *
+ * The key is the existing baseline identity (ruleId, file, layers, target);
+ * reasonId is not part of it. Recorded crossings stay advisory. Callers run
+ * this only when a baseline (or an `--against` base) is in use.
+ */
+export function applyAdvisorySiblingRatchet(violations, occurrenceKeys, recordedKeys, options) {
+    const groups = new Map();
+    for (let index = 0; index < violations.length; index += 1) {
+        const row = violations[index];
+        if (row?.reasonId !== 'CROSS_SIBLING_SLICE' || row.failsStrict !== false)
+            continue;
+        const key = `${row.fromLayer ?? ''}\0${row.toLayer ?? ''}`;
+        const list = groups.get(key);
+        if (list)
+            list.push(index);
+        else
+            groups.set(key, [index]);
+    }
+    if (groups.size === 0)
+        return [...violations];
+    const currentKeys = new Set(occurrenceKeys);
+    const promote = new Set();
+    for (const indexes of groups.values()) {
+        const first = violations[indexes[0] ?? 0];
+        const rule = (options?.rules ?? []).find((candidate) => candidate &&
+            candidate.from === first?.fromLayer &&
+            candidate.to === first?.toLayer &&
+            candidate.allowed === false &&
+            candidate.peerIsolation === true &&
+            candidate.childSlices != null);
+        const mode = siblingRatchetMode(rule?.childSlices?.siblings);
+        if (mode === 'never')
+            continue;
+        if (mode === 'auto') {
+            const recorded = recordedAdvisorySiblingCount({
+                rule: rule,
+                ruleIds: new Set(indexes.map((index) => String(violations[index]?.ruleId ?? ''))),
+                groupKeys: new Set(indexes.map((index) => occurrenceKeys[index] ?? '')),
+                currentKeys,
+                recordedKeys,
+                layers: options?.layers,
+            });
+            if (recorded === 0 || indexes.length <= recorded)
+                continue;
+        }
+        for (const index of indexes) {
+            if (!recordedKeys.has(occurrenceKeys[index] ?? ''))
+                promote.add(index);
+        }
+    }
+    if (promote.size === 0)
+        return [...violations];
+    return violations.map((violation, index) => {
+        if (!promote.has(index))
+            return violation;
+        const from = violation.fromLayer ?? '?';
+        const to = violation.toLayer ?? '?';
+        const why = `New advisory sibling crossing past the recorded baseline for ${from} → ${to}. Set childSlices.siblings.ratchet: false to measure only.`;
+        return {
+            ...violation,
+            failsStrict: true,
+            severity: 'error',
+            ...(typeof violation.message === 'string' ? { message: `${violation.message} ${why}` } : {}),
+        };
+    });
+}
 /**
  * Find the first denying rule for a layer edge.
  *
@@ -656,25 +1721,35 @@ export function findDeniedEdgeDecision(rules, from, to, options) {
             const fromPath = options?.fromPath;
             const toPath = options?.toPath;
             const folders = resolveSliceFolders(rule, from, options?.layers);
-            const fromSlice = fromPath
-                ? sliceIdForPath(fromPath, folders, rule.sliceIdentity)
-                : undefined;
-            const toSlice = toPath ? sliceIdForPath(toPath, folders, rule.sliceIdentity) : undefined;
-            const decision = peerIsolationDecision({
+            const pair = resolveGovernedSlicePair(rule, folders, fromPath, toPath);
+            const fromPlace = pair.from;
+            const toPlace = pair.to;
+            const fromSlice = fromPlace.universeId;
+            const toSlice = toPlace.universeId;
+            const verdict = evaluateNestedSliceWall({
+                rule,
                 fromPath,
                 toPath,
                 folderCount: folders.length,
                 fromSlice,
                 toSlice,
+                fromChild: fromPlace.childId,
+                toChild: toPlace.childId,
                 fromShared: !fromSlice && pathUnderSharedRoot(fromPath, rule.sharedRoots),
                 toShared: !toSlice && pathUnderSharedRoot(toPath, rule.sharedRoots),
-                crossSliceAllowed: crossSliceEdgeAllowed(rule.allowedCrossSlice, fromSlice, toSlice),
-                sharedImportsSlice: rule.sharedImportsSlice,
+                crossSliceAllowed: pair.crossSliceAllowed,
+                legacyChildAllowed: pair.legacyChildAllowed,
             });
-            if (decision.denied) {
-                return { rule, peerIsolationReason: decision.reason, fromSlice, toSlice };
+            if (verdict.decision !== 'allow') {
+                return {
+                    rule,
+                    peerIsolationReason: verdict.peerIsolationReason,
+                    fromSlice,
+                    toSlice,
+                    sliceVerdict: verdict,
+                };
             }
-            continue; // same slice, declared shared, or declared cross edge: no denial
+            continue; // same slice, declared shared, declared cross edge, or child wall allow
         }
         // Classic deny — same-layer always allowed without peerIsolation
         if (from === to)
@@ -698,11 +1773,11 @@ export function findSharedImportsSliceBridge(rules, from, to, options) {
             continue;
         if (rule.allowed !== false || !rule.peerIsolation)
             continue;
-        if (rule.sharedImportsSlice === 'deny')
+        if (sharedImportsSliceMode(rule.sharedImportsSlice) === 'deny')
             continue;
         const folders = resolveSliceFolders(rule, from, options?.layers);
-        const fromSlice = sliceIdForPath(fromPath, folders, rule.sliceIdentity);
-        const toSlice = sliceIdForPath(toPath, folders, rule.sliceIdentity);
+        const fromSlice = resolveGovernedSlice(fromPath, rule, folders).universeId;
+        const toSlice = resolveGovernedSlice(toPath, rule, folders).universeId;
         if (fromSlice || !toSlice)
             continue;
         if (!pathUnderSharedRoot(fromPath, rule.sharedRoots))
@@ -732,6 +1807,10 @@ export function isScanExcludedRelative(relPath, config) {
     const rel = String(relPath).split(/[/\\]/).join('/');
     return scanExcludePatterns(config).some((pattern) => globToRegExp(pattern).test(rel));
 }
+/** Slice folders the universe wall uses: the rule's list, or the from-layer patterns. */
+export function peerSliceFolders(rule, layerName, layers) {
+    return resolveSliceFolders(rule, layerName, layers);
+}
 
 
 import path from 'node:path';