boundry 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -4,6 +4,76 @@ All notable changes to Boundry are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
 versioning follows [semver](https://semver.org/).
 
+## [0.6.0] — 2026-07-22
+
+### Changed
+
+- **`boundry diff` now emits a single "proposed changes" view by default** ([#8]),
+  instead of one view per changed layer. The per-layer shape (added in 0.4.0,
+  extended per-altitude in 0.5.0) had two failure modes on real changes: it
+  multiplied views (one multi-slice change produced ~21), and its per-layer
+  `include *` collapsed deeply-nested proposals into their grey ancestor box, so a
+  nested proposed leaf silently lost its amber. The new `boundry_diff` view uses
+  `include * -> * where tag is #proposed` with **no** bare `include *`, so it pulls
+  in exactly the proposed edges and the leaf modules they touch — every change is
+  drawn at leaf level, uncollapsed and uniformly coloured, on one landing. A
+  `#proposed` box with no edge yet is included by fqn so a proposed-but-unwired
+  module still shows, and every endpoint's ancestor chain is included so each
+  change nests under its layer/system for context. `approve` still deletes the
+  derived file (0.5.0 behaviour).
+  - The per-altitude per-layer views from 0.5.0 remain available behind
+    **`boundry diff --per-layer`** — useful for a small change, opt-in.
+
+[#8]: https://github.com/makspiechota/boundry/issues/8
+
+## [0.5.0] — 2026-07-21
+
+### Fixed
+
+- **`approve` no longer leaves a stale, corrupted `boundry.diff.likec4`** ([#6]).
+  `approve` used to walk the derived diff file along with the model and splice the
+  marker tokens out of its *view rules* (`style element.tag = #proposed …`,
+  `include … where tag is #proposed`), mangling them into invalid LikeC4 — so
+  `likec4 validate` (and any `arch:verify` gate) went red immediately after a
+  successful approve, recoverable only by a separate `diff` run. `approve` now
+  skips the derived file and deletes it as part of enacting: the moment the last
+  proposal is approved those views are stale — they frame changes that are now
+  approved — so the post-approve workspace is clean and validates.
+
+### Added
+
+- **Per-altitude diff views** ([#7]). `boundry diff` now emits a focused view for
+  *every* layer that draws a changed edge, not only the common-ancestor layer. A
+  cross-system dependency between two deeply-nested leaves is drawable at each
+  endpoint's system and container as well as at the shared root; `diff` emits one
+  `view … of <scope>` for each, so a reviewer can open the change at whatever
+  altitude matters — the whole system, a specific container — instead of being
+  dropped at the noisy root view. The scopes are derived from how LikeC4's
+  `include *` actually renders: the common ancestor plus each endpoint's ancestor
+  chain down to its parent, never *above* the common ancestor (where both
+  endpoints collapse into one child and the edge becomes an undrawn self-loop) and
+  never the leaf endpoints themselves. Boxes are unchanged — one view at the box's
+  parent layer.
+
+### Changed
+
+- **`verify` now compares against the accepted `boundry.lock`, not a git ref.**
+  The lock was introduced in 0.4.0 to decouple *approved* from *committed*, but
+  `verify --base <ref>` kept re-deriving its baseline from a diagram at a git ref
+  — quietly re-coupling "accepted" to "committed", the very thing the lock exists
+  to break. `verify` now reads the lock, exactly as `annotate` does, so the two
+  share one baseline and can never disagree about what "accepted" means. It also
+  catches a committed-but-*unapproved* bare edge, which the git-ref baseline
+  silently absorbed. The `--base` flag is gone from `verify` and `approve`;
+  `approve`'s anti-laundering pre-check now runs the same lock-based gate, and the
+  first `approve` (no lock yet) bootstraps the initial accepted state. **Tradeoff,
+  by design:** the baseline is the working-tree lock, so the gate leans on
+  `approve` being a human act — the lock moves only when someone approves, which
+  is why the skill forbids agents from running it.
+
+[#6]: https://github.com/makspiechota/boundry/issues/6
+[#7]: https://github.com/makspiechota/boundry/issues/7
+
 ## [0.4.0] — 2026-07-17
 
 Makes the "one file can be both the communication diagram and the enforcement

package/README.md

@@ -227,15 +227,21 @@ deterministically, by splicing the LikeC4 CST. No model call, no reformatting:
 source-preserving, idempotent, byte-exact.
 
 ```bash
-boundry verify --arch arch --base origin/main   # any edge granted without a marker?
-boundry approve --arch arch --base origin/main  # HUMAN ONLY: strip markers = approve
+boundry verify  --arch arch   # any edge granted without a marker, vs the lock?
+boundry approve --arch arch   # HUMAN ONLY: strip markers = approve, update the lock
 ```
 
-`verify` compares against the approved diagram at a git ref and rejects edges that
-appeared *without* going through a proposal. Because proposals are excluded from
-the allow-list, the newly-allowed set is exactly the set of self-approvals — no
-diff engine required. `approve --base` runs the same gate first, so it won't
-launder a self-granted edge into an approved one.
+`verify` compares the working diagram against the accepted **`boundry.lock`** and
+rejects edges that appeared *without* going through a proposal. Because proposals
+are excluded from the allow-list, the newly-allowed set is exactly the set of
+self-approvals — no diff engine required. `approve` runs the same gate first, so
+it won't launder a self-granted edge into an approved one; then it enacts the
+proposals and records the new accepted state to the lock.
+
+The baseline is the lock, not a git ref: it's the state Boundry *owns*, so
+"accepted" never collapses into merely "committed". (One consequence, by design:
+the gate leans on `approve` being a human act — the lock moves only when someone
+approves. That's why the skill forbids agents from running it.)
 
 **To retire an edge or a box, propose its removal** with `#proposal-delete`
 instead of deleting it. The marker colours it red; a pending deletion changes
@@ -258,12 +264,12 @@ Point your agents at
 [`.claude/skills/define-architecture-boundaries`](.claude/skills/define-architecture-boundaries/SKILL.md)
 and they'll follow this protocol.
 
-### Catching drift — the lock and `annotate` (prototype)
+### Catching drift — `annotate` (prototype)
 
-`verify --base` trusts git for the baseline, which conflates *approved* with
-*committed*. If you'd rather Boundry own that baseline: `approve` records the
-accepted model to **`boundry.lock`** beside the diagram, and `annotate` compares
-against it — no git ref required.
+`verify` catches a self-grant and fails; `annotate` is the other half — it
+*rewrites* the same drift into a reviewable proposal. Both read the same baseline,
+the accepted **`boundry.lock`** that `approve` records beside the diagram, so they
+can never disagree about what "accepted" means.
 
 ```bash
 boundry approve  --arch arch          # enact proposals AND write boundry.lock
@@ -287,31 +293,43 @@ this styling back out with the marker: a `#proposed` edge returns to bare, a
 `#proposed` box stays but loses its colour, a `#proposal-delete` is removed
 outright. Requires **LikeC4 ≥ 1.58** to render.
 
-### Reviewing a proposal — per-layer diff views (prototype)
+### Reviewing a proposal — the diff view (prototype)
 
-A proposal nested inside a box is invisible at a wider zoom: at the top level the
-box collapses and its inner `#proposed` edge disappears. So `diff` generates a
-**focused view for every layer that holds a pending change** — the tightest scope
-that actually draws it — into a derived `boundry.diff.likec4`:
+`diff` generates a single **proposed-changes** view — every pending change on one
+landing — into a derived `boundry.diff.likec4`:
 
 ```bash
 boundry diff --arch arch              # (re)write boundry.diff.likec4
-likec4 serve arch                     # review each layer, changes coloured
+likec4 serve arch                     # open 'Boundry diff — proposed changes'
 ```
 
 The highlighting is **generated, not hand-styled** — `diff` emits the LikeC4
-style rules into the derived file, so every `#proposed` box fills amber and edge
-goes amber + solid, every `#proposal-delete` red, deterministically. That closes
-the last manual seam: `annotate` marks, `diff` colours, no agent-dependent
-styling step. Boxes are styled *in place* (never force-included), so a nested
-proposal stays in its own layer; unchanged elements keep their defaults; and the
-rules live only in the generated views, so your own views are untouched.
+rules into the derived file, so every `#proposed` box fills amber and edge goes
+amber + solid, every `#proposal-delete` red, deterministically. That closes the
+last manual seam: `annotate` marks, `diff` colours, no agent-dependent styling
+step. Unchanged elements keep their defaults, and the rules live only in the
+generated view, so your own views are untouched.
+
+The view uses `include * -> * where tag is #proposed` (no bare `include *`), so it
+pulls in exactly the proposed edges and the leaf modules they touch — a
+deeply-nested proposal renders as its **own coloured node** instead of collapsing
+into a grey ancestor. A proposed *module* with no edge yet is included too, so a
+proposed-but-unwired box still shows. Each change nests under its layer/system for
+context.
+
+For a small change you can ask for the old per-layer shape instead — one focused
+`view … of <scope>` for every layer that draws a change:
+
+```bash
+boundry diff --arch arch --per-layer
+```
 
 The file is a **derived artifact**: overwritten every run, removed when nothing is
-proposed, so it always matches the current diagram — regenerate it after
-`approve`. It reads the diagram's own markers (not the lock), so it frames
-whatever `annotate` or a human has marked. Being derived, it's a `.gitignore`
-candidate (`boundry.diff.likec4`).
+proposed, so it always matches the current diagram. `approve` deletes it too, as
+part of enacting — the moment the last proposal is approved the view is stale, so
+the post-approve workspace validates clean. It reads the diagram's own markers
+(not the lock), so it frames whatever `annotate` or a human has marked. Being
+derived, it's a `.gitignore` candidate (`boundry.diff.likec4`).
 
 > Rendering the coloured diff views needs **LikeC4 ≥ 1.58** (the style-rule syntax
 > Boundry emits). Boundry itself depends on that floor; the tool you review with
@@ -322,10 +340,10 @@ candidate (`boundry.diff.likec4`).
 ```
 boundry check    [--arch <dir>] [--cwd <dir>] [sources...]
 boundry generate [--arch <dir>] [--cwd <dir>] [--out <file>]
-boundry verify   [--arch <dir>] [--cwd <dir>] --base <git-ref>
-boundry approve  [--arch <dir>] [--cwd <dir>] [--base <git-ref>]
+boundry verify   [--arch <dir>] [--cwd <dir>]
+boundry approve  [--arch <dir>] [--cwd <dir>]
 boundry annotate [--arch <dir>]
-boundry diff     [--arch <dir>]
+boundry diff     [--arch <dir>] [--per-layer]
 ```
 
 | Flag | Meaning |
@@ -333,19 +351,22 @@ boundry diff     [--arch <dir>]
 | `--arch <dir>` | LikeC4 workspace directory (all `.likec4` files in it are merged). Default `.`. |
 | `--cwd <dir>` | Repo root to check. `folder` paths are relative to it. Lets you run from anywhere. |
 | `--out <file>` | `generate` only: where to write the dependency-cruiser config. Default `.dependency-cruiser.cjs`. |
-| `--base <ref>` | `verify`/`approve`: the git ref holding the approved diagram to compare against. |
+| `--per-layer` | `diff` only: emit one focused view per layer instead of the single proposed-changes view. |
 | `sources...` | `check` only: paths to lint. Default `src`. |
 
 - **`check`** compiles the rules and runs the linter. Exits non-zero on any violation.
 - **`generate`** just emits the dependency-cruiser config so you can commit it or
   run `depcruise` yourself.
-- **`verify`** rejects dependencies granted without a proposal.
-- **`approve`** enacts markers (strips `#proposed`, removes `#proposal-delete`) and
-  writes `boundry.lock`. For humans, not agents.
+- **`verify`** rejects dependencies granted without a proposal, comparing the
+  diagram against the accepted `boundry.lock`. Needs a lock — run `approve` once
+  to record one.
+- **`approve`** runs the same gate, then enacts markers (strips `#proposed`,
+  removes `#proposal-delete`) and writes `boundry.lock`. For humans, not agents.
 - **`annotate`** rewrites undeclared additions as `#proposed`, diffing against
   `boundry.lock`.
-- **`diff`** generates a focused, colour-coded review view per layer that holds a
-  pending change, into a derived `boundry.diff.likec4`.
+- **`diff`** generates a single colour-coded "proposed changes" review view into a
+  derived `boundry.diff.likec4` (or, with `--per-layer`, one focused view per layer
+  that draws a change).
 
 Boundry warns (but does not fail) when a mapped folder matches **zero** files, and
 **fails outright** when a check analysed no files at all — so a passing check can
@@ -366,9 +387,8 @@ jobs:
         with: { node-version: 20 }
       - run: npm ci
       - run: npx boundry check --arch arch src
-      # On PRs, also reject dependencies granted without a proposal.
-      - run: npx boundry verify --arch arch --base origin/${{ github.base_ref }}
-        if: github.event_name == 'pull_request'
+      # Reject any dependency granted without a proposal, vs the committed lock.
+      - run: npx boundry verify --arch arch
 ```
 
 ## Programmatic use (SDK)

package/dist/adapters/visualizer/likec4.d.ts

@@ -18,6 +18,13 @@ export declare class LikeC4Visualizer implements VisualizerPort {
      *   - `#proposal-delete` markers take their whole edge or box with them, so
      *     approving a proposed removal actually removes it.
      * All other formatting is left intact.
+     *
+     * The derived `boundry.diff.likec4` is skipped, not approved: it holds no real
+     * markers, only view rules that *reference* the marker tags (`style element.tag
+     * = #proposed`, `include … where tag is #proposed`). Splicing those `#proposed`
+     * tokens out would corrupt the rules into invalid LikeC4. And it is stale the
+     * moment the last proposal is enacted — it describes changes that are now
+     * approved — so approve deletes it, leaving a workspace `likec4 validate` accepts.
      */
     approve(): Promise<void>;
     /**
@@ -39,12 +46,26 @@ export declare class LikeC4Visualizer implements VisualizerPort {
      */
     styleMarkers(): Promise<void>;
     /**
-     * Generate a focused diff view for every layer that holds a pending change.
-     * Walks the diagram's own `#proposed` / `#proposal-delete` markers (never the
-     * lock — a `#proposal-delete` has no lock delta), buckets each change into the
-     * tightest scope that draws it, and writes one `view … of <scope>` per bucket
-     * to a derived `boundry.diff.likec4`. The file is overwritten each run and
-     * removed when nothing is proposed, so it always reflects the current diagram.
+     * Generate the review views for the diagram's pending changes, into a derived
+     * `boundry.diff.likec4`. Walks the diagram's own `#proposed` / `#proposal-delete`
+     * markers (never the lock — a `#proposal-delete` has no lock delta).
+     *
+     * By default it emits a **single `boundry_diff` view** that draws every change at
+     * once, uncollapsed and uniformly highlighted (see `renderSingleView`) — the diff
+     * landing. With `perLayer`, it instead emits one focused `view … of <scope>` for
+     * every layer that draws a change (a box in its parent layer; an edge in every
+     * layer that draws it, per `edgeScopes`) — useful for a small change, but it
+     * multiplies views and collapses deeply-nested proposals into grey ancestors on
+     * a broad `include *`, which is why the single view is the default (issue #8).
+     *
+     * The file is overwritten each run and removed when nothing is proposed, so it
+     * always reflects the current diagram.
      */
-    emitDiffViews(): Promise<DiffView[]>;
+    emitDiffViews(perLayer?: boolean): Promise<DiffView[]>;
+    /**
+     * The `--per-layer` shape: buckets each change into every layer that draws it and
+     * renders one scoped `view … of <scope>` per layer. Kept as an opt-in to the
+     * single-view default.
+     */
+    private perLayerViews;
 }

package/dist/adapters/visualizer/likec4.js

@@ -28,6 +28,46 @@ function parentScope(fqn) {
     parts.pop();
     return parts.length ? parts.join('.') : undefined;
 }
+/**
+ * Every layer that actually *draws* the edge `from -> to`, so a reviewer can open
+ * the change at whatever altitude matters — the whole system, a specific
+ * container, or the endpoint's immediate parent — not only the auto-picked common
+ * ancestor (issue #7). The set is derived from how LikeC4's `include *` renders a
+ * scoped view, verified against 1.58:
+ *
+ *   - The tightest common ancestor draws it nested (both endpoints inside).
+ *   - Every proper ancestor of an endpoint *below* that common ancestor draws it
+ *     too: that side's subtree is expanded and the far endpoint is pulled in as a
+ *     boundary node (e.g. `of s1` → `s1.c1 -> s2`).
+ *   - Ancestors *above* the common ancestor are deliberately excluded: both
+ *     endpoints collapse into the same child there, so the edge becomes a
+ *     self-loop and LikeC4 draws nothing. The common ancestor is the widest layer
+ *     that still draws it.
+ *
+ * So the scopes are the common ancestor plus each endpoint's ancestor chain from
+ * just below it down to the endpoint's parent — never the endpoints themselves
+ * (a view scoped *to* a leaf endpoint has an empty subtree).
+ */
+function edgeScopes(from, to) {
+    const common = commonScope(from, to);
+    const depthOf = (scope) => (scope ? scope.split('.').length : 0);
+    const commonDepth = depthOf(common);
+    const byId = new Map();
+    const add = (scope) => {
+        byId.set(scopeViewId(scope), scope);
+    };
+    add(common);
+    for (const endpoint of [from, to]) {
+        const parts = endpoint.split('.');
+        // Proper ancestors of the endpoint strictly below the common ancestor: prefix
+        // lengths (commonDepth + 1) .. (parts.length - 1). The last is the endpoint's
+        // parent; the endpoint itself (full length) is never a scope.
+        for (let len = commonDepth + 1; len <= parts.length - 1; len++) {
+            add(parts.slice(0, len).join('.'));
+        }
+    }
+    return [...byId.values()];
+}
 /**
  * Deterministic highlight rules for the marker tags actually in use. Referencing
  * an undeclared tag is a hard LikeC4 error, and a tag can only be *used* if it is
@@ -64,6 +104,61 @@ function renderDiffView(scope, highlight) {
     const lines = [`    title 'Boundry diff · ${scope ?? 'root'}'`, '    include *', ...highlight];
     return `${opener}\n${lines.join('\n')}\n  }`;
 }
+/** Every proper ancestor of an element, shallowest first — its parent chain up to (not including) the root. */
+function ancestorFqns(fqn) {
+    const parts = fqn.split('.');
+    const out = [];
+    for (let len = 1; len <= parts.length - 1; len++)
+        out.push(parts.slice(0, len).join('.'));
+    return out;
+}
+/**
+ * The single `boundry_diff` view: one landing that draws *every* pending change at
+ * once, with uniform highlighting and no empty views. It sidesteps the per-layer
+ * shape's two failure modes (issue #8):
+ *
+ *   - **No collapse.** `include * -> * where tag is #proposed` (with NO bare
+ *     `include *`) pulls in exactly the proposed edges and the leaf modules they
+ *     touch — so a deeply-nested proposed leaf renders as its own amber node
+ *     instead of collapsing into a grey ancestor, as it does under `include *`.
+ *   - **Standalone boxes.** A `#proposed` box with no edge is included by fqn, so
+ *     a proposed-but-unwired module still shows (and is coloured by the style rule).
+ *
+ * Every endpoint's and box's full ancestor chain is included too, so each change
+ * nests under its layer/system for context (verified against LikeC4 1.58). Rules
+ * are emitted only for marker tags actually in use — referencing an undeclared tag
+ * is a hard LikeC4 error.
+ */
+function renderSingleView(edges, boxes, usedTags) {
+    const lines = [`    title 'Boundry diff — proposed changes'`];
+    // Edge includes: one per marker that appears on an edge. These pull the proposed
+    // edges and their endpoint leaves in at leaf level, uncollapsed.
+    if (edges.some((e) => e.marker === '#proposed')) {
+        lines.push('    include * -> * where tag is #proposed with { color amber; line solid }');
+    }
+    if (edges.some((e) => e.marker === '#proposal-delete')) {
+        lines.push('    include * -> * where tag is #proposal-delete with { color red; line solid }');
+    }
+    // Element includes: the proposed/proposal-delete boxes themselves (so a standalone
+    // one shows), plus the full ancestor chain of every endpoint and box (so each
+    // change nests under its containers). Deterministic: sorted, de-duplicated.
+    const includeFqns = new Set();
+    for (const box of boxes)
+        includeFqns.add(box.fqn);
+    const anchors = [...edges.flatMap((e) => [e.from, e.to]), ...boxes.map((b) => b.fqn)];
+    for (const fqn of anchors)
+        for (const ancestor of ancestorFqns(fqn))
+            includeFqns.add(ancestor);
+    if (includeFqns.size) {
+        lines.push(`    include ${[...includeFqns].sort().join(', ')}`);
+    }
+    // Style rules colour the tagged boxes (edges are coloured by their include above).
+    if (usedTags.has('proposed'))
+        lines.push('    style element.tag = #proposed { color amber }');
+    if (usedTags.has('proposal-delete'))
+        lines.push('    style element.tag = #proposal-delete { color red }');
+    return `  view boundry_diff {\n${lines.join('\n')}\n  }`;
+}
 /**
  * An exemption pattern has to be a usable regex before it reaches the linter. A
  * broken or empty one would otherwise be a silent hole: it exempts files from
@@ -393,11 +488,20 @@ export class LikeC4Visualizer {
      *   - `#proposal-delete` markers take their whole edge or box with them, so
      *     approving a proposed removal actually removes it.
      * All other formatting is left intact.
+     *
+     * The derived `boundry.diff.likec4` is skipped, not approved: it holds no real
+     * markers, only view rules that *reference* the marker tags (`style element.tag
+     * = #proposed`, `include … where tag is #proposed`). Splicing those `#proposed`
+     * tokens out would corrupt the rules into invalid LikeC4. And it is stale the
+     * moment the last proposal is enacted — it describes changes that are now
+     * approved — so approve deletes it, leaving a workspace `likec4 validate` accepts.
      */
     async approve() {
         const likec4 = await LikeC4.fromWorkspace(this.workspaceDir);
         for (const doc of likec4.LangiumDocuments.all) {
             const filePath = doc.uri.fsPath;
+            if (filePath.endsWith(DIFF_FILE))
+                continue;
             const text = doc.textDocument?.getText?.() ?? readFileSync(filePath, 'utf8');
             const ranges = collectApprovalRanges(doc.parseResult?.value, text);
             if (ranges.length === 0)
@@ -408,6 +512,12 @@ export class LikeC4Visualizer {
             }
             writeFileSync(filePath, next);
         }
+        // Enacting the last proposal makes any diff views stale — they frame changes
+        // that are now approved. Remove the derived artifact so the post-approve
+        // workspace validates and never renders an approved-away change.
+        const diffPath = join(this.workspaceDir, DIFF_FILE);
+        if (existsSync(diffPath))
+            rmSync(diffPath);
     }
     /**
      * Deterministically mark the given edges and elements `#proposed`. The inverse
@@ -527,26 +637,28 @@ export class LikeC4Visualizer {
         }
     }
     /**
-     * Generate a focused diff view for every layer that holds a pending change.
-     * Walks the diagram's own `#proposed` / `#proposal-delete` markers (never the
-     * lock — a `#proposal-delete` has no lock delta), buckets each change into the
-     * tightest scope that draws it, and writes one `view … of <scope>` per bucket
-     * to a derived `boundry.diff.likec4`. The file is overwritten each run and
-     * removed when nothing is proposed, so it always reflects the current diagram.
+     * Generate the review views for the diagram's pending changes, into a derived
+     * `boundry.diff.likec4`. Walks the diagram's own `#proposed` / `#proposal-delete`
+     * markers (never the lock — a `#proposal-delete` has no lock delta).
+     *
+     * By default it emits a **single `boundry_diff` view** that draws every change at
+     * once, uncollapsed and uniformly highlighted (see `renderSingleView`) — the diff
+     * landing. With `perLayer`, it instead emits one focused `view … of <scope>` for
+     * every layer that draws a change (a box in its parent layer; an edge in every
+     * layer that draws it, per `edgeScopes`) — useful for a small change, but it
+     * multiplies views and collapses deeply-nested proposals into grey ancestors on
+     * a broad `include *`, which is why the single view is the default (issue #8).
+     *
+     * The file is overwritten each run and removed when nothing is proposed, so it
+     * always reflects the current diagram.
      */
-    async emitDiffViews() {
+    async emitDiffViews(perLayer = false) {
         const likec4 = await LikeC4.fromWorkspace(this.workspaceDir);
-        // scopeViewId -> { scope, changes } — deterministic key, so the same diagram
-        // always yields the same set of views.
-        const layers = new Map();
-        const record = (scope) => {
-            const key = scopeViewId(scope);
-            const layer = layers.get(key) ?? { scope, changes: 0 };
-            layer.changes += 1;
-            layers.set(key, layer);
-        };
-        // Which marker tags actually appear — so the emitted highlight rules only ever
-        // reference declared tags (an undeclared tag reference is a hard LikeC4 error).
+        // Lift every marked edge and box once; both view shapes are built from this.
+        const edges = [];
+        const boxes = [];
+        // Which marker tags actually appear — so the emitted rules only ever reference
+        // declared tags (an undeclared tag reference is a hard LikeC4 error).
         const usedTags = new Set();
         for (const doc of likec4.LangiumDocuments.all) {
             const filePath = doc.uri.fsPath;
@@ -563,23 +675,53 @@ export class LikeC4Visualizer {
                     const from = fqnOf(endpointElement(statement.source));
                     const to = fqnOf(endpointElement(statement.target));
                     if (from && to)
-                        record(commonScope(from, to));
+                        edges.push({ from, to, marker });
                 }
                 else if (statement?.$type === 'Element') {
                     const fqn = fqnOf(statement);
                     if (fqn)
-                        record(parentScope(fqn));
+                        boxes.push({ fqn, marker });
                 }
             });
         }
         const diffPath = join(this.workspaceDir, DIFF_FILE);
-        if (layers.size === 0) {
+        if (edges.length === 0 && boxes.length === 0) {
             // Nothing proposed — clear any stale views so `serve` never renders a diff
             // that no longer exists (and never dangles a reference to an approved-away box).
             if (existsSync(diffPath))
                 rmSync(diffPath);
             return [];
         }
+        const { header, body, views } = perLayer
+            ? this.perLayerViews(edges, boxes, usedTags)
+            : {
+                header: 'a single landing view of every pending change',
+                body: renderSingleView(edges, boxes, usedTags),
+                views: [{ id: 'boundry_diff', changes: edges.length + boxes.length }],
+            };
+        writeFileSync(diffPath, `// Generated by \`boundry diff\` — ${header}.\n` +
+            `// Derived artifact: regenerate after approve; do not hand-edit.\n` +
+            `views {\n${body}\n}\n`);
+        return views;
+    }
+    /**
+     * The `--per-layer` shape: buckets each change into every layer that draws it and
+     * renders one scoped `view … of <scope>` per layer. Kept as an opt-in to the
+     * single-view default.
+     */
+    perLayerViews(edges, boxes, usedTags) {
+        const layers = new Map();
+        const record = (scope) => {
+            const key = scopeViewId(scope);
+            const layer = layers.get(key) ?? { scope, changes: 0 };
+            layer.changes += 1;
+            layers.set(key, layer);
+        };
+        for (const edge of edges)
+            for (const scope of edgeScopes(edge.from, edge.to))
+                record(scope);
+        for (const box of boxes)
+            record(parentScope(box.fqn));
         // Root first, then by fqn, so the output is stable across runs.
         const ordered = [...layers.values()].sort((a, b) => {
             if (!a.scope)
@@ -589,14 +731,14 @@ export class LikeC4Visualizer {
             return a.scope.localeCompare(b.scope);
         });
         const highlight = highlightLines(usedTags);
-        const body = ordered.map((layer) => renderDiffView(layer.scope, highlight)).join('\n');
-        writeFileSync(diffPath, `// Generated by \`boundry diff\` — one focused view per layer with a pending\n` +
-            `// change. Derived artifact: regenerate after approve; do not hand-edit.\n` +
-            `views {\n${body}\n}\n`);
-        return ordered.map((layer) => ({
-            id: scopeViewId(layer.scope),
-            scope: layer.scope,
-            changes: layer.changes,
-        }));
+        return {
+            header: 'one focused view per layer with a pending change',
+            body: ordered.map((layer) => renderDiffView(layer.scope, highlight)).join('\n'),
+            views: ordered.map((layer) => ({
+                id: scopeViewId(layer.scope),
+                scope: layer.scope,
+                changes: layer.changes,
+            })),
+        };
     }
 }

package/dist/cli/index.js

@@ -1,12 +1,10 @@
 #!/usr/bin/env node
-import { execFileSync } from 'node:child_process';
-import { existsSync, mkdtempSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join, relative, resolve } from 'node:path';
 import { Pipeline } from '../core/pipeline/pipeline.js';
 import { LikeC4Visualizer } from '../adapters/visualizer/likec4.js';
 import { DepCruiserEnforcer } from '../adapters/enforcer/depcruiser.js';
-const USAGE = 'usage: boundry <generate|check|approve|verify|annotate|diff> [--arch <dir>] [--base <git-ref>] [--cwd <dir>] [--out <file>] [sources...]';
+const USAGE = 'usage: boundry <generate|check|approve|verify|annotate|diff> [--arch <dir>] [--cwd <dir>] [--out <file>] [--per-layer] [sources...]';
 function optValue(args, flag) {
     const i = args.indexOf(flag);
     return i >= 0 ? args[i + 1] : undefined;
@@ -22,30 +20,6 @@ function positionals(args) {
     }
     return out;
 }
-/**
- * Materialize the architecture as of a git ref into a temp workspace, so the
- * previously-approved boundary model can be lifted and compared against HEAD.
- */
-function materializeArchAt(archDir, ref) {
-    const gitRoot = execFileSync('git', ['rev-parse', '--show-toplevel'], {
-        cwd: archDir,
-        encoding: 'utf8',
-    }).trim();
-    const workDir = mkdtempSync(join(tmpdir(), 'boundry-base-'));
-    for (const file of readdirSync(archDir).filter((f) => f.endsWith('.likec4'))) {
-        try {
-            const content = execFileSync('git', ['show', `${ref}:${relative(gitRoot, join(archDir, file))}`], {
-                cwd: gitRoot,
-                encoding: 'utf8',
-            });
-            writeFileSync(join(workDir, file), content);
-        }
-        catch {
-            // The file did not exist at `ref` — everything it declares is new.
-        }
-    }
-    return workDir;
-}
 function countGrants(granted) {
     return granted.edges.length + granted.exemptions.length;
 }
@@ -69,17 +43,17 @@ async function main() {
     const archDir = resolve(optValue(rest, '--arch') ?? '.');
     const outArg = optValue(rest, '--out');
     const outFile = outArg ? resolve(outArg) : undefined;
-    const baseRef = optValue(rest, '--base');
     // `--cwd` lets you check a repo without cd-ing into it. `folder` metadata is
     // relative to the target repo root, so the enforcer runs from there.
     const cwd = optValue(rest, '--cwd');
     if (cwd)
         process.chdir(resolve(cwd));
     // The accepted-state lock lives beside the diagram it locks. `approve` writes
-    // it; `annotate` reads it — the baseline Boundry owns, not one inferred from git.
+    // it; `verify` and `annotate` read it — the baseline Boundry owns, decoupled
+    // from git, so "accepted" never means merely "committed".
     const lockFile = join(archDir, 'boundry.lock');
+    const readLock = () => existsSync(lockFile) ? readFileSync(lockFile, 'utf8') : undefined;
     const pipeline = new Pipeline(new LikeC4Visualizer(archDir), new DepCruiserEnforcer());
-    const grantedSince = (ref) => pipeline.verify(new LikeC4Visualizer(materializeArchAt(archDir, ref)));
     if (command === 'generate') {
         const config = await pipeline.generate();
         const out = outFile ?? resolve(config.filename);
@@ -105,37 +79,43 @@ async function main() {
         return;
     }
     if (command === 'verify') {
-        if (!baseRef) {
-            console.error('Boundry: verify requires --base <git-ref>');
+        const lock = readLock();
+        if (!lock) {
+            console.error(`Boundry: no ${relative(process.cwd(), lockFile)} — run 'boundry approve' first to record the accepted state`);
             process.exitCode = 2;
             return;
         }
-        const granted = await grantedSince(baseRef);
+        const granted = await pipeline.verify(lock);
         if (countGrants(granted) === 0) {
-            console.log(`Boundry: ✓ nothing granted without a #proposed marker (vs ${baseRef})`);
+            console.log('Boundry: ✓ nothing granted without a #proposed marker (vs the accepted lock)');
             return;
         }
-        console.error(`Boundry: ✗ ${countGrants(granted)} grant(s) made without a #proposed marker (vs ${baseRef})`);
+        console.error(`Boundry: ✗ ${countGrants(granted)} grant(s) made without a #proposed marker (vs the accepted lock)`);
         listGrants(granted);
         process.exitCode = 1;
         return;
     }
     if (command === 'approve') {
         // Approving must never launder an edge that skipped the proposal protocol.
-        if (baseRef) {
-            const granted = await grantedSince(baseRef);
+        // The accepted lock is the baseline: a bare edge added since the last approve
+        // is in the allow-list but not the lock, so it surfaces here; a #proposed one
+        // is excluded from the allow-list, so it passes and gets enacted below. The
+        // first approve has no lock yet — it establishes the initial accepted state.
+        const lock = readLock();
+        if (lock) {
+            const granted = await pipeline.verify(lock);
             if (countGrants(granted) > 0) {
-                console.error(`Boundry: ✗ refusing to approve — ${countGrants(granted)} grant(s) were made without a #proposed marker (vs ${baseRef})`);
+                console.error(`Boundry: ✗ refusing to approve — ${countGrants(granted)} grant(s) were made without a #proposed marker (vs the accepted lock)`);
                 listGrants(granted);
                 process.exitCode = 1;
                 return;
             }
         }
         else {
-            console.error('Boundry: ⚠ no --base given — approving without verifying that every new edge was proposed');
+            console.error('Boundry: ⚠ no boundry.lock yet — approving to record the initial accepted state');
         }
-        const lock = await pipeline.approve();
-        writeFileSync(lockFile, lock);
+        const nextLock = await pipeline.approve();
+        writeFileSync(lockFile, nextLock);
         console.log('Boundry: ✓ approved — enacted the diagram and wrote', relative(process.cwd(), lockFile));
         return;
     }
@@ -159,7 +139,8 @@ async function main() {
         return;
     }
     if (command === 'diff') {
-        const views = await pipeline.diffViews();
+        const perLayer = rest.includes('--per-layer');
+        const views = await pipeline.diffViews(perLayer);
         const diffFile = join(archDir, 'boundry.diff.likec4');
         if (views.length === 0) {
             console.log('Boundry: ✓ nothing proposed — no diff views to draw');
@@ -167,10 +148,10 @@ async function main() {
         }
         console.log(`Boundry: ✎ wrote ${views.length} diff view(s) to ${relative(process.cwd(), diffFile)}:`);
         for (const view of views) {
-            const layer = view.scope ?? 'root';
-            console.log(`  ${view.id}  (layer ${layer}, ${view.changes} change(s))`);
+            const where = perLayer ? `layer ${view.scope ?? 'root'}, ` : '';
+            console.log(`  ${view.id}  (${where}${view.changes} change(s))`);
         }
-        console.log('  Open the diagram in `likec4 serve` to review each layer.');
+        console.log('  Open the diagram in `likec4 serve` to review.');
         return;
     }
     console.error(USAGE);

package/dist/core/pipeline/pipeline.d.ts

@@ -31,12 +31,18 @@ export declare class Pipeline {
     /** Diagram -> boundary model -> run the linter over `sources`. */
     check(sources: string[]): Promise<CheckResult>;
     /**
-     * What this diagram grants that `base` did not — dependencies added without a
-     * `#proposed` marker, and importer exemptions added. Proposals are excluded
-     * from the allow-list, so anything reported here bypassed the approval
-     * protocol.
+     * What this diagram grants that the accepted `lock` did not — dependencies
+     * added without a `#proposed` marker, and importer exemptions added. Proposals
+     * are excluded from the allow-list, so anything reported here bypassed the
+     * approval protocol.
+     *
+     * The baseline is the lock — the accepted state `approve` records — not a git
+     * ref. The lock exists precisely to decouple "accepted" from "committed", so
+     * verify reads from it, exactly as `annotate` does; the two can never disagree
+     * about what "accepted" means. It also catches a committed-but-unapproved bare
+     * edge, which re-deriving a baseline from a git ref would silently absorb.
      */
-    verify(base: VisualizerPort): Promise<VerifyResult>;
+    verify(lock: string): Promise<VerifyResult>;
     /**
      * Enact the diagram's pending proposals (strip `#proposed`, remove
      * `#proposal-delete`), then return the resulting accepted model as a lock
@@ -54,11 +60,11 @@ export declare class Pipeline {
      */
     annotate(lock: string): Promise<AnnotateResult>;
     /**
-     * (Re)generate a focused diff view per layer that holds a pending change, so a
-     * reviewer sees each proposal in the scope where it is actually drawn — a
-     * proposal nested in a box is invisible once that box collapses at a wider
-     * view. Reads the diagram's own `#proposed` / `#proposal-delete` markers, so it
-     * composes with `annotate` (annotate marks drift, this frames it).
+     * (Re)generate the review views for the diagram's pending changes. By default a
+     * single `boundry_diff` landing view draws every `#proposed` / `#proposal-delete`
+     * change at once; with `perLayer`, one focused view per layer that draws a change.
+     * Reads the diagram's own markers, so it composes with `annotate` (annotate marks
+     * drift, this frames it).
      */
-    diffViews(): Promise<DiffView[]>;
+    diffViews(perLayer?: boolean): Promise<DiffView[]>;
 }

package/dist/core/pipeline/pipeline.js

@@ -21,16 +21,23 @@ export class Pipeline {
         return this.enforcer.check(model, sources);
     }
     /**
-     * What this diagram grants that `base` did not — dependencies added without a
-     * `#proposed` marker, and importer exemptions added. Proposals are excluded
-     * from the allow-list, so anything reported here bypassed the approval
-     * protocol.
+     * What this diagram grants that the accepted `lock` did not — dependencies
+     * added without a `#proposed` marker, and importer exemptions added. Proposals
+     * are excluded from the allow-list, so anything reported here bypassed the
+     * approval protocol.
+     *
+     * The baseline is the lock — the accepted state `approve` records — not a git
+     * ref. The lock exists precisely to decouple "accepted" from "committed", so
+     * verify reads from it, exactly as `annotate` does; the two can never disagree
+     * about what "accepted" means. It also catches a committed-but-unapproved bare
+     * edge, which re-deriving a baseline from a git ref would silently absorb.
      */
-    async verify(base) {
-        const [baseModel, headModel] = await Promise.all([base.read(), this.visualizer.read()]);
+    async verify(lock) {
+        const base = parseModel(lock);
+        const head = await this.visualizer.read();
         return {
-            edges: newlyAllowedEdges(baseModel, headModel),
-            exemptions: newlyExemptedImporters(baseModel, headModel),
+            edges: newlyAllowedEdges(base, head),
+            exemptions: newlyExemptedImporters(base, head),
         };
     }
     /**
@@ -62,13 +69,13 @@ export class Pipeline {
         return { edges, modules };
     }
     /**
-     * (Re)generate a focused diff view per layer that holds a pending change, so a
-     * reviewer sees each proposal in the scope where it is actually drawn — a
-     * proposal nested in a box is invisible once that box collapses at a wider
-     * view. Reads the diagram's own `#proposed` / `#proposal-delete` markers, so it
-     * composes with `annotate` (annotate marks drift, this frames it).
+     * (Re)generate the review views for the diagram's pending changes. By default a
+     * single `boundry_diff` landing view draws every `#proposed` / `#proposal-delete`
+     * change at once; with `perLayer`, one focused view per layer that draws a change.
+     * Reads the diagram's own markers, so it composes with `annotate` (annotate marks
+     * drift, this frames it).
      */
-    async diffViews() {
-        return this.visualizer.emitDiffViews();
+    async diffViews(perLayer = false) {
+        return this.visualizer.emitDiffViews(perLayer);
     }
 }

package/dist/core/ports/ports.d.ts

@@ -23,25 +23,26 @@ export interface VisualizerPort {
      */
     styleMarkers(): Promise<void>;
     /**
-     * (Re)generate a focused diff view for every layer that holds a pending
-     * change — an edge or box tagged `#proposed` or `#proposal-delete`. Each view
-     * is scoped to the tightest element that contains the change (the model root
-     * for a top-level one), because a proposal nested inside a box is invisible
-     * once that box collapses at a wider scope. A derived artifact: overwritten
+     * (Re)generate the review views for the diagram's pending changes — edges and
+     * boxes tagged `#proposed` or `#proposal-delete`. By default a single
+     * `boundry_diff` landing view draws every change at once, uncollapsed and
+     * uniformly highlighted. With `perLayer`, one focused `view … of <scope>` is
+     * emitted per layer that draws a change instead. A derived artifact: overwritten
      * each run, and removed when nothing is proposed. Returns one entry per view.
      */
-    emitDiffViews(): Promise<DiffView[]>;
+    emitDiffViews(perLayer?: boolean): Promise<DiffView[]>;
 }
 /**
- * One emitted diff view: a single layer (element scope) that holds at least one
- * pending change, and how many changes fall in it.
+ * One emitted diff view. For the default single view there is one entry
+ * (`boundry_diff`) counting every pending change; in `perLayer` mode there is one
+ * per layer, each scoped to an element and counting the changes that fall in it.
  */
 export interface DiffView {
-    /** The generated view id, e.g. `boundry_diff_root` or `boundry_diff_billing`. */
+    /** The generated view id — `boundry_diff`, or `boundry_diff_<scope>` per layer. */
     id: string;
-    /** The scope element's fqn, or undefined for the model root. */
+    /** perLayer only: the scope element's fqn, or undefined for the model root. */
     scope?: string;
-    /** How many pending `#proposed` / `#proposal-delete` changes this layer holds. */
+    /** How many pending `#proposed` / `#proposal-delete` changes this view holds. */
     changes: number;
 }
 /** A generated linter config artifact. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "boundry",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Compile a C4 architecture diagram into a deterministic dependency linter. Deterministic architectural guardrails for AI agents and humans.",
   "type": "module",
   "license": "MIT",