boundry 0.3.0 → 0.4.0

package/CHANGELOG.md

@@ -4,13 +4,58 @@ All notable changes to Boundry are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
 versioning follows [semver](https://semver.org/).
 
-## [0.3.0] — unreleased
+## [0.4.0] — 2026-07-17
 
 Makes the "one file can be both the communication diagram and the enforcement
-model" promise hold for deep, nested C4 trees.
+model" promise hold for deep, nested C4 trees, and makes a proposed change
+highlight itself — deterministically, on every LikeC4 surface.
 
 ### Added
 
+- **Accepted-state lock + `annotate` (prototype).** `approve` now records the
+  accepted model to `boundry.lock` beside the diagram — a baseline Boundry
+  **owns**, rather than inferring it from whatever git happens to hold, so
+  "approved" is decoupled from "committed". `boundry annotate` diffs the diagram
+  against that lock and rewrites every undeclared addition — a bare new edge (a
+  self-grant) or box — into an explicit `#proposed` proposal in the source,
+  deterministically and idempotently. Turns silent drift into a reviewable,
+  colourable proposal. (Additive only; deletions are reported, not round-tripped
+  back into the DSL — re-materialising a removed box would resurrect it as an
+  enforced module.)
+  - **Cross-surface highlighting** ([#5]). `annotate` also paints each marker with
+    an intrinsic `style { color amber }` (`#proposed`) / `style { color red }`
+    (`#proposal-delete`) on the element itself. Intrinsic style is the only styling
+    LikeC4 renders on **every** surface — base views *and* the "relationships of X"
+    panel — so a proposal is highlighted wherever a reviewer looks, not just inside
+    the diff views (whose view-scoped rules stop at the view boundary). Idempotent,
+    and `approve` strips the styling back out with the marker: a `#proposed` edge
+    returns to bare, a `#proposed` box loses its colour, a `#proposal-delete` is
+    removed outright. Needs LikeC4 ≥ 1.58 to render.
+- **Per-layer diff views — `boundry diff` (prototype).** Generates a focused
+  LikeC4 view for every layer that holds a pending change — an edge or box tagged
+  `#proposed` or `#proposal-delete` — scoped to the tightest element that draws
+  it, into a derived `boundry.diff.likec4`. This matters because a proposal nested
+  inside a box is invisible once that box collapses at a wider zoom, so a single
+  all-up view hides it; one view per layer surfaces every change in the scope
+  where it renders. It reads the diagram's own markers, not the lock, so it frames
+  whatever `annotate` or a human marked. The file is derived — overwritten each
+  run, removed when nothing is proposed — so it always reflects the current
+  diagram; regenerate after `approve`.
+  - **Deterministic highlighting** ([#4]). `diff` emits the LikeC4 style rules
+    into the derived file, so a `#proposed` box fills amber and its edge goes
+    amber + solid, a `#proposal-delete` red — with no hand-styling. Boxes are
+    styled in place (`style element.tag`, never force-included), so a nested
+    proposal stays in its layer; the rules live only in the generated views, so
+    user-authored views are untouched. Rules are emitted only for marker tags
+    actually in use (referencing an undeclared tag is a hard LikeC4 error).
+- **`#proposal-delete` — the deletion half of the approval lifecycle.** Tag an
+  edge or a box `#proposal-delete` to propose retiring it. The marker colours it
+  red; a pending deletion changes nothing (the edge stays allowed, the box stays
+  enforced), so proposing a removal never breaks the build. On `approve`, the
+  marked edge or box is removed from the diagram outright — deterministically, by
+  splicing the LikeC4 CST — where `#proposed` only strips its own marker and
+  leaves the edge behind. `#proposed` (amber, additive) and `#proposal-delete`
+  (red, subtractive) are now the two halves of every change.
 - **File-level mapping — `metadata { file 'src/x.ts' }`** ([#3]). An element maps
   to a single file instead of a folder. A file module owns exactly its file; a
   folder module owns its subtree minus any mapped descendants — nested folders
@@ -26,8 +71,19 @@ model" promise hold for deep, nested C4 trees.
 
 - **`Module.folder: string` → `Module.path: string` + `Module.kind: 'folder' | 'file'`.**
   SDK-breaking; the diagram surface and CLI are unaffected.
+- **`likec4` floor raised to `^1.58.0`.** The diff-view style-rule syntax Boundry
+  emits is verified against LikeC4 1.58; rendering the coloured views needs a
+  renderer at least that new.
 
 [#3]: https://github.com/makspiechota/boundry/issues/3
+[#4]: https://github.com/makspiechota/boundry/issues/4
+[#5]: https://github.com/makspiechota/boundry/issues/5
+
+## [0.3.0] — 2026-07-16 — superseded by 0.4.0
+
+Published early from a pre-feature snapshot (≈ 0.2.0 plus the `#anything`
+wildcard) and never carried the work now listed under 0.4.0. npm versions are
+immutable, so it stays on the registry; use **0.4.0**.
 
 ## [0.2.0] — 2026-07-16
 

package/README.md

@@ -237,10 +237,86 @@ the allow-list, the newly-allowed set is exactly the set of self-approvals — n
 diff engine required. `approve --base` runs the same gate first, so it won't
 launder a self-granted edge into an approved one.
 
+**To retire an edge or a box, propose its removal** with `#proposal-delete`
+instead of deleting it. The marker colours it red; a pending deletion changes
+nothing (the edge stays allowed, the box stays enforced) so it never breaks the
+build. Then `approve` removes the marked edge or box outright:
+
+```likec4
+  module legacy 'Legacy' {
+    #proposal-delete
+    metadata { folder 'src/legacy' }
+  }
+  api -> legacy #proposal-delete
+```
+
+So `#proposed` and `#proposal-delete` are the two halves of a change — an amber
+addition that `approve` makes permanent, and a red removal that `approve` takes
+away — each a visible mark on the diagram until a human acts.
+
 Point your agents at
 [`.claude/skills/define-architecture-boundaries`](.claude/skills/define-architecture-boundaries/SKILL.md)
 and they'll follow this protocol.
 
+### Catching drift — the lock and `annotate` (prototype)
+
+`verify --base` trusts git for the baseline, which conflates *approved* with
+*committed*. If you'd rather Boundry own that baseline: `approve` records the
+accepted model to **`boundry.lock`** beside the diagram, and `annotate` compares
+against it — no git ref required.
+
+```bash
+boundry approve  --arch arch          # enact proposals AND write boundry.lock
+boundry annotate --arch arch          # rewrite undeclared additions as #proposed
+```
+
+`annotate` finds every edge or box that drifted past the lock without a marker —
+a self-grant — and rewrites it in place as a `#proposed` proposal. That's not
+cosmetic: a `#proposed` edge leaves the allow-list, so the silent grant becomes a
+red-again check and a highlighted box on the diagram, awaiting a real approval. It
+handles additions only; a removal is reported, not re-drawn (re-adding a deleted
+box would resurrect it as an enforced module).
+
+It also **paints the markers** — every `#proposed` edge/box gets an intrinsic
+`style { color amber }`, every `#proposal-delete` a `style { color red }`, written
+onto the element itself. Intrinsic style is the one styling LikeC4 renders on
+*every* surface — base views **and the "relationships of X" panel** — so a
+proposal shows up highlighted wherever a reviewer looks, not only in the generated
+diff views (whose view-scoped rules stop at the view boundary). `approve` strips
+this styling back out with the marker: a `#proposed` edge returns to bare, a
+`#proposed` box stays but loses its colour, a `#proposal-delete` is removed
+outright. Requires **LikeC4 ≥ 1.58** to render.
+
+### Reviewing a proposal — per-layer diff views (prototype)
+
+A proposal nested inside a box is invisible at a wider zoom: at the top level the
+box collapses and its inner `#proposed` edge disappears. So `diff` generates a
+**focused view for every layer that holds a pending change** — the tightest scope
+that actually draws it — into a derived `boundry.diff.likec4`:
+
+```bash
+boundry diff --arch arch              # (re)write boundry.diff.likec4
+likec4 serve arch                     # review each layer, changes coloured
+```
+
+The highlighting is **generated, not hand-styled** — `diff` emits the LikeC4
+style rules into the derived file, so every `#proposed` box fills amber and edge
+goes amber + solid, every `#proposal-delete` red, deterministically. That closes
+the last manual seam: `annotate` marks, `diff` colours, no agent-dependent
+styling step. Boxes are styled *in place* (never force-included), so a nested
+proposal stays in its own layer; unchanged elements keep their defaults; and the
+rules live only in the generated views, so your own views are untouched.
+
+The file is a **derived artifact**: overwritten every run, removed when nothing is
+proposed, so it always matches the current diagram — regenerate it after
+`approve`. It reads the diagram's own markers (not the lock), so it frames
+whatever `annotate` or a human has marked. Being derived, it's a `.gitignore`
+candidate (`boundry.diff.likec4`).
+
+> Rendering the coloured diff views needs **LikeC4 ≥ 1.58** (the style-rule syntax
+> Boundry emits). Boundry itself depends on that floor; the tool you review with
+> (`likec4 serve`, the CLI, or the IDE extension) has to meet it too.
+
 ## CLI
 
 ```
@@ -248,6 +324,8 @@ boundry check    [--arch <dir>] [--cwd <dir>] [sources...]
 boundry generate [--arch <dir>] [--cwd <dir>] [--out <file>]
 boundry verify   [--arch <dir>] [--cwd <dir>] --base <git-ref>
 boundry approve  [--arch <dir>] [--cwd <dir>] [--base <git-ref>]
+boundry annotate [--arch <dir>]
+boundry diff     [--arch <dir>]
 ```
 
 | Flag | Meaning |
@@ -262,7 +340,12 @@ boundry approve  [--arch <dir>] [--cwd <dir>] [--base <git-ref>]
 - **`generate`** just emits the dependency-cruiser config so you can commit it or
   run `depcruise` yourself.
 - **`verify`** rejects dependencies granted without a proposal.
-- **`approve`** strips `#proposed` markers. For humans, not agents.
+- **`approve`** enacts markers (strips `#proposed`, removes `#proposal-delete`) and
+  writes `boundry.lock`. For humans, not agents.
+- **`annotate`** rewrites undeclared additions as `#proposed`, diffing against
+  `boundry.lock`.
+- **`diff`** generates a focused, colour-coded review view per layer that holds a
+  pending change, into a derived `boundry.diff.likec4`.
 
 Boundry warns (but does not fail) when a mapped folder matches **zero** files, and
 **fails outright** when a check analysed no files at all — so a passing check can

package/dist/adapters/visualizer/likec4.d.ts

@@ -1,5 +1,5 @@
-import type { VisualizerPort } from '../../core/ports/ports.js';
-import type { BoundaryModel } from '../../core/model/boundary-model.js';
+import type { VisualizerPort, DiffView } from '../../core/ports/ports.js';
+import type { BoundaryModel, AllowedEdge } from '../../core/model/boundary-model.js';
 /**
  * First visualizer adapter. Reads a LikeC4 workspace and lifts it into the
  * boundary model: any element carrying a `folder` metadata key becomes a
@@ -11,10 +11,40 @@ export declare class LikeC4Visualizer implements VisualizerPort {
     constructor(workspaceDir: string);
     read(): Promise<BoundaryModel>;
     /**
-     * Deterministically strip `#proposed` markers from the diagram source,
-     * promoting intent edges to approved. Source-preserving; never an LLM edit —
-     * it locates each marked relationship in the LikeC4 CST and splices out its
-     * proposal decoration, leaving all other formatting intact.
+     * Deterministically enact a diagram's pending proposals. Source-preserving,
+     * never an LLM edit — it walks the LikeC4 CST and splices ranges directly:
+     *   - `#proposed` markers are stripped, promoting their intent edges to
+     *     approved (the edge/box stays, permanently allowed);
+     *   - `#proposal-delete` markers take their whole edge or box with them, so
+     *     approving a proposed removal actually removes it.
+     * All other formatting is left intact.
      */
     approve(): Promise<void>;
+    /**
+     * Deterministically mark the given edges and elements `#proposed`. The inverse
+     * of `approve` for additions: an undeclared new edge (a self-grant) or box is
+     * rewritten into an explicit, colourable proposal. It locates each target's
+     * relation/element in the CST by its resolved ids and injects the marker,
+     * skipping anything already marked, so it is idempotent.
+     */
+    propose(edges: AllowedEdge[], moduleIds: string[]): Promise<void>;
+    /**
+     * Paint intrinsic style on every marked edge and box, so a proposal is
+     * highlighted on *every* LikeC4 surface — base views and the "relationships of
+     * X" panel, not just the generated diff views (which only carry view-scoped
+     * rules). A `#proposed` edge/box gets `style { color amber }`, a
+     * `#proposal-delete` `style { color red }`. Source-preserving and idempotent —
+     * anything already carrying the canonical style is left alone. `approve` strips
+     * this styling back out when it enacts the marker.
+     */
+    styleMarkers(): Promise<void>;
+    /**
+     * Generate a focused diff view for every layer that holds a pending change.
+     * Walks the diagram's own `#proposed` / `#proposal-delete` markers (never the
+     * lock — a `#proposal-delete` has no lock delta), buckets each change into the
+     * tightest scope that draws it, and writes one `view … of <scope>` per bucket
+     * to a derived `boundry.diff.likec4`. The file is overwritten each run and
+     * removed when nothing is proposed, so it always reflects the current diagram.
+     */
+    emitDiffViews(): Promise<DiffView[]>;
 }

package/dist/adapters/visualizer/likec4.js

@@ -1,5 +1,69 @@
 import { LikeC4 } from 'likec4';
-import { readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+/** The generated, derived file holding Boundry's per-layer diff views. */
+const DIFF_FILE = 'boundry.diff.likec4';
+/** The generated view id for a scope — `boundry_diff_root` or `boundry_diff_<fqn>`. */
+function scopeViewId(scope) {
+    return scope ? `boundry_diff_${scope.replace(/\./g, '_')}` : 'boundry_diff_root';
+}
+/**
+ * The tightest layer that draws an edge between two elements: the deepest
+ * element that contains both, i.e. the common prefix of their fqns (undefined =
+ * the model root). An edge nested inside a box shows there, not at a wider scope
+ * where the box has collapsed — which is exactly why each layer needs its own view.
+ */
+function commonScope(from, to) {
+    const a = from.split('.');
+    const b = to.split('.');
+    const shared = [];
+    for (let i = 0; i < Math.min(a.length, b.length) && a[i] === b[i]; i++) {
+        shared.push(a[i]);
+    }
+    return shared.length ? shared.join('.') : undefined;
+}
+/** The layer that draws a box: its parent element (undefined = the model root). */
+function parentScope(fqn) {
+    const parts = fqn.split('.');
+    parts.pop();
+    return parts.length ? parts.join('.') : undefined;
+}
+/**
+ * Deterministic highlight rules for the marker tags actually in use. Referencing
+ * an undeclared tag is a hard LikeC4 error, and a tag can only be *used* if it is
+ * declared — so emitting rules only for seen tags is always safe.
+ *
+ * Boxes use a style-only `style element.tag` rule: a tagged box is coloured where
+ * it already sits and never force-included into a wider view (which would drag a
+ * nested proposal out of its collapsed parent, defeating the per-layer framing).
+ * Edges use `include … where … with`, coloured and made *solid* so they stand out
+ * against LikeC4's dashed default. Amber = addition, red = removal. Verified
+ * against LikeC4 1.58.
+ */
+function highlightLines(usedTags) {
+    const lines = [];
+    if (usedTags.has('proposed')) {
+        lines.push('    style element.tag = #proposed { color amber }');
+    }
+    if (usedTags.has('proposal-delete')) {
+        lines.push('    style element.tag = #proposal-delete { color red }');
+    }
+    if (usedTags.has('proposed')) {
+        lines.push('    include * -> * where tag is #proposed with { color amber; line solid }');
+    }
+    if (usedTags.has('proposal-delete')) {
+        lines.push('    include * -> * where tag is #proposal-delete with { color red; line solid }');
+    }
+    return lines;
+}
+/** One `view … { include * }` block, scoped with `of <element>` unless it is root. */
+function renderDiffView(scope, highlight) {
+    const opener = scope
+        ? `  view ${scopeViewId(scope)} of ${scope} {`
+        : `  view ${scopeViewId(scope)} {`;
+    const lines = [`    title 'Boundry diff · ${scope ?? 'root'}'`, '    include *', ...highlight];
+    return `${opener}\n${lines.join('\n')}\n  }`;
+}
 /**
  * An exemption pattern has to be a usable regex before it reaches the linter. A
  * broken or empty one would otherwise be a silent hole: it exempts files from
@@ -24,15 +88,57 @@ function assertUsableRegex(pattern, elementId) {
     }
     return pattern;
 }
-/** A `#proposed` marker in the source — on an element or a relationship alike. */
-function isProposedTag(node, text) {
-    return (node.$type === 'TagRef' &&
-        node.$cstNode &&
-        text.slice(node.$cstNode.offset, node.$cstNode.end) === '#proposed');
+/**
+ * Walk the AST through CONTAINMENT only — descending into a property solely when
+ * the child names this node as its `$container`. That skips cross-references (a
+ * relation's endpoint links to the element it names), so a node is never reached
+ * through another's reference to it, and traversal never leaves this document.
+ */
+function walkContained(root, visit) {
+    const go = (node) => {
+        if (!node || typeof node !== 'object')
+            return;
+        visit(node);
+        for (const key of Object.keys(node)) {
+            if (key.startsWith('$'))
+                continue;
+            const child = node[key];
+            for (const kid of Array.isArray(child) ? child : [child]) {
+                if (kid && typeof kid === 'object' && kid.$container === node)
+                    go(kid);
+            }
+        }
+    };
+    go(root);
 }
 /**
- * The source to remove for one marker. A marker alone on its line takes the
- * whole line (so approving leaves no blank gap); an inline one takes just the
+ * The fully-qualified id of an element AST node — its own name and every
+ * enclosing element's, joined by '.'. Matches the id the computed model assigns,
+ * for nested elements as well as flat ones.
+ */
+function fqnOf(astElement) {
+    if (!astElement)
+        return undefined;
+    const parts = [];
+    for (let n = astElement; n; n = n.$container) {
+        if (n.$type === 'Element' && n.name)
+            parts.unshift(n.name);
+    }
+    return parts.length ? parts.join('.') : undefined;
+}
+/** The element an `a -> b` endpoint (FqnRef) resolves to, or undefined. */
+function endpointElement(fqnRef) {
+    return fqnRef?.value?.ref;
+}
+/** The literal source text of a TagRef node, or undefined if it is not one. */
+function tagRefText(node, text) {
+    if (node.$type !== 'TagRef' || !node.$cstNode)
+        return undefined;
+    return text.slice(node.$cstNode.offset, node.$cstNode.end);
+}
+/**
+ * The source to remove for a `#proposed` marker. A marker alone on its line takes
+ * the whole line (so approving leaves no blank gap); an inline one takes just the
  * token and the space before it. The `tag proposed` declaration in the
  * specification is untouched — the vocabulary stays for the next proposal.
  */
@@ -50,28 +156,150 @@ function proposedRemovalRange(tag, text) {
         start--;
     return { start, end };
 }
-function collectProposedRanges(root, text) {
-    const ranges = [];
-    const seen = new Set();
-    const walk = (node) => {
-        if (!node || typeof node !== 'object' || seen.has(node))
-            return;
-        seen.add(node);
-        if (Array.isArray(node)) {
-            for (const item of node)
-                walk(item);
-            return;
+/**
+ * The nearest relationship or element the marker sits in, found via the AST
+ * `$container` chain — the true syntactic parent. A plain object-graph walk would
+ * follow the cross-reference from a relation's endpoint into the element it names
+ * and mis-attribute an element's marker to a relation; `$container` never does.
+ */
+function enclosingStatement(tagRef) {
+    for (let n = tagRef.$container; n; n = n.$container) {
+        if (n.$type === 'Relation' || n.$type === 'Element')
+            return n;
+    }
+    return undefined;
+}
+/**
+ * The whole-statement range for a `#proposal-delete` marker: the entire relation
+ * or element block, from the start of its first line through its trailing
+ * newline, so approving the deletion removes the edge/box and leaves no gap.
+ */
+function statementRemovalRange(statement, text) {
+    const { offset, end } = statement.$cstNode;
+    const lineStart = text.lastIndexOf('\n', offset - 1) + 1;
+    const nl = text.indexOf('\n', end);
+    return { start: lineStart, end: nl === -1 ? text.length : nl + 1 };
+}
+/** amber for `#proposed`, red for `#proposal-delete` — the intrinsic colour annotate paints. */
+const MARKER_COLOR = {
+    '#proposed': 'amber',
+    '#proposal-delete': 'red',
+};
+/** The canonical intrinsic style annotate injects for a colour. */
+function canonicalStyle(color) {
+    return `style { color ${color} }`;
+}
+/** The direct `*Body` child (ElementBody / RelationBody) of a statement, if any. */
+function statementBody(stmt) {
+    for (const key of Object.keys(stmt)) {
+        if (key.startsWith('$'))
+            continue;
+        const child = stmt[key];
+        for (const kid of Array.isArray(child) ? child : [child]) {
+            if (kid && typeof kid === 'object' && kid.$container === stmt &&
+                typeof kid.$type === 'string' && kid.$type.endsWith('Body')) {
+                return kid;
+            }
+        }
+    }
+    return undefined;
+}
+/** The direct `*StyleProperty` children of a body. */
+function styleProperties(body) {
+    const out = [];
+    for (const key of Object.keys(body)) {
+        if (key.startsWith('$'))
+            continue;
+        const child = body[key];
+        for (const kid of Array.isArray(child) ? child : [child]) {
+            if (kid && typeof kid === 'object' && kid.$container === body &&
+                typeof kid.$type === 'string' && kid.$type.endsWith('StyleProperty')) {
+                out.push(kid);
+            }
+        }
+    }
+    return out;
+}
+/**
+ * The style node in `body` whose source is EXACTLY the canonical `style { color
+ * <c> }` annotate writes — matched by whitespace-normalised text, so a richer
+ * user-authored style (`style { color amber; icon none }`) is never mistaken for
+ * ours and never stripped.
+ */
+function canonicalStyleNode(body, color, text) {
+    const want = canonicalStyle(color);
+    return styleProperties(body).find((s) => s.$cstNode &&
+        text.slice(s.$cstNode.offset, s.$cstNode.end).replace(/\s+/g, ' ').trim() === want);
+}
+/** True when `node` is the body's only property — nothing else would survive removing it. */
+function bodyHasOnly(body, node) {
+    for (const key of Object.keys(body)) {
+        if (key.startsWith('$'))
+            continue;
+        const child = body[key];
+        for (const kid of Array.isArray(child) ? child : [child]) {
+            if (kid && typeof kid === 'object' && kid.$container === body && kid !== node)
+                return false;
         }
-        if (isProposedTag(node, text)) {
+    }
+    return true;
+}
+/** A node's whole line, trailing newline included — for stripping a box's style line. */
+function lineRemovalRange(node, text) {
+    const { offset, end } = node.$cstNode;
+    const lineStart = text.lastIndexOf('\n', offset - 1) + 1;
+    const nl = text.indexOf('\n', end);
+    return { start: lineStart, end: nl === -1 ? text.length : nl + 1 };
+}
+/** A relation body in full, plus the whitespace before its `{` — turns `a -> b { … }` back into `a -> b`. */
+function bodyRemovalRange(body, text) {
+    let start = body.$cstNode.offset;
+    while (start > 0 && (text[start - 1] === ' ' || text[start - 1] === '\t'))
+        start--;
+    return { start, end: body.$cstNode.end };
+}
+/**
+ * Every source range to splice out to approve a diagram. A `#proposed` marker
+ * strips to its token (the edge/box stays and becomes permanent) AND takes with
+ * it any intrinsic `style { color amber }` annotate painted on — for a box, that
+ * style's line; for an edge, its whole (now-empty) body, so the edge goes back to
+ * bare. A `#proposal-delete` marker takes its whole enclosing statement (the
+ * edge/box, and any style on it, are removed outright). Ranges are collected via
+ * a containment-only walk — descending solely into true children
+ * (`child.$container === node`), never cross-references — so one marker is never
+ * counted through another element's reference to it, and no range ever escapes
+ * into a different document's text.
+ */
+function collectApprovalRanges(root, text) {
+    const ranges = [];
+    walkContained(root, (node) => {
+        const marker = tagRefText(node, text);
+        if (marker === '#proposed') {
             ranges.push(proposedRemovalRange(node, text));
+            // Strip the intrinsic amber style annotate paints, so an approved box does
+            // not stay amber forever and an approved edge goes back to bare.
+            const statement = enclosingStatement(node);
+            const body = statement && statementBody(statement);
+            const style = body && canonicalStyleNode(body, MARKER_COLOR['#proposed'], text);
+            if (style) {
+                if (statement.$type === 'Relation' && bodyHasOnly(body, style)) {
+                    ranges.push(bodyRemovalRange(body, text));
+                }
+                else {
+                    ranges.push(lineRemovalRange(style, text));
+                }
+            }
         }
-        for (const key of Object.keys(node)) {
-            if (!key.startsWith('$'))
-                walk(node[key]);
+        else if (marker === '#proposal-delete') {
+            const statement = enclosingStatement(node);
+            if (statement?.$cstNode)
+                ranges.push(statementRemovalRange(statement, text));
         }
-    };
-    walk(root);
-    return ranges;
+    });
+    // A whole-statement removal can contain a `#proposed` token range inside it
+    // (a box being deleted that also carried a proposed edge). Drop any range that
+    // another wholly contains, so back-to-front splicing never double-cuts.
+    return ranges.filter((r) => !ranges.some((o) => o !== r && o.start <= r.start && o.end >= r.end && o.end - o.start > r.end - r.start));
 }
 /**
  * First visualizer adapter. Reads a LikeC4 workspace and lifts it into the
@@ -158,17 +386,20 @@ export class LikeC4Visualizer {
         };
     }
     /**
-     * Deterministically strip `#proposed` markers from the diagram source,
-     * promoting intent edges to approved. Source-preserving; never an LLM edit —
-     * it locates each marked relationship in the LikeC4 CST and splices out its
-     * proposal decoration, leaving all other formatting intact.
+     * Deterministically enact a diagram's pending proposals. Source-preserving,
+     * never an LLM edit — it walks the LikeC4 CST and splices ranges directly:
+     *   - `#proposed` markers are stripped, promoting their intent edges to
+     *     approved (the edge/box stays, permanently allowed);
+     *   - `#proposal-delete` markers take their whole edge or box with them, so
+     *     approving a proposed removal actually removes it.
+     * All other formatting is left intact.
      */
     async approve() {
         const likec4 = await LikeC4.fromWorkspace(this.workspaceDir);
         for (const doc of likec4.LangiumDocuments.all) {
             const filePath = doc.uri.fsPath;
             const text = doc.textDocument?.getText?.() ?? readFileSync(filePath, 'utf8');
-            const ranges = collectProposedRanges(doc.parseResult?.value, text);
+            const ranges = collectApprovalRanges(doc.parseResult?.value, text);
             if (ranges.length === 0)
                 continue;
             let next = text;
@@ -178,4 +409,194 @@ export class LikeC4Visualizer {
             writeFileSync(filePath, next);
         }
     }
+    /**
+     * Deterministically mark the given edges and elements `#proposed`. The inverse
+     * of `approve` for additions: an undeclared new edge (a self-grant) or box is
+     * rewritten into an explicit, colourable proposal. It locates each target's
+     * relation/element in the CST by its resolved ids and injects the marker,
+     * skipping anything already marked, so it is idempotent.
+     */
+    async propose(edges, moduleIds) {
+        if (edges.length === 0 && moduleIds.length === 0)
+            return;
+        const wantEdge = new Set(edges.map((e) => `${e.from} -> ${e.to}`));
+        const wantModule = new Set(moduleIds);
+        const likec4 = await LikeC4.fromWorkspace(this.workspaceDir);
+        for (const doc of likec4.LangiumDocuments.all) {
+            const filePath = doc.uri.fsPath;
+            if (!filePath.endsWith('.likec4'))
+                continue;
+            const text = doc.textDocument?.getText?.() ?? readFileSync(filePath, 'utf8');
+            const inserts = [];
+            walkContained(doc.parseResult?.value, (node) => {
+                if (node.$type === 'Relation' && node.$cstNode) {
+                    const from = fqnOf(endpointElement(node.source));
+                    const to = fqnOf(endpointElement(node.target));
+                    if (from && to && wantEdge.has(`${from} -> ${to}`)) {
+                        const { offset, end } = node.$cstNode;
+                        if (!text.slice(offset, end).includes('#proposed')) {
+                            inserts.push({ at: end, text: ' #proposed' });
+                        }
+                    }
+                }
+                else if (node.$type === 'Element' && node.$cstNode) {
+                    const id = fqnOf(node);
+                    const body = node.body;
+                    if (id && wantModule.has(id) && body?.$cstNode) {
+                        const braceStart = body.$cstNode.offset;
+                        const bodyText = text.slice(braceStart, body.$cstNode.end);
+                        if (!bodyText.includes('#proposed')) {
+                            // Insert as the body's first line, matching the indentation of the
+                            // line that already follows the opening brace.
+                            const afterBrace = text.indexOf('{', braceStart) + 1;
+                            const nextLine = text.indexOf('\n', afterBrace) + 1;
+                            const indent = (text.slice(nextLine).match(/^[ \t]*/) ?? [''])[0];
+                            inserts.push({ at: afterBrace, text: `\n${indent}#proposed` });
+                        }
+                    }
+                }
+            });
+            if (inserts.length === 0)
+                continue;
+            let next = text;
+            for (const { at, text: fragment } of inserts.sort((a, b) => b.at - a.at)) {
+                next = next.slice(0, at) + fragment + next.slice(at);
+            }
+            writeFileSync(filePath, next);
+        }
+    }
+    /**
+     * Paint intrinsic style on every marked edge and box, so a proposal is
+     * highlighted on *every* LikeC4 surface — base views and the "relationships of
+     * X" panel, not just the generated diff views (which only carry view-scoped
+     * rules). A `#proposed` edge/box gets `style { color amber }`, a
+     * `#proposal-delete` `style { color red }`. Source-preserving and idempotent —
+     * anything already carrying the canonical style is left alone. `approve` strips
+     * this styling back out when it enacts the marker.
+     */
+    async styleMarkers() {
+        const likec4 = await LikeC4.fromWorkspace(this.workspaceDir);
+        for (const doc of likec4.LangiumDocuments.all) {
+            const filePath = doc.uri.fsPath;
+            if (!filePath.endsWith('.likec4') || filePath.endsWith(DIFF_FILE))
+                continue;
+            const text = doc.textDocument?.getText?.() ?? readFileSync(filePath, 'utf8');
+            const inserts = [];
+            walkContained(doc.parseResult?.value, (node) => {
+                const marker = tagRefText(node, text);
+                if (marker !== '#proposed' && marker !== '#proposal-delete')
+                    return;
+                const color = MARKER_COLOR[marker];
+                const statement = enclosingStatement(node);
+                if (!statement)
+                    return;
+                const body = statementBody(statement);
+                if (body && canonicalStyleNode(body, color, text))
+                    return; // already styled
+                if (body?.$cstNode) {
+                    // Style on the line right after the marker, at the marker's indent. It
+                    // must go AFTER the marker: a body lists its tags before its style
+                    // properties, so a style ahead of the `#proposed` tag is a parse error.
+                    const markerEnd = node.$cstNode.end;
+                    const lineStart = text.lastIndexOf('\n', markerEnd - 1) + 1;
+                    const indent = (text.slice(lineStart).match(/^[ \t]*/) ?? [''])[0];
+                    const nl = text.indexOf('\n', markerEnd);
+                    inserts.push({
+                        at: nl === -1 ? markerEnd : nl,
+                        text: `\n${indent}${canonicalStyle(color)}`,
+                    });
+                }
+                else {
+                    // An inline-marked edge (`a -> b #proposed`) has no body — give it one,
+                    // indented one level past the relation's own line.
+                    const lineStart = text.lastIndexOf('\n', statement.$cstNode.offset - 1) + 1;
+                    const indent = (text.slice(lineStart).match(/^[ \t]*/) ?? [''])[0];
+                    inserts.push({
+                        at: statement.$cstNode.end,
+                        text: ` {\n${indent}  ${canonicalStyle(color)}\n${indent}}`,
+                    });
+                }
+            });
+            if (inserts.length === 0)
+                continue;
+            let next = text;
+            for (const { at, text: fragment } of inserts.sort((a, b) => b.at - a.at)) {
+                next = next.slice(0, at) + fragment + next.slice(at);
+            }
+            writeFileSync(filePath, next);
+        }
+    }
+    /**
+     * Generate a focused diff view for every layer that holds a pending change.
+     * Walks the diagram's own `#proposed` / `#proposal-delete` markers (never the
+     * lock — a `#proposal-delete` has no lock delta), buckets each change into the
+     * tightest scope that draws it, and writes one `view … of <scope>` per bucket
+     * to a derived `boundry.diff.likec4`. The file is overwritten each run and
+     * removed when nothing is proposed, so it always reflects the current diagram.
+     */
+    async emitDiffViews() {
+        const likec4 = await LikeC4.fromWorkspace(this.workspaceDir);
+        // scopeViewId -> { scope, changes } — deterministic key, so the same diagram
+        // always yields the same set of views.
+        const layers = new Map();
+        const record = (scope) => {
+            const key = scopeViewId(scope);
+            const layer = layers.get(key) ?? { scope, changes: 0 };
+            layer.changes += 1;
+            layers.set(key, layer);
+        };
+        // Which marker tags actually appear — so the emitted highlight rules only ever
+        // reference declared tags (an undeclared tag reference is a hard LikeC4 error).
+        const usedTags = new Set();
+        for (const doc of likec4.LangiumDocuments.all) {
+            const filePath = doc.uri.fsPath;
+            if (!filePath.endsWith('.likec4') || filePath.endsWith(DIFF_FILE))
+                continue;
+            const text = doc.textDocument?.getText?.() ?? readFileSync(filePath, 'utf8');
+            walkContained(doc.parseResult?.value, (node) => {
+                const marker = tagRefText(node, text);
+                if (marker !== '#proposed' && marker !== '#proposal-delete')
+                    return;
+                usedTags.add(marker.slice(1)); // drop the leading '#'
+                const statement = enclosingStatement(node);
+                if (statement?.$type === 'Relation') {
+                    const from = fqnOf(endpointElement(statement.source));
+                    const to = fqnOf(endpointElement(statement.target));
+                    if (from && to)
+                        record(commonScope(from, to));
+                }
+                else if (statement?.$type === 'Element') {
+                    const fqn = fqnOf(statement);
+                    if (fqn)
+                        record(parentScope(fqn));
+                }
+            });
+        }
+        const diffPath = join(this.workspaceDir, DIFF_FILE);
+        if (layers.size === 0) {
+            // Nothing proposed — clear any stale views so `serve` never renders a diff
+            // that no longer exists (and never dangles a reference to an approved-away box).
+            if (existsSync(diffPath))
+                rmSync(diffPath);
+            return [];
+        }
+        // Root first, then by fqn, so the output is stable across runs.
+        const ordered = [...layers.values()].sort((a, b) => {
+            if (!a.scope)
+                return -1;
+            if (!b.scope)
+                return 1;
+            return a.scope.localeCompare(b.scope);
+        });
+        const highlight = highlightLines(usedTags);
+        const body = ordered.map((layer) => renderDiffView(layer.scope, highlight)).join('\n');
+        writeFileSync(diffPath, `// Generated by \`boundry diff\` — one focused view per layer with a pending\n` +
+            `// change. Derived artifact: regenerate after approve; do not hand-edit.\n` +
+            `views {\n${body}\n}\n`);
+        return ordered.map((layer) => ({
+            id: scopeViewId(layer.scope),
+            scope: layer.scope,
+            changes: layer.changes,
+        }));
+    }
 }

package/dist/cli/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { execFileSync } from 'node:child_process';
-import { mkdtempSync, readdirSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdtempSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, relative, resolve } from 'node:path';
 import { Pipeline } from '../core/pipeline/pipeline.js';
 import { LikeC4Visualizer } from '../adapters/visualizer/likec4.js';
 import { DepCruiserEnforcer } from '../adapters/enforcer/depcruiser.js';
-const USAGE = 'usage: boundry <generate|check|approve|verify> [--arch <dir>] [--base <git-ref>] [--cwd <dir>] [--out <file>] [sources...]';
+const USAGE = 'usage: boundry <generate|check|approve|verify|annotate|diff> [--arch <dir>] [--base <git-ref>] [--cwd <dir>] [--out <file>] [sources...]';
 function optValue(args, flag) {
     const i = args.indexOf(flag);
     return i >= 0 ? args[i + 1] : undefined;
@@ -75,6 +75,9 @@ async function main() {
     const cwd = optValue(rest, '--cwd');
     if (cwd)
         process.chdir(resolve(cwd));
+    // The accepted-state lock lives beside the diagram it locks. `approve` writes
+    // it; `annotate` reads it — the baseline Boundry owns, not one inferred from git.
+    const lockFile = join(archDir, 'boundry.lock');
     const pipeline = new Pipeline(new LikeC4Visualizer(archDir), new DepCruiserEnforcer());
     const grantedSince = (ref) => pipeline.verify(new LikeC4Visualizer(materializeArchAt(archDir, ref)));
     if (command === 'generate') {
@@ -131,8 +134,43 @@ async function main() {
         else {
             console.error('Boundry: ⚠ no --base given — approving without verifying that every new edge was proposed');
         }
-        await pipeline.approve();
-        console.log('Boundry: ✓ approved — stripped #proposed markers from the diagram');
+        const lock = await pipeline.approve();
+        writeFileSync(lockFile, lock);
+        console.log('Boundry: ✓ approved — enacted the diagram and wrote', relative(process.cwd(), lockFile));
+        return;
+    }
+    if (command === 'annotate') {
+        if (!existsSync(lockFile)) {
+            console.error(`Boundry: no ${relative(process.cwd(), lockFile)} — run 'boundry approve' first to record an accepted state`);
+            process.exitCode = 2;
+            return;
+        }
+        const { edges, modules } = await pipeline.annotate(readFileSync(lockFile, 'utf8'));
+        if (edges.length === 0 && modules.length === 0) {
+            console.log('Boundry: ✓ nothing to annotate — the diagram matches the accepted lock');
+            return;
+        }
+        console.log(`Boundry: ✎ marked ${edges.length} edge(s) and ${modules.length} box(es) #proposed:`);
+        for (const edge of edges)
+            console.log(`  ${edge.from} → ${edge.to}`);
+        for (const mod of modules)
+            console.log(`  [${mod.title}]`);
+        console.log('  Review the highlighted diagram, then approve or revert.');
+        return;
+    }
+    if (command === 'diff') {
+        const views = await pipeline.diffViews();
+        const diffFile = join(archDir, 'boundry.diff.likec4');
+        if (views.length === 0) {
+            console.log('Boundry: ✓ nothing proposed — no diff views to draw');
+            return;
+        }
+        console.log(`Boundry: ✎ wrote ${views.length} diff view(s) to ${relative(process.cwd(), diffFile)}:`);
+        for (const view of views) {
+            const layer = view.scope ?? 'root';
+            console.log(`  ${view.id}  (layer ${layer}, ${view.changes} change(s))`);
+        }
+        console.log('  Open the diagram in `likec4 serve` to review each layer.');
         return;
     }
     console.error(USAGE);

package/dist/core/model/boundary-model.d.ts

@@ -82,3 +82,18 @@ export declare function newlyExemptedImporters(base: BoundaryModel, head: Bounda
  * dependencies granted WITHOUT going through a proposal — i.e. self-approvals.
  */
 export declare function newlyAllowedEdges(base: BoundaryModel, head: BoundaryModel): AllowedEdge[];
+/**
+ * Modules present at `head` but not at `base`, keyed by id. A `#proposed` element
+ * stays a module (the marker is visual-only), so this reports both bare-added and
+ * already-proposed new boxes — the annotator makes marking idempotent.
+ */
+export declare function newlyAddedModules(base: BoundaryModel, head: BoundaryModel): Module[];
+/**
+ * The accepted state, written as a canonical string — the lock. `approve` records
+ * it so change detection has a baseline it OWNS, rather than trusting whatever git
+ * happens to hold. Deterministic: fields and lists are sorted, so the same model
+ * always serializes byte-for-byte the same.
+ */
+export declare function serializeModel(model: BoundaryModel): string;
+/** Read a lock back into a model. Inverse of {@link serializeModel}. */
+export declare function parseModel(text: string): BoundaryModel;

package/dist/core/model/boundary-model.js

@@ -34,3 +34,43 @@ export function newlyAllowedEdges(base, head) {
     const allowedAtBase = new Set(base.allowed.map(edgeKey));
     return head.allowed.filter((edge) => !allowedAtBase.has(edgeKey(edge)));
 }
+/**
+ * Modules present at `head` but not at `base`, keyed by id. A `#proposed` element
+ * stays a module (the marker is visual-only), so this reports both bare-added and
+ * already-proposed new boxes — the annotator makes marking idempotent.
+ */
+export function newlyAddedModules(base, head) {
+    const atBase = new Set(base.modules.map((m) => m.id));
+    return head.modules.filter((m) => !atBase.has(m.id));
+}
+/**
+ * The accepted state, written as a canonical string — the lock. `approve` records
+ * it so change detection has a baseline it OWNS, rather than trusting whatever git
+ * happens to hold. Deterministic: fields and lists are sorted, so the same model
+ * always serializes byte-for-byte the same.
+ */
+export function serializeModel(model) {
+    const canonical = {
+        modules: [...model.modules]
+            .sort((a, b) => a.id.localeCompare(b.id))
+            .map((m) => ({ id: m.id, title: m.title, path: m.path, kind: m.kind })),
+        allowed: [...model.allowed]
+            .sort((a, b) => edgeKey(a).localeCompare(edgeKey(b)))
+            .map((e) => ({ from: e.from, to: e.to })),
+        wildcards: [...model.wildcards].sort(),
+        exemptImporters: [...model.exemptImporters].sort(),
+        ...(model.governRoot ? { governRoot: model.governRoot } : {}),
+    };
+    return `${JSON.stringify(canonical, null, 2)}\n`;
+}
+/** Read a lock back into a model. Inverse of {@link serializeModel}. */
+export function parseModel(text) {
+    const raw = JSON.parse(text);
+    return {
+        modules: raw.modules ?? [],
+        allowed: raw.allowed ?? [],
+        wildcards: raw.wildcards ?? [],
+        exemptImporters: raw.exemptImporters ?? [],
+        governRoot: raw.governRoot,
+    };
+}

package/dist/core/pipeline/pipeline.d.ts

@@ -1,5 +1,10 @@
-import type { VisualizerPort, EnforcerPort, EnforcerConfig, CheckResult } from "../ports/ports.js";
-import type { AllowedEdge } from "../model/boundary-model.js";
+import type { VisualizerPort, EnforcerPort, EnforcerConfig, CheckResult, DiffView } from "../ports/ports.js";
+import type { AllowedEdge, Module } from "../model/boundary-model.js";
+/** What the annotator turned into explicit `#proposed` proposals. */
+export interface AnnotateResult {
+    edges: AllowedEdge[];
+    modules: Module[];
+}
 /**
  * What a diagram grants that the approved base did not. Both kinds of grant are
  * reported, because both let code cross a boundary that was previously closed.
@@ -32,6 +37,28 @@ export declare class Pipeline {
      * protocol.
      */
     verify(base: VisualizerPort): Promise<VerifyResult>;
-    /** Approve proposed edges: strip their `#proposed` markers from the diagram. */
-    approve(): Promise<void>;
+    /**
+     * Enact the diagram's pending proposals (strip `#proposed`, remove
+     * `#proposal-delete`), then return the resulting accepted model as a lock
+     * string. The caller persists it: that lock — written by approve, not inferred
+     * from git — is the baseline change detection compares against.
+     */
+    approve(): Promise<string>;
+    /**
+     * Compare the diagram against a previously accepted lock and rewrite every
+     * undeclared addition — a bare new edge (a self-grant) or box — into an
+     * explicit `#proposed` proposal in the source, then paints intrinsic styling on
+     * every marker so the proposal is highlighted on every LikeC4 surface. Turns
+     * silent drift into a reviewable, colourable proposal without trusting git for
+     * the baseline.
+     */
+    annotate(lock: string): Promise<AnnotateResult>;
+    /**
+     * (Re)generate a focused diff view per layer that holds a pending change, so a
+     * reviewer sees each proposal in the scope where it is actually drawn — a
+     * proposal nested in a box is invisible once that box collapses at a wider
+     * view. Reads the diagram's own `#proposed` / `#proposal-delete` markers, so it
+     * composes with `annotate` (annotate marks drift, this frames it).
+     */
+    diffViews(): Promise<DiffView[]>;
 }

package/dist/core/pipeline/pipeline.js

@@ -1,4 +1,4 @@
-import { newlyAllowedEdges, newlyExemptedImporters, } from "../model/boundary-model.js";
+import { newlyAddedModules, newlyAllowedEdges, newlyExemptedImporters, parseModel, serializeModel, } from "../model/boundary-model.js";
 /**
  * The SDK's public surface. Orchestrates the two driven ports and stays blind
  * to any concrete diagram source or linter — swap adapters, this is untouched.
@@ -33,8 +33,42 @@ export class Pipeline {
             exemptions: newlyExemptedImporters(baseModel, headModel),
         };
     }
-    /** Approve proposed edges: strip their `#proposed` markers from the diagram. */
+    /**
+     * Enact the diagram's pending proposals (strip `#proposed`, remove
+     * `#proposal-delete`), then return the resulting accepted model as a lock
+     * string. The caller persists it: that lock — written by approve, not inferred
+     * from git — is the baseline change detection compares against.
+     */
     async approve() {
-        return this.visualizer.approve();
+        await this.visualizer.approve();
+        const accepted = await this.visualizer.read();
+        return serializeModel(accepted);
+    }
+    /**
+     * Compare the diagram against a previously accepted lock and rewrite every
+     * undeclared addition — a bare new edge (a self-grant) or box — into an
+     * explicit `#proposed` proposal in the source, then paints intrinsic styling on
+     * every marker so the proposal is highlighted on every LikeC4 surface. Turns
+     * silent drift into a reviewable, colourable proposal without trusting git for
+     * the baseline.
+     */
+    async annotate(lock) {
+        const accepted = parseModel(lock);
+        const head = await this.visualizer.read();
+        const edges = newlyAllowedEdges(accepted, head);
+        const modules = newlyAddedModules(accepted, head);
+        await this.visualizer.propose(edges, modules.map((m) => m.id));
+        await this.visualizer.styleMarkers();
+        return { edges, modules };
+    }
+    /**
+     * (Re)generate a focused diff view per layer that holds a pending change, so a
+     * reviewer sees each proposal in the scope where it is actually drawn — a
+     * proposal nested in a box is invisible once that box collapses at a wider
+     * view. Reads the diagram's own `#proposed` / `#proposal-delete` markers, so it
+     * composes with `annotate` (annotate marks drift, this frames it).
+     */
+    async diffViews() {
+        return this.visualizer.emitDiffViews();
     }
 }

package/dist/core/ports/ports.d.ts

@@ -1,4 +1,4 @@
-import type { BoundaryModel } from '../model/boundary-model.js';
+import type { AllowedEdge, BoundaryModel } from '../model/boundary-model.js';
 /** A driven port: turns some diagram source into the boundary model. */
 export interface VisualizerPort {
     read(): Promise<BoundaryModel>;
@@ -7,6 +7,42 @@ export interface VisualizerPort {
      * promoting intent edges to approved. Source-preserving; never an LLM edit.
      */
     approve(): Promise<void>;
+    /**
+     * Deterministically mark the given edges and elements `#proposed` in the
+     * source. The inverse of `approve` for additions: it rewrites an undeclared
+     * change into an explicit, colourable proposal. Idempotent — anything already
+     * marked is left alone. Source-preserving; never an LLM edit.
+     */
+    propose(edges: AllowedEdge[], moduleIds: string[]): Promise<void>;
+    /**
+     * Paint intrinsic `style { color … }` on every edge/box carrying a marker, so a
+     * proposal is highlighted on every LikeC4 surface — base views and the
+     * relationships panel, not only the generated diff views. Amber for `#proposed`,
+     * red for `#proposal-delete`. Idempotent; `approve` strips it back out.
+     * Source-preserving; never an LLM edit.
+     */
+    styleMarkers(): Promise<void>;
+    /**
+     * (Re)generate a focused diff view for every layer that holds a pending
+     * change — an edge or box tagged `#proposed` or `#proposal-delete`. Each view
+     * is scoped to the tightest element that contains the change (the model root
+     * for a top-level one), because a proposal nested inside a box is invisible
+     * once that box collapses at a wider scope. A derived artifact: overwritten
+     * each run, and removed when nothing is proposed. Returns one entry per view.
+     */
+    emitDiffViews(): Promise<DiffView[]>;
+}
+/**
+ * One emitted diff view: a single layer (element scope) that holds at least one
+ * pending change, and how many changes fall in it.
+ */
+export interface DiffView {
+    /** The generated view id, e.g. `boundry_diff_root` or `boundry_diff_billing`. */
+    id: string;
+    /** The scope element's fqn, or undefined for the model root. */
+    scope?: string;
+    /** How many pending `#proposed` / `#proposal-delete` changes this layer holds. */
+    changes: number;
 }
 /** A generated linter config artifact. */
 export interface EnforcerConfig {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "boundry",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Compile a C4 architecture diagram into a deterministic dependency linter. Deterministic architectural guardrails for AI agents and humans.",
   "type": "module",
   "license": "MIT",
@@ -56,7 +56,7 @@
   },
   "dependencies": {
     "dependency-cruiser": "^16.4.0",
-    "likec4": "^1.46.0",
+    "likec4": "^1.58.0",
     "typescript": "^5.6.0"
   },
   "devDependencies": {