boundry 0.5.0 → 0.7.0

package/CHANGELOG.md

@@ -4,6 +4,71 @@ All notable changes to Boundry are documented here.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
 versioning follows [semver](https://semver.org/).
 
+## [0.7.0] — 2026-07-24
+
+The enforced contract moves from the diagram to the **lock**. The diagram becomes
+a proposal surface; enforcement is engine-independent and changes only on
+`approve`.
+
+### Changed
+
+- **`check` and `generate` now enforce the accepted `boundry.lock`, not the
+  working diagram** ([#10]). The lock — a serialized boundary model, no LikeC4 in
+  it — is the source of truth; the diagram is a staging surface for proposing
+  changes to it. Consequences:
+  - **Enforcement is engine-independent.** `check`/`generate` read the lock, so
+    they need no diagram at all — you can swap the LikeC4 adapter, or enforce with
+    only a committed lock. The visualizer is a driven port again, not something
+    enforcement rides on.
+  - **Editing the diagram never moves enforcement on its own.** Drawing a proposal
+    or deleting a box changes nothing until `approve` folds it into the lock.
+  - **`check` runs a parity gate first.** When a diagram is present, `check`
+    rejects any *un-annotated* drift between it and the lock — a self-granted edge
+    (add without `#proposed`) **or** a silent removal (delete without
+    `#proposal-delete`) — so the diagram can never silently disagree with what the
+    lock enforces. This subsumes `verify` (now the parity gate on its own, extended
+    to removals). With no diagram, the gate is skipped and the lock alone enforces.
+  - **`check`/`generate` require a lock** — with none, they error "run `approve`
+    first" (the first `approve` bootstraps it). `approve` refuses to accept any
+    un-annotated drift, so every change reaches the lock through a reviewed marker.
+  - The `boundry.lock` **must be committed** — it is the contract CI enforces.
+
+### Added
+
+- **`annotate` is symmetric — it stages removals, not just additions** ([#9]). It
+  already rewrote a bare new edge/box as `#proposed`; it now also detects an
+  element or edge that is in the lock but **deleted** from the diagram and
+  **re-materialises it** into the source tagged `#proposal-delete` — reconstructing
+  a deleted nested subtree in place, re-declaring deleted edges by fqn. So a
+  restructure that removes a component is reviewable the same way an addition is:
+  *delete → `annotate` → review (`diff` draws it red) → `approve` removes it from
+  the lock*. Idempotent; `styleMarkers` colours it red like any marker.
+
+[#9]: https://github.com/makspiechota/boundry/issues/9
+[#10]: https://github.com/makspiechota/boundry/issues/10
+
+## [0.6.0] — 2026-07-22
+
+### Changed
+
+- **`boundry diff` now emits a single "proposed changes" view by default** ([#8]),
+  instead of one view per changed layer. The per-layer shape (added in 0.4.0,
+  extended per-altitude in 0.5.0) had two failure modes on real changes: it
+  multiplied views (one multi-slice change produced ~21), and its per-layer
+  `include *` collapsed deeply-nested proposals into their grey ancestor box, so a
+  nested proposed leaf silently lost its amber. The new `boundry_diff` view uses
+  `include * -> * where tag is #proposed` with **no** bare `include *`, so it pulls
+  in exactly the proposed edges and the leaf modules they touch — every change is
+  drawn at leaf level, uncollapsed and uniformly coloured, on one landing. A
+  `#proposed` box with no edge yet is included by fqn so a proposed-but-unwired
+  module still shows, and every endpoint's ancestor chain is included so each
+  change nests under its layer/system for context. `approve` still deletes the
+  derived file (0.5.0 behaviour).
+  - The per-altitude per-layer views from 0.5.0 remain available behind
+    **`boundry diff --per-layer`** — useful for a small change, opt-in.
+
+[#8]: https://github.com/makspiechota/boundry/issues/8
+
 ## [0.5.0] — 2026-07-21
 
 ### Fixed

package/README.md

@@ -227,16 +227,17 @@ deterministically, by splicing the LikeC4 CST. No model call, no reformatting:
 source-preserving, idempotent, byte-exact.
 
 ```bash
-boundry verify  --arch arch   # any edge granted without a marker, vs the lock?
+boundry verify  --arch arch   # any change vs the lock that skipped a marker?
 boundry approve --arch arch   # HUMAN ONLY: strip markers = approve, update the lock
 ```
 
-`verify` compares the working diagram against the accepted **`boundry.lock`** and
-rejects edges that appeared *without* going through a proposal. Because proposals
-are excluded from the allow-list, the newly-allowed set is exactly the set of
-self-approvals — no diff engine required. `approve` runs the same gate first, so
-it won't launder a self-granted edge into an approved one; then it enacts the
-proposals and records the new accepted state to the lock.
+`verify` is the **parity gate**: it compares the working diagram against the
+accepted **`boundry.lock`** and rejects anything that changed *without* a marker —
+an addition without `#proposed` (a self-grant) or a removal without
+`#proposal-delete` (a silent deletion). `check` runs this gate before it enforces,
+so the diagram can never silently disagree with the lock. `approve` runs it too,
+so it won't accept un-annotated drift; then it enacts the markers and records the
+new accepted state to the lock.
 
 The baseline is the lock, not a git ref: it's the state Boundry *owns*, so
 "accepted" never collapses into merely "committed". (One consequence, by design:
@@ -266,22 +267,25 @@ and they'll follow this protocol.
 
 ### Catching drift — `annotate` (prototype)
 
-`verify` catches a self-grant and fails; `annotate` is the other half — it
-*rewrites* the same drift into a reviewable proposal. Both read the same baseline,
-the accepted **`boundry.lock`** that `approve` records beside the diagram, so they
-can never disagree about what "accepted" means.
+`verify` catches drift and fails; `annotate` is the other half — it *rewrites* the
+same drift into a reviewable proposal. Both read the same baseline, the accepted
+**`boundry.lock`** that `approve` records beside the diagram, so they can never
+disagree about what "accepted" means.
 
 ```bash
 boundry approve  --arch arch          # enact proposals AND write boundry.lock
-boundry annotate --arch arch          # rewrite undeclared additions as #proposed
+boundry annotate --arch arch          # stage drift as #proposed / #proposal-delete
 ```
 
-`annotate` finds every edge or box that drifted past the lock without a marker —
-a self-grant — and rewrites it in place as a `#proposed` proposal. That's not
-cosmetic: a `#proposed` edge leaves the allow-list, so the silent grant becomes a
-red-again check and a highlighted box on the diagram, awaiting a real approval. It
-handles additions only; a removal is reported, not re-drawn (re-adding a deleted
-box would resurrect it as an enforced module).
+`annotate` is **symmetric**. An **addition** that drifted past the lock without a
+marker — a bare new edge or box — is rewritten in place as `#proposed`: it leaves
+the allow-list, so the silent grant becomes a red-again check awaiting approval. A
+**removal** — an element or edge that is in the lock but was *deleted* from the
+diagram — is **re-materialised** back into the source tagged `#proposal-delete`,
+reconstructing a deleted nested subtree in place and re-declaring its edges. So a
+restructure that removes a component is reviewable exactly like one that adds: the
+deletion comes back as a red proposal you can see in `diff` and enact with
+`approve`, rather than as silent drift a failing `check` only hints at.
 
 It also **paints the markers** — every `#proposed` edge/box gets an intrinsic
 `style { color amber }`, every `#proposal-delete` a `style { color red }`, written
@@ -293,38 +297,41 @@ this styling back out with the marker: a `#proposed` edge returns to bare, a
 `#proposed` box stays but loses its colour, a `#proposal-delete` is removed
 outright. Requires **LikeC4 ≥ 1.58** to render.
 
-### Reviewing a proposal — per-layer diff views (prototype)
+### Reviewing a proposal — the diff view (prototype)
 
-A proposal nested inside a box is invisible at a wider zoom: at the top level the
-box collapses and its inner `#proposed` edge disappears. So `diff` generates a
-**focused view for every layer that draws a pending change** — into a derived
-`boundry.diff.likec4`:
+`diff` generates a single **proposed-changes** view — every pending change on one
+landing — into a derived `boundry.diff.likec4`:
 
 ```bash
 boundry diff --arch arch              # (re)write boundry.diff.likec4
-likec4 serve arch                     # review each layer, changes coloured
+likec4 serve arch                     # open 'Boundry diff — proposed changes'
 ```
 
 The highlighting is **generated, not hand-styled** — `diff` emits the LikeC4
-style rules into the derived file, so every `#proposed` box fills amber and edge
-goes amber + solid, every `#proposal-delete` red, deterministically. That closes
-the last manual seam: `annotate` marks, `diff` colours, no agent-dependent
-styling step. Boxes are styled *in place* (never force-included), so a nested
-proposal stays in its own layer; unchanged elements keep their defaults; and the
-rules live only in the generated views, so your own views are untouched.
-
-A changed edge is drawn at **every altitude it appears**, not only the
-common-ancestor layer — so a cross-system dependency between two deeply-nested
-leaves gets a view at each endpoint's system and container as well as at the
-shared root. Open the change at whatever altitude matters (the whole system, a
-specific container) instead of being dropped at the noisy root view. `diff` emits
-only the layers that genuinely draw the edge: never above the common ancestor
-(where it collapses to an undrawn self-loop), never the leaf endpoints themselves.
+rules into the derived file, so every `#proposed` box fills amber and edge goes
+amber + solid, every `#proposal-delete` red, deterministically. That closes the
+last manual seam: `annotate` marks, `diff` colours, no agent-dependent styling
+step. Unchanged elements keep their defaults, and the rules live only in the
+generated view, so your own views are untouched.
+
+The view uses `include * -> * where tag is #proposed` (no bare `include *`), so it
+pulls in exactly the proposed edges and the leaf modules they touch — a
+deeply-nested proposal renders as its **own coloured node** instead of collapsing
+into a grey ancestor. A proposed *module* with no edge yet is included too, so a
+proposed-but-unwired box still shows. Each change nests under its layer/system for
+context.
+
+For a small change you can ask for the old per-layer shape instead — one focused
+`view … of <scope>` for every layer that draws a change:
+
+```bash
+boundry diff --arch arch --per-layer
+```
 
 The file is a **derived artifact**: overwritten every run, removed when nothing is
 proposed, so it always matches the current diagram. `approve` deletes it too, as
-part of enacting — the moment the last proposal is approved the views are stale,
-so the post-approve workspace validates clean. It reads the diagram's own markers
+part of enacting — the moment the last proposal is approved the view is stale, so
+the post-approve workspace validates clean. It reads the diagram's own markers
 (not the lock), so it frames whatever `annotate` or a human has marked. Being
 derived, it's a `.gitignore` candidate (`boundry.diff.likec4`).
 
@@ -340,7 +347,7 @@ boundry generate [--arch <dir>] [--cwd <dir>] [--out <file>]
 boundry verify   [--arch <dir>] [--cwd <dir>]
 boundry approve  [--arch <dir>] [--cwd <dir>]
 boundry annotate [--arch <dir>]
-boundry diff     [--arch <dir>]
+boundry diff     [--arch <dir>] [--per-layer]
 ```
 
 | Flag | Meaning |
@@ -348,20 +355,31 @@ boundry diff     [--arch <dir>]
 | `--arch <dir>` | LikeC4 workspace directory (all `.likec4` files in it are merged). Default `.`. |
 | `--cwd <dir>` | Repo root to check. `folder` paths are relative to it. Lets you run from anywhere. |
 | `--out <file>` | `generate` only: where to write the dependency-cruiser config. Default `.dependency-cruiser.cjs`. |
+| `--per-layer` | `diff` only: emit one focused view per layer instead of the single proposed-changes view. |
 | `sources...` | `check` only: paths to lint. Default `src`. |
 
-- **`check`** compiles the rules and runs the linter. Exits non-zero on any violation.
-- **`generate`** just emits the dependency-cruiser config so you can commit it or
-  run `depcruise` yourself.
-- **`verify`** rejects dependencies granted without a proposal, comparing the
-  diagram against the accepted `boundry.lock`. Needs a lock — run `approve` once
-  to record one.
-- **`approve`** runs the same gate, then enacts markers (strips `#proposed`,
-  removes `#proposal-delete`) and writes `boundry.lock`. For humans, not agents.
-- **`annotate`** rewrites undeclared additions as `#proposed`, diffing against
-  `boundry.lock`.
-- **`diff`** generates a focused, colour-coded review view per layer that holds a
-  pending change, into a derived `boundry.diff.likec4`.
+- **`check`** enforces the accepted **`boundry.lock`** (not the working diagram)
+  against your code, and runs the linter. When a diagram is present it first runs
+  the **parity gate** — rejecting any un-annotated drift between the diagram and
+  the lock — then enforces. With no diagram, the lock alone enforces
+  (engine-independent). Needs a lock; exits non-zero on any violation.
+- **`generate`** emits the dependency-cruiser config from the lock, so it matches
+  exactly what `check` enforces.
+- **`verify`** is the parity gate on its own: it rejects any change between the
+  diagram and the lock that skipped a marker — an addition without `#proposed`
+  **or** a removal without `#proposal-delete`.
+- **`approve`** folds the diagram into the lock — the only op that changes what is
+  enforced. It refuses un-annotated drift first, then enacts markers (strips
+  `#proposed`, removes `#proposal-delete`) and writes `boundry.lock`. For humans,
+  not agents.
+- **`annotate`** stages drift as proposals, symmetrically: an undeclared addition
+  becomes `#proposed`; an element/edge deleted from the diagram is re-materialised
+  as `#proposal-delete`. Diffs against `boundry.lock`.
+- **`diff`** generates a single colour-coded "proposed changes" review view into a
+  derived `boundry.diff.likec4` (or, with `--per-layer`, one focused view per layer
+  that draws a change).
+
+**Commit `boundry.lock`** — it is the enforced contract, and CI checks against it.
 
 Boundry warns (but does not fail) when a mapped folder matches **zero** files, and
 **fails outright** when a check analysed no files at all — so a passing check can
@@ -381,9 +399,9 @@ jobs:
       - uses: actions/setup-node@v4
         with: { node-version: 20 }
       - run: npm ci
+      # Enforces the committed boundry.lock against the code, and rejects any
+      # un-annotated drift between the diagram and the lock (the parity gate).
       - run: npx boundry check --arch arch src
-      # Reject any dependency granted without a proposal, vs the committed lock.
-      - run: npx boundry verify --arch arch
 ```
 
 ## Programmatic use (SDK)
@@ -392,6 +410,7 @@ The CLI is a thin wrapper over the SDK. Everything is pluggable — the diagram
 source and the target linter are both adapters behind ports.
 
 ```ts
+import { readFileSync } from 'node:fs';
 import { Pipeline, LikeC4Visualizer, DepCruiserEnforcer } from 'boundry';
 
 const pipeline = new Pipeline(
@@ -399,7 +418,9 @@ const pipeline = new Pipeline(
   new DepCruiserEnforcer(),
 );
 
-const result = await pipeline.check(['src']);
+// Enforce the accepted lock — the committed contract — against your code.
+const lock = readFileSync('arch/boundry.lock', 'utf8');
+const result = await pipeline.check(lock, ['src']);
 if (!result.ok) {
   for (const v of result.violations) console.error(`${v.from} → ${v.to}`);
   process.exit(1);

package/dist/adapters/visualizer/likec4.d.ts

@@ -1,5 +1,5 @@
 import type { VisualizerPort, DiffView } from '../../core/ports/ports.js';
-import type { BoundaryModel, AllowedEdge } from '../../core/model/boundary-model.js';
+import type { BoundaryModel, Module, AllowedEdge } from '../../core/model/boundary-model.js';
 /**
  * First visualizer adapter. Reads a LikeC4 workspace and lifts it into the
  * boundary model: any element carrying a `folder` metadata key becomes a
@@ -35,6 +35,17 @@ export declare class LikeC4Visualizer implements VisualizerPort {
      * skipping anything already marked, so it is idempotent.
      */
     propose(edges: AllowedEdge[], moduleIds: string[]): Promise<void>;
+    /**
+     * Re-materialise deleted elements and edges into the source, tagged
+     * `#proposal-delete`, so a removal is a reviewable red proposal rather than
+     * silent drift. Modules are rebuilt with their folder/file mapping and nesting
+     * (a deleted subtree is reconstructed as one nested block, inserted into the
+     * surviving parent's body, or the model root for a top-level one); edges are
+     * re-declared by fqn at the model root. Idempotent — anything already present in
+     * the source (by fqn / by endpoints) is skipped. Never an LLM edit: it splices
+     * text at CST anchors, and `styleMarkers`/`diff` then colour it red.
+     */
+    proposeDeletions(modules: Module[], edges: AllowedEdge[]): Promise<void>;
     /**
      * Paint intrinsic style on every marked edge and box, so a proposal is
      * highlighted on *every* LikeC4 surface — base views and the "relationships of
@@ -46,14 +57,26 @@ export declare class LikeC4Visualizer implements VisualizerPort {
      */
     styleMarkers(): Promise<void>;
     /**
-     * Generate a focused diff view for every layer that holds a pending change.
-     * Walks the diagram's own `#proposed` / `#proposal-delete` markers (never the
-     * lock — a `#proposal-delete` has no lock delta) and writes one `view … of
-     * <scope>` per layer to a derived `boundry.diff.likec4`. A box is bucketed into
-     * its parent layer; an edge into *every* layer that draws it (see `edgeScopes`),
-     * so a cross-system dependency can be reviewed at each altitude, not only the
-     * common-ancestor layer. The file is overwritten each run and removed when
-     * nothing is proposed, so it always reflects the current diagram.
+     * Generate the review views for the diagram's pending changes, into a derived
+     * `boundry.diff.likec4`. Walks the diagram's own `#proposed` / `#proposal-delete`
+     * markers (never the lock — a `#proposal-delete` has no lock delta).
+     *
+     * By default it emits a **single `boundry_diff` view** that draws every change at
+     * once, uncollapsed and uniformly highlighted (see `renderSingleView`) — the diff
+     * landing. With `perLayer`, it instead emits one focused `view … of <scope>` for
+     * every layer that draws a change (a box in its parent layer; an edge in every
+     * layer that draws it, per `edgeScopes`) — useful for a small change, but it
+     * multiplies views and collapses deeply-nested proposals into grey ancestors on
+     * a broad `include *`, which is why the single view is the default (issue #8).
+     *
+     * The file is overwritten each run and removed when nothing is proposed, so it
+     * always reflects the current diagram.
+     */
+    emitDiffViews(perLayer?: boolean): Promise<DiffView[]>;
+    /**
+     * The `--per-layer` shape: buckets each change into every layer that draws it and
+     * renders one scoped `view … of <scope>` per layer. Kept as an opt-in to the
+     * single-view default.
      */
-    emitDiffViews(): Promise<DiffView[]>;
+    private perLayerViews;
 }

package/dist/adapters/visualizer/likec4.js

@@ -104,6 +104,61 @@ function renderDiffView(scope, highlight) {
     const lines = [`    title 'Boundry diff · ${scope ?? 'root'}'`, '    include *', ...highlight];
     return `${opener}\n${lines.join('\n')}\n  }`;
 }
+/** Every proper ancestor of an element, shallowest first — its parent chain up to (not including) the root. */
+function ancestorFqns(fqn) {
+    const parts = fqn.split('.');
+    const out = [];
+    for (let len = 1; len <= parts.length - 1; len++)
+        out.push(parts.slice(0, len).join('.'));
+    return out;
+}
+/**
+ * The single `boundry_diff` view: one landing that draws *every* pending change at
+ * once, with uniform highlighting and no empty views. It sidesteps the per-layer
+ * shape's two failure modes (issue #8):
+ *
+ *   - **No collapse.** `include * -> * where tag is #proposed` (with NO bare
+ *     `include *`) pulls in exactly the proposed edges and the leaf modules they
+ *     touch — so a deeply-nested proposed leaf renders as its own amber node
+ *     instead of collapsing into a grey ancestor, as it does under `include *`.
+ *   - **Standalone boxes.** A `#proposed` box with no edge is included by fqn, so
+ *     a proposed-but-unwired module still shows (and is coloured by the style rule).
+ *
+ * Every endpoint's and box's full ancestor chain is included too, so each change
+ * nests under its layer/system for context (verified against LikeC4 1.58). Rules
+ * are emitted only for marker tags actually in use — referencing an undeclared tag
+ * is a hard LikeC4 error.
+ */
+function renderSingleView(edges, boxes, usedTags) {
+    const lines = [`    title 'Boundry diff — proposed changes'`];
+    // Edge includes: one per marker that appears on an edge. These pull the proposed
+    // edges and their endpoint leaves in at leaf level, uncollapsed.
+    if (edges.some((e) => e.marker === '#proposed')) {
+        lines.push('    include * -> * where tag is #proposed with { color amber; line solid }');
+    }
+    if (edges.some((e) => e.marker === '#proposal-delete')) {
+        lines.push('    include * -> * where tag is #proposal-delete with { color red; line solid }');
+    }
+    // Element includes: the proposed/proposal-delete boxes themselves (so a standalone
+    // one shows), plus the full ancestor chain of every endpoint and box (so each
+    // change nests under its containers). Deterministic: sorted, de-duplicated.
+    const includeFqns = new Set();
+    for (const box of boxes)
+        includeFqns.add(box.fqn);
+    const anchors = [...edges.flatMap((e) => [e.from, e.to]), ...boxes.map((b) => b.fqn)];
+    for (const fqn of anchors)
+        for (const ancestor of ancestorFqns(fqn))
+            includeFqns.add(ancestor);
+    if (includeFqns.size) {
+        lines.push(`    include ${[...includeFqns].sort().join(', ')}`);
+    }
+    // Style rules colour the tagged boxes (edges are coloured by their include above).
+    if (usedTags.has('proposed'))
+        lines.push('    style element.tag = #proposed { color amber }');
+    if (usedTags.has('proposal-delete'))
+        lines.push('    style element.tag = #proposal-delete { color red }');
+    return `  view boundry_diff {\n${lines.join('\n')}\n  }`;
+}
 /**
  * An exemption pattern has to be a usable regex before it reaches the linter. A
  * broken or empty one would otherwise be a silent hole: it exempts files from
@@ -520,6 +575,114 @@ export class LikeC4Visualizer {
             writeFileSync(filePath, next);
         }
     }
+    /**
+     * Re-materialise deleted elements and edges into the source, tagged
+     * `#proposal-delete`, so a removal is a reviewable red proposal rather than
+     * silent drift. Modules are rebuilt with their folder/file mapping and nesting
+     * (a deleted subtree is reconstructed as one nested block, inserted into the
+     * surviving parent's body, or the model root for a top-level one); edges are
+     * re-declared by fqn at the model root. Idempotent — anything already present in
+     * the source (by fqn / by endpoints) is skipped. Never an LLM edit: it splices
+     * text at CST anchors, and `styleMarkers`/`diff` then colour it red.
+     */
+    async proposeDeletions(modules, edges) {
+        if (modules.length === 0 && edges.length === 0)
+            return;
+        const likec4 = await LikeC4.fromWorkspace(this.workspaceDir);
+        const docs = [];
+        const existingFqns = new Set();
+        const existingEdges = new Set();
+        for (const doc of likec4.LangiumDocuments.all) {
+            const filePath = doc.uri.fsPath;
+            if (!filePath.endsWith('.likec4') || filePath.endsWith(DIFF_FILE))
+                continue;
+            const text = doc.textDocument?.getText?.() ?? readFileSync(filePath, 'utf8');
+            const elementByFqn = new Map();
+            let modelBlock;
+            walkContained(doc.parseResult?.value, (node) => {
+                if (node.$type === 'Element') {
+                    const fqn = fqnOf(node);
+                    if (fqn) {
+                        elementByFqn.set(fqn, node);
+                        existingFqns.add(fqn);
+                    }
+                    if (node.$container?.$type === 'Model' && !modelBlock)
+                        modelBlock = node.$container;
+                }
+                else if (node.$type === 'Relation') {
+                    const from = fqnOf(endpointElement(node.source));
+                    const to = fqnOf(endpointElement(node.target));
+                    if (from && to)
+                        existingEdges.add(`${from} -> ${to}`);
+                }
+            });
+            docs.push({ filePath, text, elementByFqn, modelBlock });
+        }
+        docs.sort((a, b) => a.filePath.localeCompare(b.filePath));
+        const primary = docs.find((d) => d.modelBlock);
+        // Idempotency: only re-add what is genuinely absent from the source.
+        const addModules = modules.filter((m) => !existingFqns.has(m.id));
+        const addEdges = edges.filter((e) => !existingEdges.has(`${e.from} -> ${e.to}`));
+        if (addModules.length === 0 && addEdges.length === 0)
+            return;
+        const childrenOf = (fqn) => addModules.filter((m) => parentScope(m.id) === fqn);
+        const moduleBlock = (m) => {
+            const indent = '  '.repeat(m.id.split('.').length);
+            const name = m.id.split('.').pop();
+            const mapping = m.kind === 'file' ? `file '${m.path}'` : `folder '${m.path}'`;
+            const lines = [
+                `${indent}module ${name} '${m.title}' {`,
+                `${indent}  #proposal-delete`,
+                `${indent}  metadata { ${mapping} }`,
+                ...childrenOf(m.id).map(moduleBlock),
+                `${indent}}`,
+            ];
+            return lines.join('\n');
+        };
+        // Accumulate insertions keyed by an anchor position, so several blocks that
+        // land in the same body (or the model root) merge into one splice.
+        const inserts = [];
+        // The start of the line the block's `{ … }` closes on, so an inserted block
+        // sits as whole lines and the closing brace keeps its own indentation.
+        const atClosingLine = (text, cst) => {
+            const brace = text.lastIndexOf('}', cst.end - 1);
+            return text.lastIndexOf('\n', brace) + 1;
+        };
+        // A module is a subtree ROOT when its parent is not itself being re-added — so
+        // its parent survives, or it is top-level. Reconstruct each root's whole
+        // subtree as one block (deepest-first recursion), then anchor it.
+        for (const root of addModules.filter((m) => !addModules.some((p) => p.id === parentScope(m.id)))) {
+            const parent = parentScope(root.id);
+            const block = `${moduleBlock(root)}\n`;
+            if (!parent) {
+                if (primary)
+                    inserts.push({ filePath: primary.filePath, at: atClosingLine(primary.text, primary.modelBlock.$cstNode), text: block });
+            }
+            else {
+                const owner = docs.find((d) => d.elementByFqn.has(parent));
+                if (owner)
+                    inserts.push({ filePath: owner.filePath, at: atClosingLine(owner.text, owner.elementByFqn.get(parent).body.$cstNode), text: block });
+            }
+        }
+        if (addEdges.length && primary) {
+            const text = addEdges.map((e) => `  ${e.from} -> ${e.to} #proposal-delete\n`).join('');
+            inserts.push({ filePath: primary.filePath, at: atClosingLine(primary.text, primary.modelBlock.$cstNode), text });
+        }
+        // Apply per file, back-to-front, so earlier offsets stay valid.
+        const byFile = new Map();
+        for (const ins of inserts) {
+            const list = byFile.get(ins.filePath) ?? [];
+            list.push({ at: ins.at, text: ins.text });
+            byFile.set(ins.filePath, list);
+        }
+        for (const [filePath, list] of byFile) {
+            let next = docs.find((d) => d.filePath === filePath).text;
+            for (const { at, text } of list.sort((a, b) => b.at - a.at)) {
+                next = next.slice(0, at) + text + next.slice(at);
+            }
+            writeFileSync(filePath, next);
+        }
+    }
     /**
      * Paint intrinsic style on every marked edge and box, so a proposal is
      * highlighted on *every* LikeC4 surface — base views and the "relationships of
@@ -582,28 +745,28 @@ export class LikeC4Visualizer {
         }
     }
     /**
-     * Generate a focused diff view for every layer that holds a pending change.
-     * Walks the diagram's own `#proposed` / `#proposal-delete` markers (never the
-     * lock — a `#proposal-delete` has no lock delta) and writes one `view … of
-     * <scope>` per layer to a derived `boundry.diff.likec4`. A box is bucketed into
-     * its parent layer; an edge into *every* layer that draws it (see `edgeScopes`),
-     * so a cross-system dependency can be reviewed at each altitude, not only the
-     * common-ancestor layer. The file is overwritten each run and removed when
-     * nothing is proposed, so it always reflects the current diagram.
+     * Generate the review views for the diagram's pending changes, into a derived
+     * `boundry.diff.likec4`. Walks the diagram's own `#proposed` / `#proposal-delete`
+     * markers (never the lock — a `#proposal-delete` has no lock delta).
+     *
+     * By default it emits a **single `boundry_diff` view** that draws every change at
+     * once, uncollapsed and uniformly highlighted (see `renderSingleView`) — the diff
+     * landing. With `perLayer`, it instead emits one focused `view … of <scope>` for
+     * every layer that draws a change (a box in its parent layer; an edge in every
+     * layer that draws it, per `edgeScopes`) — useful for a small change, but it
+     * multiplies views and collapses deeply-nested proposals into grey ancestors on
+     * a broad `include *`, which is why the single view is the default (issue #8).
+     *
+     * The file is overwritten each run and removed when nothing is proposed, so it
+     * always reflects the current diagram.
      */
-    async emitDiffViews() {
+    async emitDiffViews(perLayer = false) {
         const likec4 = await LikeC4.fromWorkspace(this.workspaceDir);
-        // scopeViewId -> { scope, changes } — deterministic key, so the same diagram
-        // always yields the same set of views.
-        const layers = new Map();
-        const record = (scope) => {
-            const key = scopeViewId(scope);
-            const layer = layers.get(key) ?? { scope, changes: 0 };
-            layer.changes += 1;
-            layers.set(key, layer);
-        };
-        // Which marker tags actually appear — so the emitted highlight rules only ever
-        // reference declared tags (an undeclared tag reference is a hard LikeC4 error).
+        // Lift every marked edge and box once; both view shapes are built from this.
+        const edges = [];
+        const boxes = [];
+        // Which marker tags actually appear — so the emitted rules only ever reference
+        // declared tags (an undeclared tag reference is a hard LikeC4 error).
         const usedTags = new Set();
         for (const doc of likec4.LangiumDocuments.all) {
             const filePath = doc.uri.fsPath;
@@ -619,27 +782,54 @@ export class LikeC4Visualizer {
                 if (statement?.$type === 'Relation') {
                     const from = fqnOf(endpointElement(statement.source));
                     const to = fqnOf(endpointElement(statement.target));
-                    // One view per layer that actually draws this edge, so the reviewer can
-                    // judge it at every altitude — not only the common-ancestor layer (#7).
                     if (from && to)
-                        for (const scope of edgeScopes(from, to))
-                            record(scope);
+                        edges.push({ from, to, marker });
                 }
                 else if (statement?.$type === 'Element') {
                     const fqn = fqnOf(statement);
                     if (fqn)
-                        record(parentScope(fqn));
+                        boxes.push({ fqn, marker });
                 }
             });
         }
         const diffPath = join(this.workspaceDir, DIFF_FILE);
-        if (layers.size === 0) {
+        if (edges.length === 0 && boxes.length === 0) {
             // Nothing proposed — clear any stale views so `serve` never renders a diff
             // that no longer exists (and never dangles a reference to an approved-away box).
             if (existsSync(diffPath))
                 rmSync(diffPath);
             return [];
         }
+        const { header, body, views } = perLayer
+            ? this.perLayerViews(edges, boxes, usedTags)
+            : {
+                header: 'a single landing view of every pending change',
+                body: renderSingleView(edges, boxes, usedTags),
+                views: [{ id: 'boundry_diff', changes: edges.length + boxes.length }],
+            };
+        writeFileSync(diffPath, `// Generated by \`boundry diff\` — ${header}.\n` +
+            `// Derived artifact: regenerate after approve; do not hand-edit.\n` +
+            `views {\n${body}\n}\n`);
+        return views;
+    }
+    /**
+     * The `--per-layer` shape: buckets each change into every layer that draws it and
+     * renders one scoped `view … of <scope>` per layer. Kept as an opt-in to the
+     * single-view default.
+     */
+    perLayerViews(edges, boxes, usedTags) {
+        const layers = new Map();
+        const record = (scope) => {
+            const key = scopeViewId(scope);
+            const layer = layers.get(key) ?? { scope, changes: 0 };
+            layer.changes += 1;
+            layers.set(key, layer);
+        };
+        for (const edge of edges)
+            for (const scope of edgeScopes(edge.from, edge.to))
+                record(scope);
+        for (const box of boxes)
+            record(parentScope(box.fqn));
         // Root first, then by fqn, so the output is stable across runs.
         const ordered = [...layers.values()].sort((a, b) => {
             if (!a.scope)
@@ -649,14 +839,14 @@ export class LikeC4Visualizer {
             return a.scope.localeCompare(b.scope);
         });
         const highlight = highlightLines(usedTags);
-        const body = ordered.map((layer) => renderDiffView(layer.scope, highlight)).join('\n');
-        writeFileSync(diffPath, `// Generated by \`boundry diff\` — one focused view per layer with a pending\n` +
-            `// change. Derived artifact: regenerate after approve; do not hand-edit.\n` +
-            `views {\n${body}\n}\n`);
-        return ordered.map((layer) => ({
-            id: scopeViewId(layer.scope),
-            scope: layer.scope,
-            changes: layer.changes,
-        }));
+        return {
+            header: 'one focused view per layer with a pending change',
+            body: ordered.map((layer) => renderDiffView(layer.scope, highlight)).join('\n'),
+            views: ordered.map((layer) => ({
+                id: scopeViewId(layer.scope),
+                scope: layer.scope,
+                changes: layer.changes,
+            })),
+        };
     }
 }

package/dist/cli/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import { join, relative, resolve } from 'node:path';
-import { Pipeline } from '../core/pipeline/pipeline.js';
+import { Pipeline, inParity } from '../core/pipeline/pipeline.js';
 import { LikeC4Visualizer } from '../adapters/visualizer/likec4.js';
 import { DepCruiserEnforcer } from '../adapters/enforcer/depcruiser.js';
-const USAGE = 'usage: boundry <generate|check|approve|verify|annotate|diff> [--arch <dir>] [--cwd <dir>] [--out <file>] [sources...]';
+const USAGE = 'usage: boundry <generate|check|approve|verify|annotate|diff> [--arch <dir>] [--cwd <dir>] [--out <file>] [--per-layer] [sources...]';
 function optValue(args, flag) {
     const i = args.indexOf(flag);
     return i >= 0 ? args[i + 1] : undefined;
@@ -20,22 +20,36 @@ function positionals(args) {
     }
     return out;
 }
-function countGrants(granted) {
-    return granted.edges.length + granted.exemptions.length;
+/** How many un-annotated differences from the lock the parity gate found. */
+function countDrift(d) {
+    return d.edges.length + d.exemptions.length + d.removedEdges.length + d.removedModules.length;
 }
-function listGrants(granted) {
-    for (const edge of granted.edges)
-        console.error(`  ${edge.from} → ${edge.to}`);
-    for (const pattern of granted.exemptions) {
-        console.error(`  exemption '${pattern}' — lifts matching files out of every rule`);
+/** Report every way the diagram drifted from the lock without a marker. */
+function listDrift(d) {
+    for (const edge of d.edges)
+        console.error(`  + ${edge.from} → ${edge.to}  (added without #proposed)`);
+    for (const pattern of d.exemptions) {
+        console.error(`  + exemption '${pattern}' — lifts matching files out of every rule`);
     }
-    if (granted.edges.length > 0) {
-        console.error('  Mark them #proposed so the grant is an explicit, reviewable act.');
+    for (const edge of d.removedEdges)
+        console.error(`  − ${edge.from} → ${edge.to}  (deleted without #proposal-delete)`);
+    for (const mod of d.removedModules)
+        console.error(`  − [${mod.title}] ${mod.path}  (deleted without #proposal-delete)`);
+    if (d.edges.length > 0) {
+        console.error('  Mark additions #proposed so the grant is an explicit, reviewable act.');
     }
-    if (granted.exemptions.length > 0) {
+    if (d.removedEdges.length > 0 || d.removedModules.length > 0) {
+        console.error("  Run 'boundry annotate' to stage removals as #proposal-delete, then review.");
+    }
+    if (d.exemptions.length > 0) {
         console.error('  An exemption cannot be proposed — a human adds it to the diagram, or not at all.');
     }
 }
+/** Whether the workspace has an authored diagram (any .likec4 but the derived diff). */
+function hasDiagram(archDir) {
+    return existsSync(archDir) &&
+        readdirSync(archDir).some((f) => f.endsWith('.likec4') && !f.endsWith('boundry.diff.likec4'));
+}
 async function main() {
     const [command, ...rest] = process.argv.slice(2);
     // Resolve paths against the *original* cwd before we optionally move into the
@@ -54,16 +68,45 @@ async function main() {
     const lockFile = join(archDir, 'boundry.lock');
     const readLock = () => existsSync(lockFile) ? readFileSync(lockFile, 'utf8') : undefined;
     const pipeline = new Pipeline(new LikeC4Visualizer(archDir), new DepCruiserEnforcer());
+    // Enforcement runs against the accepted lock — the engine-independent contract —
+    // not the working diagram, so a lock is required for `generate` and `check`.
+    const requireLock = () => {
+        const lock = readLock();
+        if (!lock) {
+            console.error(`Boundry: no ${relative(process.cwd(), lockFile)} — run 'boundry approve' first to record the accepted state`);
+            process.exitCode = 2;
+        }
+        return lock;
+    };
     if (command === 'generate') {
-        const config = await pipeline.generate();
+        const lock = requireLock();
+        if (!lock)
+            return;
+        const config = await pipeline.generate(lock);
         const out = outFile ?? resolve(config.filename);
         writeFileSync(out, config.content);
         console.log(`Boundry: wrote ${out}`);
         return;
     }
     if (command === 'check') {
+        const lock = requireLock();
+        if (!lock)
+            return;
+        // Parity gate: reject un-annotated drift before enforcing, so the diagram can
+        // never silently disagree with what the lock enforces. Skipped when there is
+        // no diagram — the lock alone drives enforcement (engine-independent).
+        if (hasDiagram(archDir)) {
+            const drift = await pipeline.verify(lock);
+            if (!inParity(drift)) {
+                console.error(`Boundry: ✗ ${countDrift(drift)} un-annotated change(s) between the diagram and the accepted lock`);
+                listDrift(drift);
+                console.error('  Enforcement is against the lock; annotate → review → approve to accept these.');
+                process.exitCode = 1;
+                return;
+            }
+        }
         const sources = positionals(rest);
-        const result = await pipeline.check(sources.length ? sources : ['src']);
+        const result = await pipeline.check(lock, sources.length ? sources : ['src']);
         for (const warning of result.warnings) {
             console.error(`Boundry: ⚠ ${warning}`);
         }
@@ -79,34 +122,30 @@ async function main() {
         return;
     }
     if (command === 'verify') {
-        const lock = readLock();
-        if (!lock) {
-            console.error(`Boundry: no ${relative(process.cwd(), lockFile)} — run 'boundry approve' first to record the accepted state`);
-            process.exitCode = 2;
+        const lock = requireLock();
+        if (!lock)
             return;
-        }
-        const granted = await pipeline.verify(lock);
-        if (countGrants(granted) === 0) {
-            console.log('Boundry: ✓ nothing granted without a #proposed marker (vs the accepted lock)');
+        const drift = await pipeline.verify(lock);
+        if (inParity(drift)) {
+            console.log('Boundry: ✓ the diagram is in parity with the accepted lock (no un-annotated drift)');
             return;
         }
-        console.error(`Boundry: ✗ ${countGrants(granted)} grant(s) made without a #proposed marker (vs the accepted lock)`);
-        listGrants(granted);
+        console.error(`Boundry: ✗ ${countDrift(drift)} un-annotated change(s) between the diagram and the accepted lock`);
+        listDrift(drift);
         process.exitCode = 1;
         return;
     }
     if (command === 'approve') {
-        // Approving must never launder an edge that skipped the proposal protocol.
-        // The accepted lock is the baseline: a bare edge added since the last approve
-        // is in the allow-list but not the lock, so it surfaces here; a #proposed one
-        // is excluded from the allow-list, so it passes and gets enacted below. The
-        // first approve has no lock yet — it establishes the initial accepted state.
+        // Approve folds the diagram into the lock — the only op that changes what is
+        // enforced. It refuses to accept un-annotated drift: every change must have
+        // gone through a marker (#proposed / #proposal-delete) so it was reviewable.
+        // The first approve has no lock yet — it establishes the initial accepted state.
         const lock = readLock();
         if (lock) {
-            const granted = await pipeline.verify(lock);
-            if (countGrants(granted) > 0) {
-                console.error(`Boundry: ✗ refusing to approve — ${countGrants(granted)} grant(s) were made without a #proposed marker (vs the accepted lock)`);
-                listGrants(granted);
+            const drift = await pipeline.verify(lock);
+            if (!inParity(drift)) {
+                console.error(`Boundry: ✗ refusing to approve — ${countDrift(drift)} un-annotated change(s) vs the accepted lock`);
+                listDrift(drift);
                 process.exitCode = 1;
                 return;
             }
@@ -125,21 +164,28 @@ async function main() {
             process.exitCode = 2;
             return;
         }
-        const { edges, modules } = await pipeline.annotate(readFileSync(lockFile, 'utf8'));
-        if (edges.length === 0 && modules.length === 0) {
+        const { edges, modules, removedEdges, removedModules } = await pipeline.annotate(readFileSync(lockFile, 'utf8'));
+        const total = edges.length + modules.length + removedEdges.length + removedModules.length;
+        if (total === 0) {
             console.log('Boundry: ✓ nothing to annotate — the diagram matches the accepted lock');
             return;
         }
-        console.log(`Boundry: ✎ marked ${edges.length} edge(s) and ${modules.length} box(es) #proposed:`);
+        console.log(`Boundry: ✎ staged ${edges.length + modules.length} addition(s) as #proposed, ` +
+            `${removedEdges.length + removedModules.length} removal(s) as #proposal-delete:`);
         for (const edge of edges)
-            console.log(`  ${edge.from} → ${edge.to}`);
+            console.log(`  + ${edge.from} → ${edge.to}`);
         for (const mod of modules)
-            console.log(`  [${mod.title}]`);
-        console.log('  Review the highlighted diagram, then approve or revert.');
+            console.log(`  + [${mod.title}]`);
+        for (const edge of removedEdges)
+            console.log(`  − ${edge.from} → ${edge.to}`);
+        for (const mod of removedModules)
+            console.log(`  − [${mod.title}]`);
+        console.log('  Review the highlighted diagram (boundry diff), then approve or revert.');
         return;
     }
     if (command === 'diff') {
-        const views = await pipeline.diffViews();
+        const perLayer = rest.includes('--per-layer');
+        const views = await pipeline.diffViews(perLayer);
         const diffFile = join(archDir, 'boundry.diff.likec4');
         if (views.length === 0) {
             console.log('Boundry: ✓ nothing proposed — no diff views to draw');
@@ -147,10 +193,10 @@ async function main() {
         }
         console.log(`Boundry: ✎ wrote ${views.length} diff view(s) to ${relative(process.cwd(), diffFile)}:`);
         for (const view of views) {
-            const layer = view.scope ?? 'root';
-            console.log(`  ${view.id}  (layer ${layer}, ${view.changes} change(s))`);
+            const where = perLayer ? `layer ${view.scope ?? 'root'}, ` : '';
+            console.log(`  ${view.id}  (${where}${view.changes} change(s))`);
         }
-        console.log('  Open the diagram in `likec4 serve` to review each layer.');
+        console.log('  Open the diagram in `likec4 serve` to review.');
         return;
     }
     console.error(USAGE);

package/dist/core/model/boundary-model.d.ts

@@ -88,6 +88,23 @@ export declare function newlyAllowedEdges(base: BoundaryModel, head: BoundaryMod
  * already-proposed new boxes — the annotator makes marking idempotent.
  */
 export declare function newlyAddedModules(base: BoundaryModel, head: BoundaryModel): Module[];
+/**
+ * Edges allowed at `base` but no longer at `head` — a dependency that was
+ * *removed*. A `#proposal-delete` edge stays in the model's allow-list (a pending
+ * deletion changes nothing until approved), so it is still present at `head` and
+ * never appears here. This delta is therefore exactly the set of edges deleted
+ * *without* going through a `#proposal-delete` proposal — silent removals, the
+ * mirror of {@link newlyAllowedEdges}.
+ */
+export declare function removedEdges(base: BoundaryModel, head: BoundaryModel): AllowedEdge[];
+/**
+ * Modules present at `base` but no longer at `head` — a box that was *removed*. A
+ * `#proposal-delete` box stays a module until approved, so it is still present at
+ * `head`; only a box deleted outright appears here. The mirror of
+ * {@link newlyAddedModules}, and — unlike a new box, which grants nothing — a
+ * removed box drops enforcement of its folder, so it must go through a proposal.
+ */
+export declare function removedModules(base: BoundaryModel, head: BoundaryModel): Module[];
 /**
  * The accepted state, written as a canonical string — the lock. `approve` records
  * it so change detection has a baseline it OWNS, rather than trusting whatever git

package/dist/core/model/boundary-model.js

@@ -43,6 +43,29 @@ export function newlyAddedModules(base, head) {
     const atBase = new Set(base.modules.map((m) => m.id));
     return head.modules.filter((m) => !atBase.has(m.id));
 }
+/**
+ * Edges allowed at `base` but no longer at `head` — a dependency that was
+ * *removed*. A `#proposal-delete` edge stays in the model's allow-list (a pending
+ * deletion changes nothing until approved), so it is still present at `head` and
+ * never appears here. This delta is therefore exactly the set of edges deleted
+ * *without* going through a `#proposal-delete` proposal — silent removals, the
+ * mirror of {@link newlyAllowedEdges}.
+ */
+export function removedEdges(base, head) {
+    const allowedAtHead = new Set(head.allowed.map(edgeKey));
+    return base.allowed.filter((edge) => !allowedAtHead.has(edgeKey(edge)));
+}
+/**
+ * Modules present at `base` but no longer at `head` — a box that was *removed*. A
+ * `#proposal-delete` box stays a module until approved, so it is still present at
+ * `head`; only a box deleted outright appears here. The mirror of
+ * {@link newlyAddedModules}, and — unlike a new box, which grants nothing — a
+ * removed box drops enforcement of its folder, so it must go through a proposal.
+ */
+export function removedModules(base, head) {
+    const atHead = new Set(head.modules.map((m) => m.id));
+    return base.modules.filter((m) => !atHead.has(m.id));
+}
 /**
  * The accepted state, written as a canonical string — the lock. `approve` records
  * it so change detection has a baseline it OWNS, rather than trusting whatever git

package/dist/core/pipeline/pipeline.d.ts

@@ -1,23 +1,35 @@
 import type { VisualizerPort, EnforcerPort, EnforcerConfig, CheckResult, DiffView } from "../ports/ports.js";
 import type { AllowedEdge, Module } from "../model/boundary-model.js";
-/** What the annotator turned into explicit `#proposed` proposals. */
+/** What the annotator turned into explicit proposals. */
 export interface AnnotateResult {
+    /** Additions marked `#proposed`. */
     edges: AllowedEdge[];
     modules: Module[];
+    /** Removals re-materialised as `#proposal-delete`. */
+    removedEdges: AllowedEdge[];
+    removedModules: Module[];
 }
 /**
- * What a diagram grants that the approved base did not. Both kinds of grant are
- * reported, because both let code cross a boundary that was previously closed.
+ * How the working diagram differs from the accepted `lock` — the parity gate. The
+ * diagram may differ from the lock *only* through marked proposals; anything here
+ * is un-annotated drift that would change enforcement without going through
+ * review. Additions (grants) must be `#proposed`; removals must be
+ * `#proposal-delete`. Parity holds when all four are empty.
  *
- * This lives with the pipeline rather than the ports: no driven port deals in
- * it, it is what `verify` returns.
+ * This lives with the pipeline rather than the ports: no driven port deals in it.
  */
 export interface VerifyResult {
-    /** Dependencies added without going through a `#proposed` proposal. */
+    /** Dependencies added without a `#proposed` marker (a self-grant). */
     edges: AllowedEdge[];
     /** Importer exemptions added, lifting files out of every rule. */
     exemptions: string[];
+    /** Edges deleted without a `#proposal-delete` marker (a silent removal). */
+    removedEdges: AllowedEdge[];
+    /** Modules deleted without a `#proposal-delete` marker — drops enforcement. */
+    removedModules: Module[];
 }
+/** True when the diagram is in parity with the lock — no un-annotated drift. */
+export declare function inParity(result: VerifyResult): boolean;
 /**
  * The SDK's public surface. Orchestrates the two driven ports and stays blind
  * to any concrete diagram source or linter — swap adapters, this is untouched.
@@ -26,21 +38,32 @@ export declare class Pipeline {
     private readonly visualizer;
     private readonly enforcer;
     constructor(visualizer: VisualizerPort, enforcer: EnforcerPort);
-    /** Diagram -> boundary model -> generated linter config. */
-    generate(): Promise<EnforcerConfig>;
-    /** Diagram -> boundary model -> run the linter over `sources`. */
-    check(sources: string[]): Promise<CheckResult>;
     /**
-     * What this diagram grants that the accepted `lock` did not — dependencies
-     * added without a `#proposed` marker, and importer exemptions added. Proposals
-     * are excluded from the allow-list, so anything reported here bypassed the
-     * approval protocol.
+     * Render the enforced contract — the accepted `lock` — into the linter config,
+     * so the emitted config matches exactly what `check` enforces. The lock is a
+     * serialized boundary model, engine-independent: no diagram is read here.
+     */
+    generate(lock: string): Promise<EnforcerConfig>;
+    /**
+     * Run the linter over `sources` against the enforced contract — the accepted
+     * `lock`, not the working diagram. Enforcement is engine-independent (no diagram
+     * needed) and changes only when `approve` folds the diagram into the lock, so
+     * drawing or deleting in the diagram never moves enforcement on its own. The
+     * caller runs the parity gate (`verify`) first to reject un-annotated drift.
+     */
+    check(lock: string, sources: string[]): Promise<CheckResult>;
+    /**
+     * The parity gate: how the working diagram differs from the accepted `lock`.
+     * The diagram may differ only through marked proposals — a `#proposed` edge is
+     * excluded from the allow-list, a `#proposal-delete` element stays present until
+     * approved — so anything reported here is un-annotated drift: a self-granted
+     * addition (bare edge / exemption) or a silent removal (an edge or box deleted
+     * without `#proposal-delete`). `check` runs this before enforcing, so the
+     * diagram can never silently disagree with what the lock enforces.
      *
      * The baseline is the lock — the accepted state `approve` records — not a git
-     * ref. The lock exists precisely to decouple "accepted" from "committed", so
-     * verify reads from it, exactly as `annotate` does; the two can never disagree
-     * about what "accepted" means. It also catches a committed-but-unapproved bare
-     * edge, which re-deriving a baseline from a git ref would silently absorb.
+     * ref: the lock exists precisely to decouple "accepted" from "committed", so
+     * verify reads from it, exactly as `annotate` does.
      */
     verify(lock: string): Promise<VerifyResult>;
     /**
@@ -52,19 +75,22 @@ export declare class Pipeline {
     approve(): Promise<string>;
     /**
      * Compare the diagram against a previously accepted lock and rewrite every
-     * undeclared addition — a bare new edge (a self-grant) or box — into an
-     * explicit `#proposed` proposal in the source, then paints intrinsic styling on
-     * every marker so the proposal is highlighted on every LikeC4 surface. Turns
-     * silent drift into a reviewable, colourable proposal without trusting git for
-     * the baseline.
+     * undeclared *change* into an explicit proposal in the source — symmetrically:
+     *   - an addition (a bare new edge / box) becomes `#proposed`;
+     *   - a removal (an edge or box in the lock but deleted from the diagram) is
+     *     re-materialised, tagged `#proposal-delete`, so the deletion becomes a
+     *     reviewable red proposal rather than silent drift.
+     * Then it paints intrinsic styling on every marker so the proposal is
+     * highlighted on every LikeC4 surface. Turns drift in either direction into a
+     * reviewable, colourable proposal — the input to `diff` and `approve`.
      */
     annotate(lock: string): Promise<AnnotateResult>;
     /**
-     * (Re)generate a focused diff view per layer that holds a pending change, so a
-     * reviewer sees each proposal in the scope where it is actually drawn — a
-     * proposal nested in a box is invisible once that box collapses at a wider
-     * view. Reads the diagram's own `#proposed` / `#proposal-delete` markers, so it
-     * composes with `annotate` (annotate marks drift, this frames it).
+     * (Re)generate the review views for the diagram's pending changes. By default a
+     * single `boundry_diff` landing view draws every `#proposed` / `#proposal-delete`
+     * change at once; with `perLayer`, one focused view per layer that draws a change.
+     * Reads the diagram's own markers, so it composes with `annotate` (annotate marks
+     * drift, this frames it).
      */
-    diffViews(): Promise<DiffView[]>;
+    diffViews(perLayer?: boolean): Promise<DiffView[]>;
 }

package/dist/core/pipeline/pipeline.js

@@ -1,4 +1,11 @@
-import { newlyAddedModules, newlyAllowedEdges, newlyExemptedImporters, parseModel, serializeModel, } from "../model/boundary-model.js";
+import { newlyAddedModules, newlyAllowedEdges, newlyExemptedImporters, parseModel, removedEdges, removedModules, serializeModel, } from "../model/boundary-model.js";
+/** True when the diagram is in parity with the lock — no un-annotated drift. */
+export function inParity(result) {
+    return (result.edges.length === 0 &&
+        result.exemptions.length === 0 &&
+        result.removedEdges.length === 0 &&
+        result.removedModules.length === 0);
+}
 /**
  * The SDK's public surface. Orchestrates the two driven ports and stays blind
  * to any concrete diagram source or linter — swap adapters, this is untouched.
@@ -10,27 +17,36 @@ export class Pipeline {
         this.visualizer = visualizer;
         this.enforcer = enforcer;
     }
-    /** Diagram -> boundary model -> generated linter config. */
-    async generate() {
-        const model = await this.visualizer.read();
-        return this.enforcer.render(model);
+    /**
+     * Render the enforced contract — the accepted `lock` — into the linter config,
+     * so the emitted config matches exactly what `check` enforces. The lock is a
+     * serialized boundary model, engine-independent: no diagram is read here.
+     */
+    async generate(lock) {
+        return this.enforcer.render(parseModel(lock));
     }
-    /** Diagram -> boundary model -> run the linter over `sources`. */
-    async check(sources) {
-        const model = await this.visualizer.read();
-        return this.enforcer.check(model, sources);
+    /**
+     * Run the linter over `sources` against the enforced contract — the accepted
+     * `lock`, not the working diagram. Enforcement is engine-independent (no diagram
+     * needed) and changes only when `approve` folds the diagram into the lock, so
+     * drawing or deleting in the diagram never moves enforcement on its own. The
+     * caller runs the parity gate (`verify`) first to reject un-annotated drift.
+     */
+    async check(lock, sources) {
+        return this.enforcer.check(parseModel(lock), sources);
     }
     /**
-     * What this diagram grants that the accepted `lock` did not — dependencies
-     * added without a `#proposed` marker, and importer exemptions added. Proposals
-     * are excluded from the allow-list, so anything reported here bypassed the
-     * approval protocol.
+     * The parity gate: how the working diagram differs from the accepted `lock`.
+     * The diagram may differ only through marked proposals — a `#proposed` edge is
+     * excluded from the allow-list, a `#proposal-delete` element stays present until
+     * approved — so anything reported here is un-annotated drift: a self-granted
+     * addition (bare edge / exemption) or a silent removal (an edge or box deleted
+     * without `#proposal-delete`). `check` runs this before enforcing, so the
+     * diagram can never silently disagree with what the lock enforces.
      *
      * The baseline is the lock — the accepted state `approve` records — not a git
-     * ref. The lock exists precisely to decouple "accepted" from "committed", so
-     * verify reads from it, exactly as `annotate` does; the two can never disagree
-     * about what "accepted" means. It also catches a committed-but-unapproved bare
-     * edge, which re-deriving a baseline from a git ref would silently absorb.
+     * ref: the lock exists precisely to decouple "accepted" from "committed", so
+     * verify reads from it, exactly as `annotate` does.
      */
     async verify(lock) {
         const base = parseModel(lock);
@@ -38,6 +54,8 @@ export class Pipeline {
         return {
             edges: newlyAllowedEdges(base, head),
             exemptions: newlyExemptedImporters(base, head),
+            removedEdges: removedEdges(base, head),
+            removedModules: removedModules(base, head),
         };
     }
     /**
@@ -53,29 +71,35 @@ export class Pipeline {
     }
     /**
      * Compare the diagram against a previously accepted lock and rewrite every
-     * undeclared addition — a bare new edge (a self-grant) or box — into an
-     * explicit `#proposed` proposal in the source, then paints intrinsic styling on
-     * every marker so the proposal is highlighted on every LikeC4 surface. Turns
-     * silent drift into a reviewable, colourable proposal without trusting git for
-     * the baseline.
+     * undeclared *change* into an explicit proposal in the source — symmetrically:
+     *   - an addition (a bare new edge / box) becomes `#proposed`;
+     *   - a removal (an edge or box in the lock but deleted from the diagram) is
+     *     re-materialised, tagged `#proposal-delete`, so the deletion becomes a
+     *     reviewable red proposal rather than silent drift.
+     * Then it paints intrinsic styling on every marker so the proposal is
+     * highlighted on every LikeC4 surface. Turns drift in either direction into a
+     * reviewable, colourable proposal — the input to `diff` and `approve`.
      */
     async annotate(lock) {
         const accepted = parseModel(lock);
         const head = await this.visualizer.read();
         const edges = newlyAllowedEdges(accepted, head);
         const modules = newlyAddedModules(accepted, head);
+        const removedEs = removedEdges(accepted, head);
+        const removedMs = removedModules(accepted, head);
         await this.visualizer.propose(edges, modules.map((m) => m.id));
+        await this.visualizer.proposeDeletions(removedMs, removedEs);
         await this.visualizer.styleMarkers();
-        return { edges, modules };
+        return { edges, modules, removedEdges: removedEs, removedModules: removedMs };
     }
     /**
-     * (Re)generate a focused diff view per layer that holds a pending change, so a
-     * reviewer sees each proposal in the scope where it is actually drawn — a
-     * proposal nested in a box is invisible once that box collapses at a wider
-     * view. Reads the diagram's own `#proposed` / `#proposal-delete` markers, so it
-     * composes with `annotate` (annotate marks drift, this frames it).
+     * (Re)generate the review views for the diagram's pending changes. By default a
+     * single `boundry_diff` landing view draws every `#proposed` / `#proposal-delete`
+     * change at once; with `perLayer`, one focused view per layer that draws a change.
+     * Reads the diagram's own markers, so it composes with `annotate` (annotate marks
+     * drift, this frames it).
      */
-    async diffViews() {
-        return this.visualizer.emitDiffViews();
+    async diffViews(perLayer = false) {
+        return this.visualizer.emitDiffViews(perLayer);
     }
 }

package/dist/core/ports/ports.d.ts

@@ -1,4 +1,4 @@
-import type { AllowedEdge, BoundaryModel } from '../model/boundary-model.js';
+import type { AllowedEdge, BoundaryModel, Module } from '../model/boundary-model.js';
 /** A driven port: turns some diagram source into the boundary model. */
 export interface VisualizerPort {
     read(): Promise<BoundaryModel>;
@@ -14,6 +14,15 @@ export interface VisualizerPort {
      * marked is left alone. Source-preserving; never an LLM edit.
      */
     propose(edges: AllowedEdge[], moduleIds: string[]): Promise<void>;
+    /**
+     * Re-materialise elements and edges that were deleted from the diagram (present
+     * in the accepted lock, absent now) back into the source, tagged
+     * `#proposal-delete`, so a removal becomes a reviewable red proposal instead of
+     * silent drift. Modules are reconstructed with their folder/file mapping and
+     * nesting; edges are re-declared by fqn. The inverse of `approve` for removals.
+     * Idempotent — anything already present is left alone. Never an LLM edit.
+     */
+    proposeDeletions(modules: Module[], edges: AllowedEdge[]): Promise<void>;
     /**
      * Paint intrinsic `style { color … }` on every edge/box carrying a marker, so a
      * proposal is highlighted on every LikeC4 surface — base views and the
@@ -23,25 +32,26 @@ export interface VisualizerPort {
      */
     styleMarkers(): Promise<void>;
     /**
-     * (Re)generate a focused diff view for every layer that holds a pending
-     * change — an edge or box tagged `#proposed` or `#proposal-delete`. Each view
-     * is scoped to the tightest element that contains the change (the model root
-     * for a top-level one), because a proposal nested inside a box is invisible
-     * once that box collapses at a wider scope. A derived artifact: overwritten
+     * (Re)generate the review views for the diagram's pending changes — edges and
+     * boxes tagged `#proposed` or `#proposal-delete`. By default a single
+     * `boundry_diff` landing view draws every change at once, uncollapsed and
+     * uniformly highlighted. With `perLayer`, one focused `view … of <scope>` is
+     * emitted per layer that draws a change instead. A derived artifact: overwritten
      * each run, and removed when nothing is proposed. Returns one entry per view.
      */
-    emitDiffViews(): Promise<DiffView[]>;
+    emitDiffViews(perLayer?: boolean): Promise<DiffView[]>;
 }
 /**
- * One emitted diff view: a single layer (element scope) that holds at least one
- * pending change, and how many changes fall in it.
+ * One emitted diff view. For the default single view there is one entry
+ * (`boundry_diff`) counting every pending change; in `perLayer` mode there is one
+ * per layer, each scoped to an element and counting the changes that fall in it.
  */
 export interface DiffView {
-    /** The generated view id, e.g. `boundry_diff_root` or `boundry_diff_billing`. */
+    /** The generated view id — `boundry_diff`, or `boundry_diff_<scope>` per layer. */
     id: string;
-    /** The scope element's fqn, or undefined for the model root. */
+    /** perLayer only: the scope element's fqn, or undefined for the model root. */
     scope?: string;
-    /** How many pending `#proposed` / `#proposal-delete` changes this layer holds. */
+    /** How many pending `#proposed` / `#proposal-delete` changes this view holds. */
     changes: number;
 }
 /** A generated linter config artifact. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "boundry",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Compile a C4 architecture diagram into a deterministic dependency linter. Deterministic architectural guardrails for AI agents and humans.",
   "type": "module",
   "license": "MIT",