arkgate 4.8.22 → 4.8.24

package/schemas/ark.analysis-result.schema.json

@@ -246,6 +246,21 @@
               "arkruleSource": {
                 "type": "string",
                 "minLength": 1
+              },
+              "reasonId": {
+                "enum": [
+                  "CROSS_PARENT_SLICE",
+                  "CROSS_SIBLING_SLICE",
+                  "CROSS_PARENT_VIA_SHARED"
+                ]
+              },
+              "universeFrom": {
+                "type": "string",
+                "minLength": 1
+              },
+              "universeTo": {
+                "type": "string",
+                "minLength": 1
               }
             }
           },

package/schemas/ark.config.schema.json

@@ -804,7 +804,7 @@
             "path",
             "stars"
           ],
-          "description": "How a starred sliceFolders prefix is named. Absent and path keep today's ids (every literal and star binding). stars keeps the last literal plus the star bindings, so parallel trees share one feature id. Bare names are unchanged."
+          "description": "How a starred sliceFolders prefix is named. Absent and path keep today's ids (every literal and star binding). stars keeps the last literal plus every star binding (a star before the last literal is kept too), so parallel trees share one feature id. Bare names are unchanged."
         },
         "sharedRoots": {
           "type": "array",
@@ -838,10 +838,169 @@
           }
         },
         "sharedImportsSlice": {
-          "type": "string",
-          "enum": [
-            "deny"
+          "description": "deny blocks every shared-root import of a slice. deny-cross-parent leaves that hop as a warning and, in ark-check and CI only, reports a slice that reaches another universe through a shared root. The write hook and ESLint see one edge and do not block it. The object form { mode: \"deny-cross-parent\", stopAt } names composition roots (bootstrap, DI registrations) the whole-graph walk never starts at or passes through; a stop file must still sit under sharedRoots, and stopAt does not silence the direct SHARED_IMPORTS_SLICE warning. arkgate 4.8.22 and older reject deny-cross-parent. arkgate 4.8.23 and older reject the object form (must be one of deny, deny-cross-parent).",
+          "oneOf": [
+            {
+              "type": "string",
+              "enum": [
+                "deny",
+                "deny-cross-parent"
+              ]
+            },
+            {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "mode",
+                "stopAt"
+              ],
+              "properties": {
+                "mode": {
+                  "type": "string",
+                  "enum": [
+                    "deny-cross-parent"
+                  ]
+                },
+                "stopAt": {
+                  "type": "array",
+                  "items": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "uniqueItems": true,
+                  "minItems": 1
+                }
+              }
+            }
           ]
+        },
+        "childSlices": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": [
+            "sliceFolders"
+          ],
+          "description": "Optional inner wall under this rule. Runs only on a rule with peerIsolation: true and allowed: false; elsewhere it is inert and ark-check warns CONFIG_CHILD_SLICES_INERT (config load still accepts it, as 4.8.23 did). Absent keeps today's universe wall. sliceFolders names children. Flat files are universe common, and so is a commonFolders directory directly under the universe (a folder of that name inside a child belongs to that child). siblings is \"deny\" (default), \"advisory\", or { default, enforce, ratchet }. parentMayImportChild defaults to false. message is the text for inner-wall findings. allowedCrossSlice may use a whole-segment *. It clears only a sibling crossing. Cross-parent has no advisory knob. arkgate 4.8.22 and older reject this key. A build that still rejects unknown childSlices fields rejects allowedCrossSlice at config load. A build that still types siblings as a string enum rejects the object at config load.",
+          "properties": {
+            "sliceFolders": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1
+              },
+              "uniqueItems": true,
+              "minItems": 1
+            },
+            "sliceIdentity": {
+              "type": "string",
+              "enum": [
+                "path",
+                "stars"
+              ]
+            },
+            "commonFolders": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "minLength": 1
+              },
+              "uniqueItems": true,
+              "minItems": 1
+            },
+            "siblings": {
+              "description": "\"deny\" or \"advisory\", or { default, enforce, ratchet } so listed subtrees are errors while the default stays advisory. ratchet absent: a new advisory crossing fails only when the baseline in use already records an advisory crossing of this rule. ratchet true: any unrecorded advisory crossing fails when a baseline is in use. ratchet false: measure only, never fails. A string-enum build rejects the object at config load (must be one of deny, advisory). arkgate 4.8.23 and older reject ratchet (unknown field).",
+              "oneOf": [
+                {
+                  "type": "string",
+                  "enum": [
+                    "deny",
+                    "advisory"
+                  ]
+                },
+                {
+                  "type": "object",
+                  "additionalProperties": false,
+                  "required": [
+                    "default"
+                  ],
+                  "properties": {
+                    "default": {
+                      "type": "string",
+                      "enum": [
+                        "deny",
+                        "advisory"
+                      ]
+                    },
+                    "enforce": {
+                      "type": "array",
+                      "items": {
+                        "type": "string",
+                        "minLength": 1
+                      },
+                      "uniqueItems": true
+                    },
+                    "ratchet": {
+                      "type": "boolean"
+                    }
+                  }
+                }
+              ]
+            },
+            "parentMayImportChild": {
+              "type": "boolean"
+            },
+            "message": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Text for inner-wall findings (CROSS_SIBLING_SLICE and universe common importing a child). The rule message stays the universe-wall text (CROSS_PARENT_SLICE and fail-closed denies). Absent: ArkGate default text, never the rule message. arkgate 4.8.23 and older reject this field (unknown field)."
+            },
+            "sliceAliases": {
+              "type": "array",
+              "minItems": 1,
+              "description": "Maps a source path glob onto a child slice id (universe id plus one child segment) so files outside the slice trees take that universe and child for both walls. A path without a wildcard also covers everything under it, as sharedRoots does. A bare name, a universe id alone, a target outside every universe shape, and a wildcard in to are rejected. Under stars identity a target written against the 4.8.23 stars id (star bindings before the last literal dropped, e.g. api/v1/x for modules/*/api/*) still loads when it maps to one universe shape, and ark-check warns CONFIG_SLICE_LEGACY_STARS_ID with the new id; it is rejected only when it maps to more than one shape. Config load checks only the shape; doctor reports a target universe no file belongs to. The glob may not overlap a slice folder, and two aliases may not match the same file. Doctor lists each alias as an owed move. A build that rejects unknown childSlices fields fails at config load (unknown field). arkgate 4.8.22 and older reject childSlices.",
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "from",
+                  "to"
+                ],
+                "properties": {
+                  "from": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "to": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                }
+              }
+            },
+            "allowedCrossSlice": {
+              "type": "array",
+              "minItems": 1,
+              "description": "Directed child-slice allowances. * matches one whole path segment (features/projects/*). ** and a partial segment are rejected. A bare name is rejected. This list clears only CROSS_SIBLING_SLICE. It cannot clear CROSS_PARENT_SLICE or CROSS_PARENT_VIA_SHARED. The universe allowedCrossSlice still treats * as a literal. A build that rejects unknown childSlices fields fails at config load (unknown field).",
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "from",
+                  "to"
+                ],
+                "properties": {
+                  "from": {
+                    "type": "string",
+                    "minLength": 1
+                  },
+                  "to": {
+                    "type": "string",
+                    "minLength": 1
+                  }
+                }
+              }
+            }
+          }
         }
       }
     },

package/schemas/ark.resolved-candidate-facts.schema.json

@@ -1 +1 @@
-{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://unpkg.com/arkgate@3/schemas/ark.resolved-candidate-facts.schema.json","title":"ArkGate resolved candidate facts","type":"object","additionalProperties":false,"required":["schemaVersion","completeness","completenessReasons","resolverIdentity","compilerIdentity","compilerOptionsHash","tsconfigHash","candidateTreeHash","evidenceRequirementsHash","files","dependencies","capabilityUses","ambientUses","publishCalls","intentReferences","safetyUses","factsHash"],"properties":{"schemaVersion":{"enum":["1.0","1.1","1.2"]},"completeness":{"enum":["complete","partial","unavailable"]},"completenessReasons":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["code","message"],"properties":{"code":{"type":"string","minLength":1},"message":{"type":"string","minLength":1},"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"}}}},"resolverIdentity":{"type":"string","minLength":1},"compilerIdentity":{"type":"string","minLength":1},"compilerOptionsHash":{"type":"string","minLength":1},"tsconfigHash":{"type":"string","minLength":1},"candidateTreeHash":{"type":"string","minLength":1},"evidenceRequirementsHash":{"type":"string","minLength":1},"projectPackageName":{"type":"string","minLength":1},"files":{"type":"array","uniqueItems":true,"items":{"type":"object","additionalProperties":false,"required":["path","contentHash","parseStatus","parseDiagnosticCount","exportsOnlyTypes","typeOnlyExportNames","hasTopLevelSideEffects"],"properties":{"path":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"contentHash":{"type":"string","minLength":1},"parseStatus":{"enum":["parsed","invalid"]},"parseDiagnosticCount":{"type":"integer","minimum":0},"exportsOnlyTypes":{"type":"boolean"},"typeOnlyExportNames":{"type":"array","items":{"type":"string","minLength":1}},"hasTopLevelSideEffects":{"type":"boolean"}},"allOf":[{"if":{"properties":{"parseStatus":{"const":"parsed"}}},"then":{"properties":{"parseDiagnosticCount":{"const":0}}}},{"if":{"properties":{"parseStatus":{"const":"invalid"}}},"then":{"properties":{"parseDiagnosticCount":{"minimum":1}}}}]}},"dependencies":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["from","kind","typeOnly","line","resolution"],"properties":{"from":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"specifier":{"type":"string","minLength":1},"kind":{"enum":["import","export","dynamic-import","require"]},"typeOnly":{"type":"boolean"},"line":{"type":"integer","minimum":1},"resolution":{"enum":["resolved-project","resolved-external","unresolved","dynamic"]},"target":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"namedBindings":{"type":"array","items":{"type":"string","minLength":1}},"targetTypeOnlyExports":{"type":"boolean"},"sourcePureTypeModule":{"type":"boolean"},"namedBindingsTypeOnly":{"type":"boolean"},"portProofEligible":{"type":"boolean"}},"allOf":[{"if":{"properties":{"resolution":{"const":"resolved-project"}}},"then":{"required":["target"]},"else":{"not":{"required":["target"]}}},{"if":{"properties":{"resolution":{"const":"dynamic"}}},"else":{"required":["specifier"]}}]}},"capabilityUses":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","symbol","capability","source"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"symbol":{"type":"string","minLength":1},"capability":{"enum":["network","filesystem","clock","randomness","environment","process","persistence"]},"source":{"enum":["ambient-global","import-based"]}}}},"ambientUses":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","symbol"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"symbol":{"type":"string","minLength":1}}}},"publishCalls":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","objectHasIntent","arkPublishCandidate","hasSource"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"rawIntentName":{"type":"string","minLength":1},"objectHasIntent":{"type":"boolean"},"arkPublishCandidate":{"type":"boolean"},"hasSource":{"type":"boolean"},"sourceIntent":{"type":"string","minLength":1}}}},"intentReferences":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","intent"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"intent":{"type":"string","minLength":1}}}},"safetyUses":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","kind"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"kind":{"enum":["ts-suppression","any-cast","dynamic-import","dynamic-require","in-memory-store"]},"symbol":{"type":"string","minLength":1}},"allOf":[{"if":{"properties":{"kind":{"const":"in-memory-store"}}},"then":{"required":["symbol"]},"else":{"not":{"required":["symbol"]}}}]}},"classShapes":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","className","exported","hasPublicMutableFields","hasPublicSetters","hasPublicConstructor","hasStaticFactory","mutatingMethods"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"className":{"type":"string","minLength":1},"exported":{"type":"boolean"},"hasPublicMutableFields":{"type":"boolean"},"hasPublicSetters":{"type":"boolean"},"hasPublicConstructor":{"type":"boolean"},"hasStaticFactory":{"type":"boolean"},"dataOnly":{"type":"boolean"},"mutatingMethods":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["name","referencesGuardOrPublish"],"properties":{"name":{"type":"string","minLength":1},"referencesGuardOrPublish":{"type":"boolean"}}}}}}},"arkRunKernelCalls":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","kind","callee","viaImport"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"kind":{"enum":["factory","publisher","publish","raise","send","subscribe","register-handler","resolve","resolve-singleton"]},"callee":{"type":"string","minLength":1},"viaImport":{"type":"boolean"},"receiver":{"type":"string","minLength":1},"nameLiteral":{"type":"string","minLength":1}}}},"arkRunManagedNews":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","typeName"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"typeName":{"type":"string","minLength":1},"importedFrom":{"type":"string","minLength":1}}}},"arkRunCompositionRootHits":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","matchedRoot","hasKernelFactory"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"matchedRoot":{"type":"string","minLength":1},"hasKernelFactory":{"type":"boolean"}}}},"arkRunDeclarations":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","uses","reactsTo","raises","sends"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"uses":{"type":"array","items":{"type":"string","minLength":1}},"reactsTo":{"type":"array","items":{"type":"string","minLength":1}},"raises":{"type":"array","items":{"type":"string","minLength":1}},"sends":{"type":"array","items":{"type":"string","minLength":1}}}}},"arkOrderPlaneCalls":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","callee"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"callee":{"type":"string","minLength":1}}}},"arkOrderGenericUpdates":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","method"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"method":{"type":"string","minLength":1}}}},"arkOrderRootHits":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","matchedRoot","hasPlaneFactory"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"matchedRoot":{"type":"string","minLength":1},"hasPlaneFactory":{"type":"boolean"}}}},"arkOrderXiFieldWrites":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","key"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"key":{"type":"string","minLength":1}}}},"arkOrderIngestWritesXi":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1}}}},"arkOrderReleaseKeyCounts":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","keyCount"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"keyCount":{"type":"integer","minimum":1}}}},"factsHash":{"type":"string","minLength":1}},"allOf":[{"if":{"properties":{"completeness":{"const":"complete"}}},"then":{"properties":{"completenessReasons":{"maxItems":0},"files":{"items":{"properties":{"parseStatus":{"const":"parsed"}}}}}}},{"if":{"properties":{"completeness":{"enum":["partial","unavailable"]}}},"then":{"properties":{"completenessReasons":{"minItems":1}}}}]}
+{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://unpkg.com/arkgate@3/schemas/ark.resolved-candidate-facts.schema.json","title":"ArkGate resolved candidate facts","type":"object","additionalProperties":false,"required":["schemaVersion","completeness","completenessReasons","resolverIdentity","compilerIdentity","compilerOptionsHash","tsconfigHash","candidateTreeHash","evidenceRequirementsHash","files","dependencies","capabilityUses","ambientUses","publishCalls","intentReferences","safetyUses","factsHash"],"properties":{"schemaVersion":{"enum":["1.0","1.1","1.2"]},"completeness":{"enum":["complete","partial","unavailable"]},"completenessReasons":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["code","message"],"properties":{"code":{"type":"string","minLength":1},"message":{"type":"string","minLength":1},"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"}}}},"resolverIdentity":{"type":"string","minLength":1},"compilerIdentity":{"type":"string","minLength":1},"compilerOptionsHash":{"type":"string","minLength":1},"tsconfigHash":{"type":"string","minLength":1},"candidateTreeHash":{"type":"string","minLength":1},"evidenceRequirementsHash":{"type":"string","minLength":1},"projectPackageName":{"type":"string","minLength":1},"files":{"type":"array","uniqueItems":true,"items":{"type":"object","additionalProperties":false,"required":["path","contentHash","parseStatus","parseDiagnosticCount","exportsOnlyTypes","typeOnlyExportNames","hasTopLevelSideEffects"],"properties":{"path":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"contentHash":{"type":"string","minLength":1},"parseStatus":{"enum":["parsed","invalid"]},"parseDiagnosticCount":{"type":"integer","minimum":0},"exportsOnlyTypes":{"type":"boolean"},"typeOnlyExportNames":{"type":"array","items":{"type":"string","minLength":1}},"hasTopLevelSideEffects":{"type":"boolean"}},"allOf":[{"if":{"properties":{"parseStatus":{"const":"parsed"}}},"then":{"properties":{"parseDiagnosticCount":{"const":0}}}},{"if":{"properties":{"parseStatus":{"const":"invalid"}}},"then":{"properties":{"parseDiagnosticCount":{"minimum":1}}}}]}},"dependencies":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["from","kind","typeOnly","line","resolution"],"properties":{"from":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"specifier":{"type":"string","minLength":1},"kind":{"enum":["import","export","dynamic-import","require"]},"typeOnly":{"type":"boolean"},"line":{"type":"integer","minimum":1},"resolution":{"enum":["resolved-project","resolved-external","unresolved","dynamic"]},"target":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"namedBindings":{"type":"array","items":{"type":"string","minLength":1}},"targetTypeOnlyExports":{"type":"boolean"},"sourcePureTypeModule":{"type":"boolean"},"namedBindingsTypeOnly":{"type":"boolean"},"portProofEligible":{"type":"boolean"}},"allOf":[{"if":{"properties":{"resolution":{"const":"resolved-project"}}},"then":{"required":["target"]},"else":{"not":{"required":["target"]}}},{"if":{"properties":{"resolution":{"const":"dynamic"}}},"else":{"required":["specifier"]}}]}},"capabilityUses":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","symbol","capability","source"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"symbol":{"type":"string","minLength":1},"capability":{"enum":["network","filesystem","clock","randomness","environment","process","persistence"]},"source":{"enum":["ambient-global","import-based"]}}}},"ambientUses":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","symbol"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"symbol":{"type":"string","minLength":1}}}},"publishCalls":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","objectHasIntent","arkPublishCandidate","hasSource"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"rawIntentName":{"type":"string","minLength":1},"objectHasIntent":{"type":"boolean"},"arkPublishCandidate":{"type":"boolean"},"hasSource":{"type":"boolean"},"sourceIntent":{"type":"string","minLength":1}}}},"intentReferences":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","intent"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"intent":{"type":"string","minLength":1}}}},"safetyUses":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","kind"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"kind":{"enum":["ts-suppression","any-cast","dynamic-import","dynamic-require","in-memory-store"]},"symbol":{"type":"string","minLength":1}},"allOf":[{"if":{"properties":{"kind":{"const":"in-memory-store"}}},"then":{"required":["symbol"]},"else":{"not":{"required":["symbol"]}}}]}},"classShapes":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","className","exported","hasPublicMutableFields","hasPublicSetters","hasPublicConstructor","hasStaticFactory","mutatingMethods"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"className":{"type":"string","minLength":1},"exported":{"type":"boolean"},"hasPublicMutableFields":{"type":"boolean"},"hasPublicSetters":{"type":"boolean"},"hasPublicConstructor":{"type":"boolean"},"hasStaticFactory":{"type":"boolean"},"dataOnly":{"type":"boolean"},"truncatedUntil":{"type":"integer","minimum":0},"mutatingMethods":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["name","referencesGuardOrPublish"],"properties":{"name":{"type":"string","minLength":1},"referencesGuardOrPublish":{"type":"boolean"}}}}}}},"arkRunKernelCalls":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","kind","callee","viaImport"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"kind":{"enum":["factory","publisher","publish","raise","send","subscribe","register-handler","resolve","resolve-singleton"]},"callee":{"type":"string","minLength":1},"viaImport":{"type":"boolean"},"receiver":{"type":"string","minLength":1},"nameLiteral":{"type":"string","minLength":1}}}},"arkRunManagedNews":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","typeName"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"typeName":{"type":"string","minLength":1},"importedFrom":{"type":"string","minLength":1}}}},"arkRunCompositionRootHits":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","matchedRoot","hasKernelFactory"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"matchedRoot":{"type":"string","minLength":1},"hasKernelFactory":{"type":"boolean"}}}},"arkRunDeclarations":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","uses","reactsTo","raises","sends"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"uses":{"type":"array","items":{"type":"string","minLength":1}},"reactsTo":{"type":"array","items":{"type":"string","minLength":1}},"raises":{"type":"array","items":{"type":"string","minLength":1}},"sends":{"type":"array","items":{"type":"string","minLength":1}}}}},"arkOrderPlaneCalls":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","callee"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"callee":{"type":"string","minLength":1}}}},"arkOrderGenericUpdates":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","method"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"method":{"type":"string","minLength":1}}}},"arkOrderRootHits":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","matchedRoot","hasPlaneFactory"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"matchedRoot":{"type":"string","minLength":1},"hasPlaneFactory":{"type":"boolean"}}}},"arkOrderXiFieldWrites":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","key"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"key":{"type":"string","minLength":1}}}},"arkOrderIngestWritesXi":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1}}}},"arkOrderReleaseKeyCounts":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","keyCount"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"keyCount":{"type":"integer","minimum":1}}}},"arkOrderXiTtlKeys":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","key"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"key":{"type":"string","minLength":1}}}},"arkOrderBudgetLeaks":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["file","line","kind"],"properties":{"file":{"type":"string","minLength":1,"pattern":"^(?!/)(?![A-Za-z]:/)(?!.*\\\\)(?!.*//)(?!.*(?:^|/)\\.{1,2}(?:/|$))(?!.*[\\u0000-\\u001f\\u007f])(?!.*\\/$).+$"},"line":{"type":"integer","minimum":1},"kind":{"type":"string","minLength":1}}}},"factsHash":{"type":"string","minLength":1}},"allOf":[{"if":{"properties":{"completeness":{"const":"complete"}}},"then":{"properties":{"completenessReasons":{"maxItems":0},"files":{"items":{"properties":{"parseStatus":{"const":"parsed"}}}}}}},{"if":{"properties":{"completeness":{"enum":["partial","unavailable"]}}},"then":{"properties":{"completenessReasons":{"minItems":1}}}}]}

package/schemas/ark.status-manifest.schema.json

@@ -240,6 +240,28 @@
         }
       }
     },
+    "contract": {
+      "type": "object",
+      "description": "Present only when the resolved config fails the shared contract validator (the same fail-closed rules ark-check, MCP and ESLint apply).",
+      "additionalProperties": false,
+      "required": [
+        "valid",
+        "errors"
+      ],
+      "properties": {
+        "valid": {
+          "const": false
+        },
+        "errors": {
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    },
     "improvementCompass": {
       "type": "object",
       "description": "Thin improvement-compass residual ids with honesty mode (notAScore). full | subset | unavailable. Never a gate input; full lenses on doctor JSON. When full, residual ids ⊆ doctor residual for the same facts. unavailable never invents green residual.",

package/server.json

@@ -6,12 +6,12 @@
     "url": "https://github.com/pedroknigge/arkgate",
     "source": "github"
   },
-  "version": "4.8.22",
+  "version": "4.8.24",
   "packages": [
     {
       "registryType": "npm",
       "identifier": "arkgate",
-      "version": "4.8.22",
+      "version": "4.8.24",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"
@@ -19,19 +19,13 @@
       "packageArguments": [
         {
           "type": "positional",
-          "value": "arkgate-mcp"
+          "value": "mcp"
         },
         {
           "type": "named",
           "name": "--root",
           "value": ".",
           "description": "Project root"
-        },
-        {
-          "type": "named",
-          "name": "--config",
-          "value": "ark.config.json",
-          "description": "Path to the rules file (ark.config.json)"
         }
       ]
     }

package/templates/agent-skills/README.md

@@ -9,7 +9,7 @@ closed `/ark-*` catalog shipped as flat templates for Ark install.
 **Closed catalog** (`ARK_SKILL_NAMES`) — first-class doors plus one-release
 redirect stubs. Add a name only with a live ROADMAP item.
 
-Package version when last generated context: **arkgate@4.8.22**
+Package version when last generated context: **arkgate@4.8.24**
 Schema: agent-skills package contract `1.0`
 
 ## Skills (closed catalog)

package/templates/agent-skills/ark-adopt/SKILL.md

@@ -362,7 +362,10 @@ Ark protects the **boundary around** a framework, not its internals. Nest/DI pub
    import them, and they may import a slice. Doctor lists that shared-root → slice hop even
    when the check stays green, so the wall is direct-only. `sharedImportsSlice: "deny"` closes
    that one hop; it does not finish the wall. Promoting the shared slice to its own
-   layer is still the preferred fix.
+   layer is still the preferred fix. With `"deny-cross-parent"` in a DI app, list the
+   composition root (bootstrap, registrations) in the object form's `stopAt` instead of
+   freezing dozens of `CROSS_PARENT_VIA_SHARED` findings through it; doctor
+   `sharedWalkHubs` names that file.
    `sliceFolders`: a bare name stays an unanchored one-segment match (`features` on
    `src/lib/features/projects/rfi/x.ts` is `features/projects`); a filename is never the
    child segment. A starred prefix (`lib/features/*/*`) is anchored like `sharedRoots`

package/templates/agent-skills/ark-order/SKILL.md

@@ -125,7 +125,8 @@ the same files or weaken the gate.
    - Keep Domain-role layers plane-free (`ARKORDER_KERNEL_IN_DOMAIN`).
    - First freeze: `release()`. Later change of a named choice is `proposeRelease` then `apply`
      — not a second `release()` (`ARKORDER_UNVALVED_RELEASE`), not `update` / `patch` / `set`
-     (`ARKORDER_GENERIC_UPDATE`).
+     (`ARKORDER_GENERIC_UPDATE`). Apply the proposal you reviewed against the current Release;
+     a stale one, or one whose blast is not the transition that commits, fails `ARKORDER_STALE_PROPOSAL` — propose again.
    - Name **`xiKeys`** (3–5 slow product decisions). Membership ids and recomputable statuses
      are not keys: derive a status on read or fold it from ingest. A use-case that persists
      those keys is `ARKORDER_XI_FIELD_WRITE`. Invoices and seats still flow through `ingest`.
@@ -149,7 +150,8 @@ the same files or weaken the gate.
 - Extra absent and the user wants it: **STOP — do not continue this skill as complete.**
   **`/ark-adopt`** writes advisory `arkOrder`.
 - Skip cluster (`ARKORDER_MISSING_PLANE` / `ARKORDER_KERNEL_IN_DOMAIN` / `ARKORDER_GENERIC_UPDATE`
-  / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI` / `ARKORDER_XI_FIELD_WRITE`) after
+  / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI` / `ARKORDER_XI_FIELD_WRITE`
+  / `ARKORDER_XI_TTL` / `ARKORDER_INFORMATION_BUDGET`) after
   the extra is on: **`/ark-autopilot`** — this skill still wires one candidate.
 - New plane-root file after the extra is on: **`/ark-place`**.
 - One kernel / bus candidate: **`/ark-runtime`** — do not mix planes.

package/templates/agent-skills/ark-runtime/SKILL.md

@@ -124,7 +124,12 @@ the same files or weaken the gate.
      `appendDecisionTape`. Shadow / compare / replay that snapshot in-memory (not a bus, not
      durable). This is still **[ArkRun]** — do not turn the tape into an ArkOrder skill.
    - In-memory stores lose state on restart — **not** production durability. Note bounded history
-     (`maxHistorySize` 1000) if the hand-rolled version retained everything.
+     (`maxHistorySize` 1000 — history, trace, audit, and the default event buffer) if the
+     hand-rolled version retained everything.
+   - `createStrictArkKernelFromConfig` maps intents by `layers[].intentPrefixes` (canonical
+     layer names get built-in ones); a custom deny-rule layer without prefixes is audited as
+     `layer.observedFlowUnresolvable` (explicit `'hard'` throws `ArkKernelConfigError`). Enforced declarations accept a literal or a same-file
+     `define(..)` creator as the call name.
 6. **Delete the hand-rolled version** once call sites are moved — the point is
    less code, not a second parallel system. Deleting code is a destructive move:
    confirm with the user before removing the old implementation, and never delete

package/templates/arkrules/PersistenceAdapters.json

@@ -4,7 +4,7 @@
   "layer": "PersistenceAdapters",
   "structure": [
     {
-      "id": "thin-adapter",
+      "id": "thin-persistence-adapter",
       "sensor": "thin-adapter",
       "mode": "advisory",
       "description": "Persistence adapters implement ports without domain branching."

package/templates/arkrules/PresentationAdapters.json

@@ -4,7 +4,7 @@
   "layer": "PresentationAdapters",
   "structure": [
     {
-      "id": "thin-adapter",
+      "id": "thin-presentation-adapter",
       "sensor": "thin-adapter",
       "mode": "advisory",
       "description": "Adapters stay thin: map I/O and delegate; avoid domain branching + persistence here."

package/templates/skills/ark-adopt.md

@@ -362,7 +362,10 @@ Ark protects the **boundary around** a framework, not its internals. Nest/DI pub
    import them, and they may import a slice. Doctor lists that shared-root → slice hop even
    when the check stays green, so the wall is direct-only. `sharedImportsSlice: "deny"` closes
    that one hop; it does not finish the wall. Promoting the shared slice to its own
-   layer is still the preferred fix.
+   layer is still the preferred fix. With `"deny-cross-parent"` in a DI app, list the
+   composition root (bootstrap, registrations) in the object form's `stopAt` instead of
+   freezing dozens of `CROSS_PARENT_VIA_SHARED` findings through it; doctor
+   `sharedWalkHubs` names that file.
    `sliceFolders`: a bare name stays an unanchored one-segment match (`features` on
    `src/lib/features/projects/rfi/x.ts` is `features/projects`); a filename is never the
    child segment. A starred prefix (`lib/features/*/*`) is anchored like `sharedRoots`

package/templates/skills/ark-order.md

@@ -125,7 +125,8 @@ the same files or weaken the gate.
    - Keep Domain-role layers plane-free (`ARKORDER_KERNEL_IN_DOMAIN`).
    - First freeze: `release()`. Later change of a named choice is `proposeRelease` then `apply`
      — not a second `release()` (`ARKORDER_UNVALVED_RELEASE`), not `update` / `patch` / `set`
-     (`ARKORDER_GENERIC_UPDATE`).
+     (`ARKORDER_GENERIC_UPDATE`). Apply the proposal you reviewed against the current Release;
+     a stale one, or one whose blast is not the transition that commits, fails `ARKORDER_STALE_PROPOSAL` — propose again.
    - Name **`xiKeys`** (3–5 slow product decisions). Membership ids and recomputable statuses
      are not keys: derive a status on read or fold it from ingest. A use-case that persists
      those keys is `ARKORDER_XI_FIELD_WRITE`. Invoices and seats still flow through `ingest`.
@@ -149,7 +150,8 @@ the same files or weaken the gate.
 - Extra absent and the user wants it: **STOP — do not continue this skill as complete.**
   **`/ark-adopt`** writes advisory `arkOrder`.
 - Skip cluster (`ARKORDER_MISSING_PLANE` / `ARKORDER_KERNEL_IN_DOMAIN` / `ARKORDER_GENERIC_UPDATE`
-  / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI` / `ARKORDER_XI_FIELD_WRITE`) after
+  / `ARKORDER_TOO_MANY_PARAMS` / `ARKORDER_INGEST_WRITES_XI` / `ARKORDER_XI_FIELD_WRITE`
+  / `ARKORDER_XI_TTL` / `ARKORDER_INFORMATION_BUDGET`) after
   the extra is on: **`/ark-autopilot`** — this skill still wires one candidate.
 - New plane-root file after the extra is on: **`/ark-place`**.
 - One kernel / bus candidate: **`/ark-runtime`** — do not mix planes.

package/templates/skills/ark-runtime.md

@@ -124,7 +124,12 @@ the same files or weaken the gate.
      `appendDecisionTape`. Shadow / compare / replay that snapshot in-memory (not a bus, not
      durable). This is still **[ArkRun]** — do not turn the tape into an ArkOrder skill.
    - In-memory stores lose state on restart — **not** production durability. Note bounded history
-     (`maxHistorySize` 1000) if the hand-rolled version retained everything.
+     (`maxHistorySize` 1000 — history, trace, audit, and the default event buffer) if the
+     hand-rolled version retained everything.
+   - `createStrictArkKernelFromConfig` maps intents by `layers[].intentPrefixes` (canonical
+     layer names get built-in ones); a custom deny-rule layer without prefixes is audited as
+     `layer.observedFlowUnresolvable` (explicit `'hard'` throws `ArkKernelConfigError`). Enforced declarations accept a literal or a same-file
+     `define(..)` creator as the call name.
 6. **Delete the hand-rolled version** once call sites are moved — the point is
    less code, not a second parallel system. Deleting code is a destructive move:
    confirm with the user before removing the old implementation, and never delete