yichus 0.3.2 → 0.3.4

package/dist/main.js

@@ -301,15 +301,16 @@ var VOCABULARY = {
     modelRing: "violet ring: the entry reaches the model  <- entries[].model",
     reachedBy: "under each resource in the rack: how many routes reach it, the resource drawn at that share of the routes (never smaller than its name)  <- entries[].db, model, net, beside.resources",
     netRing: "orange ring: the entry reaches the network  <- entries[].net",
-    guard: "red diamond on the path where the check happens, its name above, failure stem below  <- entries[].guards, wrappers[].guards, entries[].passed[].guards, entries[].beside.guards",
+    guard: 'red diamond on the path where the route can refuse, the check named above it (the program\u2019s definition it calls, "<table> row found", "<table> row\u2019s <field>" for a branch on a field of a read row, or "a test in <definition>" for a comparison or library answer that definition branches on), failure stem below; a branch no path refuses on is not drawn here  <- entries[].guards (structure.scenarios[]: branches where one arm ends only in refusals), wrappers[].guards, entries[].passed[].guards, entries[].beside.guards',
+    policy: "under the db, each table with its access policy as the access check proves it: own = each caller reads and writes only their own row; no row rule = the access check holds no rule over its rows, so who reads or writes which row is decided only by the code drawn on the routes; guarded = rows pass the named guard; role \u2026 only = only callers with that role reach its rows; unchecked = the access check gave this table no verdict; a policy ending \u201Cbroken\u201D is one the code breaks, and \u201Cnot proven\u201D one the check could not settle; counted when the tables are too many to list  <- resources[kind=db].policies",
     hull: "translucent region in the hull band: paths merge into it, run one shared stretch, and split; everything inside it runs inside the wrapper; its right wall, drawn in the hull ink, is where the wrapper returns  <- wrappers[]",
     socket: "broken-rim ring: a function the caller hands in runs here; its centre fills like a station  <- entries[].passed[]",
     token: "small grey word under a path: the value the caller fixes for the wrapper  <- entries[].policy",
     afterDot: "dot in the after band: a call the entry makes after its wrapper returns  <- entries[].beside.calls",
     builder: "plus-disc under a station with the call that builds the handle there  <- uses[how=local].builtBy",
     unknown: 'a ? in a circle on the rail, with "partly traced" beside it and a sentence on hover: the engine traced the handle only on some paths  <- uses[how=mixed]',
-    fork: "three prongs and a type: a choice keyed on a plain String or Int; under the mark that makes it, else on the quiet line  <- keyed[]",
-    bundle: 'one cable with how many routes it carries ("4 routes"): entries with the same wrapper and identical marks; its title names every route; opening it draws each one  <- bundles[]',
+    fork: 'three prongs and a type: a choice keyed on a plain String or Int; under the mark that makes it (under a list of checks, named by the check it is inside: "can_see on String"), else on the quiet line  <- keyed[]',
+    bundle: 'one cable with how many routes it carries ("4 routes"): entries with the same wrapper and identical marks; its title names every route: by the one part of the path that differs, among at most six ("/{tags, tasks}/sync"), or each by name when there are at most four; else a pattern with *; opening it draws each one  <- bundles[]',
     anchor: "where the rail starts: platform when no definition of the program can make the handle; ? when the trace stops and the program could  <- uses[].anchor",
     step: 'loop arc with a type on the quiet line: functions of the package take that type and return it; gathered, a count in words ("8 steps"), as are choices, db uses and generic parts  <- steps[]',
     loop: "loop arc with package names: packages whose types lead back to themselves  <- phases.cycles",
@@ -330,6 +331,7 @@ var VOCABULARY = {
     replyLoop: `one solid arc from a lane's foot back into the program, with one loop node naming what repeats the step within one call, and "each call of \u2026 runs it" naming the routes that run the rounds  <- programs[].engines[].replies, loop, starters`,
     replaced: 'a check named "(in place of \u2026)": in the compared base record the same route had that other check at the same place, and it is on that route no longer; says nothing about whether the two do the same  <- compare.replaced[]'
   },
+  names: "every check, call and table name is a label the code's author (often an AI) chose; the picture proves where a check runs, what it is given and what happens when it fails, never what it decides: a reader who doubts the author reads that rule itself.",
   rule: "every guard, wrapper, socket, fork, handle, station, step and resource the engine records is drawn at its fixed place, in every view; where nothing is drawn, the engine checked and found none."
 };
 var bare = (id) => String(id).split("::").pop();
@@ -449,9 +451,51 @@ function programsOf(st, layers = null) {
   });
 }
 var outsideResourcesOf = (steps) => uniq((steps || []).map((e) => e.resource).filter((r) => r === "model" || r === "net"));
+var leavesUnder = (t) => t.kind === "leaf" ? [t] : t.arms.flatMap((a) => leavesUnder(a.next));
+function refusingForks(tree) {
+  const out = [];
+  const go = (t) => {
+    if (!t || t.kind !== "node") return;
+    const refused = t.arms.map((a) => leavesUnder(a.next).every((l) => l.outcome.kind === "refused"));
+    if (t.concern?.layer !== "platform" && refused.some(Boolean) && !refused.every(Boolean)) out.push(t);
+    t.arms.forEach((a) => go(a.next));
+  };
+  go(tree);
+  return out;
+}
+var forkId = (n, own) => n.from.kind === "call" && own.has(n.from.callee) ? n.from.callee : n.id;
+var forkParts = (n, own) => n.from.kind === "call" && own.has(n.from.callee) ? { definition: n.from.callee } : n.from.kind === "read" && n.from.table ? { table: n.from.table, ...n.from.path?.length ? { field: n.from.path.join(".") } : {} } : n.from.site ? { definition: n.from.site } : {};
+var forkKey = (own) => (n) => n.from.kind === "call" && own.has(n.from.callee) ? n.from.callee : `${forkLabel(n, own)} ${n.from.site}`;
+var forkLabel = (n, own) => n.from.kind === "call" ? own.has(n.from.callee) ? bare(n.from.callee) : `a test in ${bare(n.from.site)}` : n.from.kind === "read" && n.from.table ? n.from.path?.length ? `${n.from.table} row\u2019s ${n.from.path.join(".")}` : `${n.from.table} row found` : n.from.site ? `a test in ${bare(n.from.site)}` : "a computed branch";
+var policyWord = (r) => {
+  const rule = policyRule(r);
+  if (rule === "unchecked") return rule;
+  return r.status === "violated" ? `${rule}, broken` : r.proven ? rule : `${rule}, not proven`;
+};
+var policyRule = (r) => {
+  const roles = () => r.roles.join(", "), guards = () => r.guards.join(", ");
+  switch (r.policyKind) {
+    case "OwnerScoped":
+      return "own";
+    case "Public":
+      return "no row rule";
+    case "Guarded":
+      return `guarded by ${guards()}`;
+    // with no guard, only the roles reach its rows
+    case "GuardedOrRoles":
+      return r.guards.length ? `guarded by ${guards()} or role ${roles()}` : `role ${roles()} only`;
+    case "PublicReadRoleWrite":
+      return `anyone reads; role ${roles()} writes`;
+    default:
+      return "unchecked";
+  }
+};
 function buildSystemMap(engine, { program }) {
   for (const [k, v] of Object.entries(engine)) if (!v.ok) throw new Error(`${k}: ${v.error}`);
   const report = engine.report, st = engine.structure, abs = engine.abstractions.abstractions, layers = engine.layers.layers;
+  const whole = (s) => s.tree && !s.truncated && !s.unsupported;
+  const trees = new Map((st.scenarios || []).filter(whole).map((s) => [s.entry, refusingForks(s.tree)]));
+  const ownDefs = new Set(layers.packages.flatMap((p) => p.definitions.map((d) => `${p.name}::${d.name}`)));
   const routes = (report.surface.routes || []).slice().sort((a, b) => a.path.localeCompare(b.path));
   const engEntry = new Map(st.entries.map((e) => [e.entry, e]));
   const shapes = new Map(abs.routeShapes.map((r) => [r.path, r]));
@@ -466,11 +510,17 @@ function buildSystemMap(engine, { program }) {
     resources: outsideResourcesOf(inst.besideEffectSteps),
     from: "abstractions.instantiations[].beside*"
   });
+  const resultOf = (sig) => sig.includes("->") ? sig.slice(sig.lastIndexOf("->") + 2).trim() : null;
+  const returnsCallers = (g) => {
+    const result = resultOf(g.signature);
+    return result !== null && (/^[a-z]\w*$/.test(result) || (g.parameterGroups || []).flat().some((sl) => sl.role === "function" && sl.returnType === result));
+  };
+  const wraps = (g) => !!g && (/\bIO\[/.test(g.signature) || g.envelope.effects.length > 0 || returnsCallers(g) && (g.envelope.guards.length > 0 || g.envelope.dispatchesOn.length > 0));
   const entries = routes.map((r) => {
     const key = `route:${r.path}`;
     const ee = engEntry.get(key);
     const rs = shapes.get(r.path);
-    const wrapper = rs.shapedByGenerator;
+    const wrapper = wraps(gens.get(rs.shapedByGenerator)) ? rs.shapedByGenerator : null;
     const inst = wrapper ? insts.find((i) => i.callerId === rs.handlerId && i.generatorId === wrapper) : null;
     const passed = (inst ? inst.slotBindings : []).filter((sb) => ["function", "effect"].includes(sb.slotRole)).map((sb) => ({
       slot: sb.slotName,
@@ -507,8 +557,9 @@ function buildSystemMap(engine, { program }) {
       model: ee.resources.includes("model"),
       net: ee.resources.includes("net"),
       writes: reach.some((e) => isWrite(e.op)),
-      guards: rs.handlerGuards.map(bare),
-      guardIds: rs.handlerGuards,
+      // every branch of the entry's own where a path refuses (a wrapper's are
+      // its own, and a function handed to it keeps its own slot)
+      ...trees.has(key) ? ((forks) => ({ guards: forks.map((n) => forkLabel(n, ownDefs)), guardIds: forks.map((n) => forkId(n, ownDefs)), guardParts: forks.map((n) => forkParts(n, ownDefs)) }))(uniqBy(trees.get(key).filter((n) => n.concern?.layer !== "cross" && !(inst ? inst.slotBindings : []).some((sb) => (sb.guards || []).includes(forkId(n, ownDefs)))), forkKey(ownDefs))) : { guards: rs.handlerGuards.map(bare), guardIds: rs.handlerGuards },
       wrapper,
       via: rs.viaSpecialization ? bare(rs.viaSpecialization) : null,
       policy: (inst ? inst.slotBindings : []).filter((s) => s.slotRole === "semantic-object").map((s) => s.value).filter(Boolean),
@@ -598,7 +649,12 @@ function buildSystemMap(engine, { program }) {
   }
   const present = uniq(st.ioKinds.flatMap((b) => b.resources));
   const tables = uniq(entries.flatMap((e) => [...e.reach, ...e.beside ? e.beside.effects : []].map((r) => r.table))).sort();
-  const resources = ["db", "model", "net"].filter((k) => present.includes(k)).map((k) => ({ kind: k, ...k === "db" ? { tables } : {}, from: "structure.ioKinds[].resources" }));
+  const policies = engine.access ? Object.fromEntries(engine.access.report.resources.filter((r) => tables.includes(r.resource)).map((r) => [r.resource, policyWord(r)])) : null;
+  const resources = ["db", "model", "net"].filter((k) => present.includes(k)).map((k) => ({
+    kind: k,
+    ...k === "db" ? { tables, ...policies ? { policies, policyFrom: "access.report.resources[].policyKind, guards, roles" } : {} } : {},
+    from: "structure.ioKinds[].resources"
+  }));
   const ghostResources = ["db", "model", "net"].filter((k) => !present.includes(k)).map((k) => ({ kind: k, from: "structure.ioKinds[] checked: no site of this kind" }));
   const transports = uniq(st.entries.map((e) => e.transport));
   const callers = [];
@@ -712,13 +768,22 @@ function bundlesOf(entries, uses, keyed) {
 }
 function pathPattern(paths) {
   if (paths.length === 1) return paths[0];
+  const sorted = [...paths].sort();
   const segs = paths.map((p) => p.split("/"));
   const n = Math.min(...segs.map((s) => s.length));
   const out = [];
+  const vary = [];
   for (let i = 0; i < n; i++) {
     const v = uniq(segs.map((s) => s[i]));
     out.push(v.length === 1 ? v[0] : "*");
+    if (v.length > 1) vary.push([i, v]);
+  }
+  if (segs.every((s) => s.length === n) && vary.length === 1 && vary[0][1].length <= 6) {
+    const [[i, v]] = vary;
+    out[i] = `{${[...v].sort().join(", ")}}`;
   }
+  if (segs.every((s) => s.length === n) && vary.length <= 1) return out.join("/");
+  if (paths.length <= 4) return sorted.join(", ");
   if (segs.every((s) => s.length === n)) return out.join("/");
   let k = 0;
   while (k < n && out[k] !== "*") k++;
@@ -750,6 +815,7 @@ var STRUCTURAL = /* @__PURE__ */ new Set([
   "vars",
   "id"
 ]);
+var DESCRIBED = /* @__PURE__ */ new Set(["guards", "policies", "policyFrom"]);
 var WHAT = {
   path: "an action the app answers",
   routes: "an action the app answers",
@@ -758,10 +824,15 @@ var WHAT = {
   roles: "a permission an action requires, held by a person's role or by the app's own server",
   policy: "a setting an action passes to shared code",
   tokens: "a setting an action passes to shared code",
-  fields: "an operation a pluggable part offers"
+  fields: "an operation a pluggable part offers",
+  field: "a field of a kind of record the app keeps"
 };
 var PACKAGE = "a section of the program";
 var DEFINITION = "a piece of the program";
+var MADE = "a kind of value the program works out";
+var OFFERED = "a part the program offers for others to use";
+var DEFINED = { makes: MADE, exports: OFFERED, exported: OFFERED };
+var PACKAGE_KEYS = /* @__PURE__ */ new Set(["package", "pkg", "instantiatingPackages"]);
 var VALUE = "a kind of value";
 var TYPES = /* @__PURE__ */ new Set(["type", "types", "signature"]);
 var WORD = /[A-Za-z_][\w/]*::\w+|[A-Za-z_]\w*/g;
@@ -781,7 +852,7 @@ var leaves = (record, visit) => {
     if (typeof v === "string") visit(v, key);
     else if (Array.isArray(v)) v.forEach((x) => walk3(x, key));
     else if (v && typeof v === "object") {
-      for (const [k, x] of Object.entries(v)) if (!skipped(k, x)) walk3(x, k);
+      for (const [k, x] of Object.entries(v)) if (!skipped(k, x) && !DESCRIBED.has(k)) walk3(x, k);
     }
   };
   walk3(record, null);
@@ -789,16 +860,19 @@ var leaves = (record, visit) => {
 function nameableParts(map, own) {
   const found = /* @__PURE__ */ new Map();
   const theirs2 = (pkg) => !own || own.has(pkg);
+  const rank = (what) => [OFFERED, MADE, PACKAGE].indexOf(what);
   const add = (code, what) => {
-    if (code && !found.has(code) && !(code in PREDEF_WORDS) && (what !== PACKAGE || theirs2(code))) found.set(code, what);
+    if (code && (!found.has(code) || rank(what) > rank(found.get(code))) && !(code in PREDEF_WORDS) && (what !== PACKAGE || theirs2(code))) found.set(code, what);
   };
-  const idParts = (id) => {
+  const idParts = (id, key) => {
     const i = id.lastIndexOf("::");
     if (!theirs2(id.slice(0, i))) return;
     add(id.slice(0, i), PACKAGE);
-    add(id.slice(i + 2), DEFINITION);
+    add(id.slice(i + 2), DEFINED[key] ?? DEFINITION);
   };
+  const isPackage = (s, key) => own?.has(s) || PACKAGE_KEYS.has(key) || s.includes("/");
   leaves(map, (s, key) => {
+    if (key === "guardIds" && s.startsWith("route:")) return;
     if (s.startsWith("route:")) return add(s.slice(6), WHAT.path);
     if (TYPES.has(key)) {
       for (const w of s.match(WORD) ?? []) if (w.includes("::")) idParts(w);
@@ -806,12 +880,12 @@ function nameableParts(map, own) {
       return;
     }
     if (s.includes("::")) {
-      for (const w of s.match(WORD)) if (w.includes("::")) idParts(w);
+      for (const w of s.match(WORD)) if (w.includes("::")) idParts(w, key);
       return;
     }
     if (STRUCTURAL.has(key)) return;
-    if (key === "name" || key === "package" || key === "pkg" || key === "instantiatingPackages" || key === "cycles" || key === "to") return add(s, s.includes("/") ? PACKAGE : DEFINITION);
-    add(s, WHAT[key] ?? DEFINITION);
+    if (key === "name" || PACKAGE_KEYS.has(key) || key === "cycles" || key === "to" || own?.has(s)) return add(s, isPackage(s, key) ? PACKAGE : DEFINITION);
+    add(s, WHAT[key] ?? DEFINED[key] ?? DEFINITION);
   });
   for (const b of map.bundles ?? []) if (b.count > 1) found.delete(b.label);
   return [...found].map(([code, what]) => ({ code, what })).sort((a, b) => a.code.localeCompare(b.code));
@@ -863,19 +937,22 @@ var VOCABULARY2 = {
   version: MARKS_VERSION,
   added: ["outcome"],
   marks: {
-    entryHead: "arrowhead where a request comes in; the rack above the tree has one per described entry, then one dashed line counting the entries no scenario describes, which opens to draw each of them struck  <- entries[], ghosts[]",
+    entryHead: 'arrowhead where a request comes in; the rack above the tree has one per described entry, then one dashed line counting the entries no scenario describes, which opens to draw each of them struck (when no entry is described, that one line is all the rack draws, and it only counts them: "8 entries"; a scenario is a requirement someone wrote, so its absence says nothing about tests); under the head, "same steps as \u2026" names the entries whose trees take the same steps on their own tables and checks  <- entries[], ghosts[], entries[].sameShape',
     guard: "red diamond: the declared sign-in or role check, the first branch of every entry that has one; its failure stem ends in a refusal  <- tree node with from.kind=guard",
-    fork: "three prongs: a branch the code takes on the request, the caller, a value read from a table, or a call result; the arm each line takes is written where it leaves  <- tree nodes",
-    station: "ring on a line: an effect on that path, its verb and table beside it; filled = it writes  <- arms[].effects, entry.effects",
+    fork: 'three prongs: a branch the code takes on the request, the caller, a value read from a table, or a call result, with "\u2190 request", "\u2190 caller" or "\u2190 <table> as read" saying where what it tests comes from; the arm each line takes is written where it leaves  <- tree nodes, nodes[].from.sources',
+    docs: "under the names line, in italic, the comment the author wrote above each named check, marked unchecked: what the author says it decides, which the engine does not confirm  <- docs (structure.docs)",
+    rows: `under the tree, for each table its stations touch (and those of the entries named in "same steps as"), what one row holds, by its checked type: "posts holds List[Post(id: String, \u2026, edited: Bool)]"; a field that is a record gives only its type's name, a choice of bare cases its cases ("visibility: Open | Members")  <- rows (structure.rows)`,
+    station: "ring on a line: an effect on that path, its verb and table beside it; filled = it writes; mint = the platform hands out a fresh row id. Under it, in grey, the row it touches (the caller's row; the row named by a request field; one fixed row; a new row; every row, and the guard that keeps them) and, for a write, whether the row is replaced whole or updated from what it read, then where what it writes comes from, field by field (\u2190 caller, \u2190 request.<field>, \u2190 a literal, \u2190 new id, \u2190 a call and what it was computed from)  <- arms[].effects[].key, value, kept (access report.findings[operation=keep_visible].provenBy)",
     modelRing: "violet ring: the path reaches the model  <- effects[resource=model]",
     netRing: "orange ring: the path reaches the network  <- effects[resource=net]",
     outcome: "the end of a path: a cap with what the request gets back (a constructor, or a refusal with its status and code); red when a claim fails there or a check reports a witness that ends there, green when every obligation that failed there at the base is checked here and holds, hollow and dashed (unchecked) when a claim there is inconclusive or an obligation that failed at the base is no longer checked, grey otherwise  <- leaves",
     unchecked: "a hollow dashed cap and a ? tick: the engine cannot say whether the claim holds on this path (a step it could not open, a table it could not name, an answer it could not decide), or what failed here at the base is not checked here; never counted as holding  <- claims[verdict=inconclusive], leaves[].gaps, diff.unresolved",
     struck: "a struck ghost: something checked and found absent (an entry nobody described, a write a claim says a path must not make)  <- ghosts[], claims holding with not",
     bundle: "a cable with a count: a subtree too large for this view; opening it draws that part with a breadcrumb  <- derived from the tree",
-    compared: 'a line under the rack, always there: "compared with <base> \xB7 N fixed \xB7 M still failing", or "no base compared" in faint text  <- diff',
+    compared: 'a line under the rack when a base was compared: "compared with <base> \xB7 N fixed \xB7 M still failing"; with no base, no line  <- diff',
     hull: `a shaded box on the line: a step that is not the handler's own work, folded (a wrapper's guard or short-circuit, the platform's declared check or the transaction it runs the plan in, work beside the wrapper, a wrapper's work after the handler); it keeps what the step answers instead of running the handler: the effects it makes before its test above the arms, then one row per arm read as a side stub (the arm, the effects that arm makes, its struck writes, what the request gets, ticks), then "continue"; opening it draws the step's own tree; drawn inline, the same hull is a light band behind the step and its exits, with its role and where it comes from above its test, so either way it reads as not the handler's own work  <- tree nodes[concern.role], entries[].steps`
   },
+  names: "every check, call and table name is a label the code's author (often an AI) chose; the picture proves where a check runs, what it is given and what happens when it fails, never what it decides: a reader who doubts the author reads that rule itself.",
   rule: "every entry, branch, arm, effect and outcome the engine computes is drawn, a folded step's inside its box and an undescribed entry behind the rack's one line; the author's words appear only on ids the engine computed, in italic, with the code name beside them.",
   concerns: "where each branch and effect comes from in value flow (concern.layer, effects[].layer): core = the handler's own work, a function it hands its wrapper or its body when it has none; cross = the wrapper its route shape names, shared with other entries; beside = the handler's code outside the wrapper call; platform = the route's declared authority, or the transaction the platform runs a plan in (its arms that give up or cannot confirm skip the handler's work). Roles come from which arms reach the handler, never from names."
 };
@@ -953,6 +1030,11 @@ function buildWhatHappens(engine, { program, base = null, baseLabel = "base" } =
   const claims = st.claims || { scenarios: [], undescribed: (st.scenarios || []).map((s) => s.entry) };
   const byEntry = new Map(claims.scenarios.filter((s) => s.status === "matched").map((s) => [s.entry, s]));
   const routes = new Map((st.entries || []).map((e) => [e.entry, e]));
+  const kept = new Map((engine.access?.report?.findings || []).filter((f) => f.operation === "keep_visible" && f.kind === "GuardProven" && f.status === "holds").map((f) => [`${f.package}::${f.binding}\0${f.resource}`, `${(f.provenBy || []).join(" and ")} passes for the caller and the row`]));
+  const withKept = (es) => es.map((e) => {
+    const by = e.kind === "DbQuery" && e.tables.length === 1 ? kept.get(`${e.site}\0${e.tables[0]}`) : null;
+    return by ? { ...e, kept: by } : e;
+  });
   const entries = st.scenarios.map((s) => {
     const meta = routes.get(s.entry) || {};
     const sc = byEntry.get(s.entry);
@@ -960,7 +1042,7 @@ function buildWhatHappens(engine, { program, base = null, baseLabel = "base" } =
     const copy = (t) => {
       if (!t) return null;
       if (t.kind === "leaf") return { ...t, words: names.get(t.id) || null, claims: [], witnesses: [], status: "grey" };
-      return { ...t, words: names.get(t.id) || null, arms: t.arms.map((a) => ({ ...a, words: names.get(a.id) || null, next: copy(a.next) })) };
+      return { ...t, words: names.get(t.id) || null, arms: t.arms.map((a) => ({ ...a, effects: withKept(a.effects), words: names.get(a.id) || null, next: copy(a.next) })) };
     };
     return {
       entry: s.entry,
@@ -970,7 +1052,7 @@ function buildWhatHappens(engine, { program, base = null, baseLabel = "base" } =
       transport: meta.transport || null,
       title: sc?.title || null,
       described: !!sc,
-      effects: s.effects,
+      effects: withKept(s.effects),
       tree: copy(s.tree),
       leafCount: Number(s.leafCount),
       truncated: s.truncated,
@@ -980,6 +1062,17 @@ function buildWhatHappens(engine, { program, base = null, baseLabel = "base" } =
       from: "structure.scenarios[]"
     };
   });
+  const shapeOf = (e) => {
+    const eff = (x) => `${x.op}${x.key ? `@${x.key.kind}` : ""}${x.value ? `<${x.value.kind}` : ""}${x.kept ? "|kept" : ""}`;
+    const go = (t) => !t ? "" : t.kind === "leaf" ? `(${t.outcome.kind}:${(t.outcome.statuses || (t.outcome.status ? [t.outcome.status] : [])).join("/")})` : `[${t.from.kind}${t.arms.map((a) => `{${a.effects.map(eff).join(",")}${go(a.next)}}`).join("")}]`;
+    return `${(e.effects || []).map(eff).join(",")}${go(e.tree)}`;
+  };
+  const byShape = /* @__PURE__ */ new Map();
+  for (const e of entries) byShape.set(shapeOf(e), [...byShape.get(shapeOf(e)) || [], e.entry]);
+  for (const e of entries) {
+    const same = byShape.get(shapeOf(e)).filter((x) => x !== e.entry);
+    if (same.length) e.sameShape = { entries: same, from: "derived: entries[] trees equal in node kinds, arms, effect verbs, row keys and value kinds, and outcomes" };
+  }
   const entryOf = new Map(entries.map((e) => [e.entry, e]));
   const leafById = new Map(entries.flatMap((e) => leavesOf(e.tree).map((l) => [l.id, l])));
   const checked = [], notes = [], refused = [], mismatches = [];
@@ -1085,6 +1178,18 @@ function buildWhatHappens(engine, { program, base = null, baseLabel = "base" } =
     refused,
     mismatches,
     diff,
+    // the comment above each definition, as its author wrote it (structure.docs); never checked
+    docs: ((callees) => Object.fromEntries(Object.entries(st.docs || {}).filter(([id]) => callees.has(id))))(
+      new Set(entries.flatMap((e) => {
+        const ids = [];
+        walk(e.tree, (n) => {
+          if (n.kind === "node" && n.from?.kind === "call") ids.push(n.from.callee);
+        });
+        return ids;
+      }))
+    ),
+    // what each table holds, by its checked row type (structure.rows)
+    rows: Object.fromEntries(Object.entries(st.rows || {}).map(([table, schema]) => [table, rowShape(schema)])),
     counts: {
       entries: entries.length,
       described: entries.length - ghosts.length,
@@ -1098,6 +1203,14 @@ function buildWhatHappens(engine, { program, base = null, baseLabel = "base" } =
     evidence: { tools: ["api_organize:structure", ...engine.access ? ["api_access_check"] : []], derived: ["diff: base red leaves matched by id, their failed obligations by identity"] }
   };
 }
+var typeName = (s) => s.type ? s.type.split("::").pop() : null;
+var fieldType = (s) => ({ string: "String", int: "Int", float64: "Float64", bool: "Bool", unit: "Unit", json: "Json" })[s.kind] || (s.kind === "list" ? `List[${fieldType(s.element)}]` : s.kind === "unsupported" ? s.rendered : s.kind === "union" && s.variants.length && s.variants.every((v) => !v.fields.length) ? s.variants.map((v) => v.tag).join(" | ") : typeName(s));
+function rowShape(s) {
+  if (s.kind === "list") return `List[${rowShape(s.element)}]`;
+  if (s.kind === "struct") return `${typeName(s)}(${s.fields.map((f) => `${f.name}: ${fieldType(f)}`).join(", ")})`;
+  if (s.kind === "union") return s.variants.map((v) => v.fields.length ? `${v.tag}(${v.fields.map((f) => `${f.name}: ${fieldType(f)}`).join(", ")})` : v.tag).join(" | ");
+  return fieldType(s);
+}
 function stationLabel(e) {
   const verb = e.op === "mint id" ? "mint" : e.op;
   if (e.tables.length) return `${verb} \xB7 ${e.tables.join(", ")}`;
@@ -1152,6 +1265,7 @@ var Step = z3.looseObject({ op: z3.string(), tables: z3.array(z3.string()).defau
 var Route = z3.looseObject({
   path: z3.string(),
   handler: z3.string(),
+  handlerBinding: z3.string(),
   authority: z3.string().optional(),
   tables: z3.array(z3.string()).default([]),
   inferredSteps: z3.array(Step).default([])
@@ -1170,8 +1284,10 @@ var Table = z3.looseObject({
 });
 var Report = z3.looseObject({
   surface: z3.looseObject({ routes: z3.array(Route).default([]) }).default({ routes: [] }),
-  dataModel: z3.looseObject({ tables: z3.array(Table).default([]) }).default({ tables: [] })
+  dataModel: z3.looseObject({ tables: z3.array(Table).default([]) }).default({ tables: [] }),
+  shape: z3.looseObject({ packages: z3.array(z3.looseObject({ name: z3.string() })).default([]) }).default({ packages: [] })
 });
+var handlerOf = (report, route) => route.handlerBinding.includes("::") ? route.handlerBinding : `${report.shape.packages[0]?.name}::${route.handlerBinding}`;
 var Entry = z3.looseObject({ entry: z3.string(), resources: z3.array(z3.string()).default([]) });
 var Structure = z3.looseObject({ entries: z3.array(Entry).default([]) });
 var ACCESS_RULES = {
@@ -1252,11 +1368,36 @@ function accessQuestion(table, names) {
     ask: `Your app saves "${shown(names, table.name)}"${table.name in names ? "" : " records"}. Who should be able to see one, and who should be able to change it?`,
     why: "Without a rule the app has no way to know a record is private. Yichus checks every place the app reads or changes these records against the rule you choose.",
     choices: [
-      { id: "owner", label: "Only the person who created it", means: "Every read and write is tied to the signed-in person, and the check proves no one reaches another person's records. No one else, not even a manager, sees or changes them, so anything someone else decides about them, such as an approval, belongs in records only the person who decides it may change." },
-      { id: "shared", label: "Only the people a rule lets in", means: "For example the members of a team, or the people a record was shared with. Every read and change goes through that rule, except work done under a role you name, such as an administrator or the app's own server, and the check proves nothing else skips it." },
-      { id: "server-only", label: "No person, only the app's own server", means: "Records the app keeps for itself, such as which number belongs to whom or which messages it has already seen. Only work the app's own server starts may read or change them, and the check proves nothing a person calls reaches them." },
-      { id: "everyone-reads", label: "Everyone can see it; only certain roles can change it", means: "Anyone can read; changes need a role the app gives out." },
-      { id: "public", label: "Anyone, even without signing in", means: "Nothing in these records is private." }
+      {
+        id: "owner",
+        label: "Only the person who created it",
+        means: "Every read and write is tied to the signed-in person, and the check proves no one reaches another person's records. No one else, not even a manager, sees or changes them, so anything someone else decides about them, such as an approval, belongs in records only the person who decides it may change.",
+        unchecked: "Decisions someone else should make about these records, such as an approval: the person who creates one can change all of it."
+      },
+      {
+        id: "shared",
+        label: "Only the people a rule lets in",
+        means: "For example the members of a team, or the people a record was shared with. Every read and change goes through that rule, except work done under a role you name, such as an administrator or the app's own server, and the check proves nothing else skips it.",
+        unchecked: "Whether the rule lets in the right people. The check proves every read and change goes through it; who it lets in is what your agent wrote."
+      },
+      {
+        id: "server-only",
+        label: "No person, only the app's own server",
+        means: "Records the app keeps for itself, such as which number belongs to whom or which messages it has already seen. Only work the app's own server starts may read or change them, and the check proves nothing a person calls reaches them.",
+        unchecked: "What the app's own server does with these records."
+      },
+      {
+        id: "everyone-reads",
+        label: "Everyone can see it; only certain roles can change it",
+        means: "Anyone can read; changes need a role the app gives out.",
+        unchecked: "Who is given the role: that is up to sign-in."
+      },
+      {
+        id: "public",
+        label: "Anyone, even without signing in",
+        means: "Nothing in these records is private.",
+        unchecked: "Nothing protects these records: anyone, even without signing in, can read, change and delete every one."
+      }
     ],
     fact: `The program stores rows in "${table.name}" (policy declared: ${table.policy ?? "none"}).`
   };
@@ -1270,8 +1411,18 @@ function togetherQuestion(table, handlers, names) {
     ask: `Two requests change the same record in "${shown(names, table.name)}" at the same moment (${who}). What should happen?`,
     why: "When a request reads a record and then writes it back, a second request in between can be silently lost, or both can pass a limit only one should, such as two people taking the last spot. People rarely notice until data goes missing.",
     choices: [
-      { id: "keep-both", label: "Both changes are kept", means: "Each change happens as one indivisible step that sees the one before it, so neither can overwrite the other unseen and a limit the app checks is never passed twice; the check proves no change is lost." },
-      { id: "refuse-second", label: "The second is refused and they try again", means: "A change made to an out-of-date copy is turned away; the check proves no change is lost." }
+      {
+        id: "keep-both",
+        label: "Both changes are kept",
+        means: "Each change happens as one indivisible step that sees the one before it, so neither can overwrite the other unseen and a limit the app checks is never passed twice; the check proves no change is lost.",
+        unchecked: "A limit counted across many records, such as sign-ups against the spots on a shift. A rule you give can check that, with a scenario that runs every action that changes the records the rule is about."
+      },
+      {
+        id: "refuse-second",
+        label: "The second is refused and they try again",
+        means: "A change made to an out-of-date copy is turned away; the check proves no change is lost.",
+        unchecked: "A limit counted across many records, such as sign-ups against the spots on a shift. A rule you give can check that, with a scenario that runs every action that changes the records the rule is about."
+      }
     ],
     fact: `${handlers.join(", ")} ${handlers.length === 1 ? "reads" : "read"} "${table.name}" and then ${handlers.length === 1 ? "writes" : "write"} it.`
   };
@@ -1284,7 +1435,12 @@ function partialQuestion(route, tables, names) {
     ask: `If the server stops halfway through "${shown(names, route.path)}" (a crash, a database error, a timeout), may part of its changes stay saved?`,
     why: `This action changes ${tables.map((t) => `"${shown(names, t)}"`).join(" and ")} in more than one step. A stop between steps can leave them disagreeing, for example money taken but no receipt.`,
     choices: [
-      { id: "all-or-nothing", label: "All or nothing", means: "Every change this action makes is saved together or not at all; Yichus stops it at each step and checks nothing half-done stays saved." },
+      {
+        id: "all-or-nothing",
+        label: "All or nothing",
+        means: "Every change this action makes is saved together or not at all; Yichus stops it at each step and checks nothing half-done stays saved.",
+        unchecked: "Requests and starting records the failure scenario does not list."
+      },
       { id: "partial-ok", label: "Partial is fine", means: "No check is added for this action." }
     ],
     fact: `${route.handler} writes ${tables.map((t) => `"${t}"`).join(", ")} in more than one step.`
@@ -1299,13 +1455,26 @@ function outsideQuestion(route, kinds, names) {
     ask: `"${shown(names, route.path)}" calls ${service}. If that service is down or slow, what should the person using your app see?`,
     why: "Outside services fail often. Without a plan, a failure can leave a half-finished record or charge for work that never happened.",
     choices: [
-      { id: "fail-clean", label: "An error, with nothing saved", means: "Yichus makes the service fail and checks that nothing from this action stays saved." },
-      { id: "finish-later", label: "Save the request and finish it later", means: "Yichus makes the service fail and checks the saved request is tried again and finished exactly once." },
+      {
+        id: "fail-clean",
+        label: "An error, with nothing saved",
+        means: "Yichus makes the service fail and checks that nothing from this action stays saved.",
+        unchecked: "Requests, starting records and answers from the service that the failure scenario does not list."
+      },
+      {
+        id: "finish-later",
+        label: "Save the request and finish it later",
+        means: "Yichus makes the service fail and checks the saved request is tried again and finished exactly once.",
+        unchecked: "Requests, starting records and answers from the service that the failure scenario does not list."
+      },
       { id: "no-plan", label: "No preference", means: "No check is added for this action." }
     ],
     fact: `${route.handler} reaches ${kinds.join(" and ")}.`
   };
 }
+var writeSteps = (route) => route.inferredSteps.filter((s) => s.resource === "db" && s.op !== "read" && s.op !== "query");
+var touchedBy = (route) => [.../* @__PURE__ */ new Set([...route.tables, ...route.inferredSteps.filter((s) => s.resource === "db").flatMap((s) => s.tables)])];
+var changedBy = (route) => [...new Set(writeSteps(route).flatMap((s) => s.tables))];
 var PERSON_SIGNS_IN = /* @__PURE__ */ new Set(["authenticated", "publishable", "requires-roles"]);
 var signIn = {
   id: "sign-in",
@@ -1344,9 +1513,7 @@ function questionsFor(report, structure, names = {}) {
     if (both.length) questions.push(togetherQuestion(table, both, names));
   }
   for (const route of report.surface.routes) {
-    const writes = route.inferredSteps.filter((s) => s.resource === "db" && s.op !== "read" && s.op !== "query");
-    const tables = [...new Set(writes.flatMap((s) => s.tables))];
-    if (writes.length >= 2) questions.push(partialQuestion(route, tables, names));
+    if (writeSteps(route).length >= 2) questions.push(partialQuestion(route, changedBy(route), names));
   }
   for (const route of report.surface.routes) {
     const entry = structure.entries.find((e) => e.entry === `route:${route.path}`);
@@ -1574,7 +1741,7 @@ var LawCheck = z6.looseObject({
   notSampled: z6.array(z6.looseObject({ binding: z6.string() })).optional(),
   reach: z6.array(z6.looseObject({ binding: z6.string(), usedBy: z6.array(z6.string()) })).optional()
 });
-var caseFile = (root, questionId) => path3.join(studioDir(root), "cases", `${questionId.replace(/[^A-Za-z0-9]+/g, "-").replace(/^-|-$/g, "")}.json`);
+var caseFile = (root, questionId) => path3.join(studioDir(root), "cases", `${questionId.replace(/[^\p{L}\p{N}]+/gu, "-").replace(/^-|-$/g, "")}.json`);
 var answerOf = (requirements, id) => requirements.answers.find((a) => a.question === id) ?? null;
 function instancesFor(requirements) {
   const choice = answerOf(requirements, "topology")?.choice;
@@ -1627,6 +1794,7 @@ async function judge(root, engine, sources, question, saved, report, verify, tog
           evidence: personal.map((r) => `${r.path} reaches "${question.subject}" and is called ${r.authority === "requires-roles" ? "by a person with a role" : "by a person"}, not by the app's own server.`)
         };
       }
+      if (answer.choice === "public") return { ...base, status: "no-check", check };
       const prop = byId(`access:${question.subject}`) ?? byId("access-coverage");
       if (!prop) return { ...base, status: "inconclusive", check: "api_verify", evidence: ["api_verify reported no access property for this table."] };
       return {
@@ -1652,35 +1820,47 @@ async function judge(root, engine, sources, question, saved, report, verify, tog
     case "partial":
     case "outside": {
       if (answer.choice === "partial-ok" || answer.choice === "no-plan") return { ...base, status: "no-check" };
-      const file = caseFile(root, question.id);
-      const rel = path3.relative(root, file).split(path3.sep).join("/");
-      if (!fs3.existsSync(file)) return { ...base, casePath: rel, status: "needs-case", check: "api_protocol_check", evidence: [`No protocol case at ${rel} yet.`] };
-      let protocolCase;
-      try {
-        protocolCase = JSON.parse(fs3.readFileSync(file, "utf8"));
-      } catch (error) {
-        return {
-          ...base,
-          casePath: rel,
-          check: "api_protocol_check",
-          status: "inconclusive",
-          evidence: [`${rel} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`]
-        };
-      }
-      const result = Protocol.parse(await engine.call("api_protocol_check", { sources: [...sources, ...caseSources(root)], case: protocolCase }));
-      const status = result.protocol?.status;
-      const check = `api_protocol_check ${rel}`;
-      if (!status) return { ...base, casePath: rel, check, status: "inconclusive", evidence: [result.error ?? "The protocol check gave no status."] };
-      return {
-        ...base,
-        casePath: rel,
-        check,
-        evidence: [`${result.protocol?.name ?? rel}: ${status}`],
-        status: status === "holds" ? "bounded" : status === "violated" ? "broken" : "inconclusive"
-      };
+      const ran = await runCase(root, engine, sources, question.id);
+      return { ...base, casePath: ran.casePath, check: ran.check, status: ran.status, evidence: ran.evidence };
     }
   }
 }
+var CaseRequests = z6.looseObject({ requests: z6.array(z6.looseObject({ call: z6.looseObject({ binding: z6.string() }) })) });
+async function runCase(root, engine, sources, id, runs = []) {
+  const file = caseFile(root, id);
+  const casePath = path3.relative(root, file).split(path3.sep).join("/");
+  if (!fs3.existsSync(file)) return { casePath, status: "needs-case", check: "api_protocol_check", evidence: [`No protocol case at ${casePath} yet.`] };
+  let protocolCase;
+  try {
+    protocolCase = JSON.parse(fs3.readFileSync(file, "utf8"));
+  } catch (error) {
+    return {
+      casePath,
+      check: "api_protocol_check",
+      status: "inconclusive",
+      evidence: [`${casePath} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`]
+    };
+  }
+  const called = CaseRequests.safeParse(protocolCase);
+  const bindings = called.success ? called.data.requests.map((r) => r.call.binding) : [];
+  const missing = runs.filter((r) => !bindings.includes(r.binding));
+  if (missing.length) return {
+    casePath,
+    check: "api_protocol_check",
+    status: "needs-case",
+    evidence: missing.map((r) => `${casePath} sends no request to ${r.path} (${r.binding}) yet.`)
+  };
+  const result = Protocol.parse(await engine.call("api_protocol_check", { sources: [...sources, ...caseSources(root)], case: protocolCase }));
+  const status = result.protocol?.status;
+  const check = `api_protocol_check ${casePath}`;
+  if (!status) return { casePath, check, status: "inconclusive", evidence: [result.error ?? "The protocol check gave no status."] };
+  return {
+    casePath,
+    check,
+    evidence: [`${result.protocol?.name ?? casePath}: ${status}`],
+    status: status === "holds" ? "bounded" : status === "violated" ? "broken" : "inconclusive"
+  };
+}
 var reason = (result) => typeof result.error === "string" ? result.error : "no reason given";
 async function checkLaws(engine, sources) {
   const answer = async (mode) => {
@@ -1719,14 +1899,27 @@ async function checkLaws(engine, sources) {
 }
 var lawNamed = (laws, ref) => laws.find((l) => l.binding === ref || l.binding.endsWith(`::${ref}`) || l.name === ref);
 var unused = (law) => law.usedBy !== null && !law.usedBy.length;
-function judgeRule(rule, laws) {
+async function judgeRule(rule, laws, report, root, engine, sources) {
   const found = rule.laws.map((ref) => [ref, lawNamed(laws, ref)]);
   const missing = found.filter(([, law]) => !law).map(([ref]) => ref);
   const checked = found.flatMap(([, law]) => law ? [law] : []);
   const evidence = [...missing.map((ref) => `No law named ${ref} in the program.`), ...checked.flatMap((l) => l.evidence.map((e) => `${l.name ?? l.binding}: ${e}`))];
   const status = missing.length || !checked.length ? "needs-law" : checked.some((l) => l.status === "broken") ? "broken" : checked.some((l) => l.status === "inconclusive") ? "inconclusive" : checked.some(unused) ? "unused" : checked.every((l) => l.status === "proven") ? "proven" : "bounded";
-  return { ...rule, status, evidence };
-}
+  if (status !== "proven" && status !== "bounded") return { ...rule, status, evidence };
+  const reachKnown = checked.every((l) => l.usedBy !== null);
+  const own = new Set(checked.flatMap((l) => l.usedBy ?? []).flatMap((entry) => entry.startsWith("route:") ? [entry.slice("route:".length)] : []));
+  const routes = report.surface.routes;
+  const records = new Set(reachKnown ? routes.filter((r) => own.has(r.path)).flatMap(touchedBy) : routes.flatMap(changedBy));
+  const others = routes.filter((r) => !own.has(r.path) && changedBy(r).some((t) => records.has(t)));
+  if (!others.length) return { ...rule, status, evidence };
+  const runs = routes.filter((r) => own.has(r.path) || others.includes(r)).map((r) => ({ path: r.path, handler: r.handler, binding: handlerOf(report, r) }));
+  const ran = await runCase(root, engine, sources, `rule:${rule.rule}`, runs);
+  const across = { casePath: ran.casePath, actions: runs.map((r) => r.path), others: others.map((r) => r.path) };
+  const changed = [...records].filter((t) => others.some((r) => changedBy(r).includes(t))).map((t) => `"${t}"`).join(", ");
+  const changing = reachKnown ? `${others.map((r) => r.path).join(", ")} ${others.length === 1 ? "changes" : "change"} ${changed} without deciding with the rule's laws.` : `Which actions decide with the rule's laws is not known, so its scenario runs every action that changes ${changed}.`;
+  return { ...rule, across, evidence: [...evidence, changing, ...ran.evidence], status: ran.status };
+}
+var keepRule = (actions) => `every one of ${actions.join(", ")} keep the rule, deciding with the same functions as its laws. Change the code, never the scenario's rule.`;
 var USE_THE_LAW = "If the function the law checks is in the program, make the action the rule is about decide with it. If it is defined next to the law, move it into the program, have the law check it there, and make the action decide with it. Never weaken what the law says.";
 var QUESTION_PROPERTIES = (id) => id.startsWith("access:") || id === "access-coverage" || id === "rmw-transactions" || id === "integrity";
 var GUIDE = {
@@ -1735,6 +1928,12 @@ var GUIDE = {
   partial: "Transaction protocols: finite cases, retries, and receipts",
   outside: "Transaction protocols: finite cases, retries, and receipts"
 };
+var DIRECTED_TOOLS = {
+  addRule: "api_add_rule",
+  deploy: "api_deploy",
+  suggestProperties: "api_suggest_properties",
+  protocolCheck: "api_protocol_check"
+};
 var SCAFFOLD_ARGS = {
   package_name: "My/App/Api",
   service_name: "my_app",
@@ -1831,7 +2030,7 @@ function nextStep(state, compileErrors, say2 = MCP) {
     instructions: [
       ...mismatched.map((p) => {
         const rule = ACCESS_RULES[p.answer.choice];
-        return `Make the AccessSpec rule for "${p.question.subject}" ${rule.write}${p.answer.choice === "server-only" ? ", and reach it only from worker routes" : ""} (${say2.api("api_add_rule")} for the snippet; ${say2.api("api_guide", { section: rule.guide })} for what it means).`;
+        return `Make the AccessSpec rule for "${p.question.subject}" ${rule.write}${p.answer.choice === "server-only" ? ", and reach it only from worker routes" : ""} (${say2.api(DIRECTED_TOOLS.addRule)} for the snippet; ${say2.api("api_guide", { section: rule.guide })} for what it means).`;
       }),
       next
     ],
@@ -1840,7 +2039,7 @@ function nextStep(state, compileErrors, say2 = MCP) {
   const broken = state.properties.filter((p) => p.status === "broken" || p.status === "inconclusive");
   const failing = state.other.filter((o) => o.status !== "warning");
   const warnings = state.other.filter((o) => o.status === "warning");
-  const brokenRules = state.rules.filter((r) => r.status !== "proven" && r.status !== "bounded");
+  const brokenRules = state.rules.filter((r) => r.status !== "proven" && r.status !== "bounded" && r.status !== "needs-case");
   const ruled = new Set(state.rules.flatMap((r) => r.laws.flatMap((ref) => lawNamed(state.laws, ref)?.binding ?? [])));
   const brokenLaws = state.laws.filter((l) => !ruled.has(l.binding) && (l.status === "broken" || l.status === "inconclusive" || unused(l)));
   const notHolding = broken.length + failing.length + brokenRules.length + brokenLaws.length + (state.lawsError ? 1 : 0);
@@ -1855,7 +2054,7 @@ function nextStep(state, compileErrors, say2 = MCP) {
       ...broken.map((p) => `"${p.question.ask}" The person chose "${p.question.choices.find((c) => c.id === p.answer?.choice)?.label}".${GUIDE[p.question.kind] ? ` ${capital(say2.api("api_guide", { section: GUIDE[p.question.kind] }))} for how.` : ""}`),
       ...failing.map((o) => `${o.title} (${o.id}) is ${o.status}.`),
       ...warnings.map((o) => `${o.title} (${o.id}) is a warning, not a failure: read its evidence. Change the code if it shows something the person did not choose, such as a stored field an action gives away; otherwise tell the person what it means.`),
-      ...brokenRules.map((r) => r.status === "needs-law" ? `The person's rule "${r.rule}" has no law in the program that checks it. Write one (${say2.reference("laws")} for how), then record the rules again with ${say2.name("yichus_rules")}.` : r.status === "unused" ? `The person's rule "${r.rule}" is checked by a law whose check calls nothing any action of the app reaches, so the law says nothing about what the app's actions do. ${USE_THE_LAW}` : `The person's rule "${r.rule}" is ${r.status === "broken" ? "broken: a law that states it fails" : "not decided by its laws"}. Change the code, never the law.`),
+      ...brokenRules.map((r) => r.status === "needs-law" ? `The person's rule "${r.rule}" has no law in the program that checks it. Write one (${say2.reference("laws")} for how), then record the rules again with ${say2.name("yichus_rules")}.` : r.status === "unused" ? `The person's rule "${r.rule}" is checked by a law whose check calls nothing any action of the app reaches, so the law says nothing about what the app's actions do. ${USE_THE_LAW}` : r.across ? r.status === "broken" ? `The person's rule "${r.rule}" is broken: its laws pass, and the scenario that runs every action that changes its records fails. Make ${keepRule(r.across.actions)}` : `The person's rule "${r.rule}" is not decided by the scenario that runs every action that changes its records. If the evidence shows ${r.across.casePath} itself is refused, fix that file, never its rule; otherwise make ${keepRule(r.across.actions)}` : `The person's rule "${r.rule}" is ${r.status === "broken" ? "broken: a law that states it fails" : "not decided by its laws"}. Change the code, never the law.`),
       ...brokenLaws.map((l) => `The law ${l.name ? `"${l.name}" (${l.binding})` : l.binding} ${l.status === "broken" ? "is broken. Change the code, never the law." : l.status === "inconclusive" ? "is not decided. Change the code, never the law." : `checks code no action of the app reaches. ${USE_THE_LAW}`}`),
       ...state.lawsError ? ["The engine could not check the program's laws, so no rule the person stated is checked. If the error below points at the program, fix the program; otherwise tell the person their rules are not checked yet."] : [],
       `Never weaken a rule, delete a check, a law or a claim, or declare one server to make a check pass: change the code. ${next}`
@@ -1914,13 +2113,15 @@ function nextStep(state, compileErrors, say2 = MCP) {
     ]
   };
   const cases = state.properties.filter((p) => p.status === "needs-case");
-  if (cases.length) return {
+  const ruleCases = state.rules.flatMap((r) => r.status === "needs-case" && r.across ? [{ rule: r.rule, ...r.across }] : []);
+  if (cases.length || ruleCases.length) return {
     stage: "write-case",
-    summary: "Writing the failure scenarios that test your answers.",
+    summary: cases.length ? "Writing the failure scenarios that test your answers." : "Writing a scenario that runs every action that changes the records your rules are about.",
     instructions: [
       `${capital(say2.reference("protocol-case"))}: it gives the case specification and a complete worked case with its program.`,
       "Put any Bosatsu observation predicates the case names in .yichus/cases/*.bosatsu. The studio adds those files to protocol checks only, so they never count as part of the app.",
       ...cases.map((p) => `Write ${p.casePath}: a protocol-case-1.0 for ${p.question.subject} whose invariants state the person's choice ("${p.question.choices.find((c) => c.id === p.answer?.choice)?.label}"), with crashes${p.question.kind === "outside" ? " and failed external results" : ""} at each step.`),
+      ...ruleCases.map((c) => `Write ${c.casePath}: a protocol-case-1.0 for the person's rule "${c.rule}". ${c.others.join(", ")} ${c.others.length === 1 ? "changes" : "change"} the same records as the actions that decide with the rule, so the case sends a request to every one of ${c.actions.join(", ")}, from starting records where the rule matters (one spot left, say), and its invariant states the rule over the records after every step: for a limit, what each record counts matches the records it counts, and never passes the limit. Write the observation predicate from the rule, not from the code.`),
       `State the person's rule exactly; never weaken it to match the code. ${next}`
     ]
   };
@@ -1934,7 +2135,7 @@ function nextStep(state, compileErrors, say2 = MCP) {
       ...assumed.length ? ["Say plainly which results depend on running exactly one server."] : [],
       ...data === "move" || data === "same-database" ? [`Before any record moves, list for the person every kind of record the old place keeps that this app does not (for example timestamps or a message log), and ask about each: add it to the app, or agree to leave it behind. ${capital(say2.reference("porting"))} says how to bring the data over.`] : [],
       `When they describe a new feature, change the code and ${say2.use("yichus_next")} again: new facts can raise new questions.`,
-      sections.length ? `When they want the app online, follow the ${sectionsText(sections)} section${sections.length === 1 ? "" : "s"} of the deploy reference (${say2.reference("deploy")}), and ${say2.api("api_deploy")} to generate the server.` : `The program keeps no records and has no actions people call, so it needs no server. When they want it on a page, ${say2.reference("calculator")}.`
+      sections.length ? `When they want the app online, follow the ${sectionsText(sections)} section${sections.length === 1 ? "" : "s"} of the deploy reference (${say2.reference("deploy")}), and ${say2.api(DIRECTED_TOOLS.deploy)} to generate the server.` : `The program keeps no records and has no actions people call, so it needs no server. When they want it on a page, ${say2.reference("calculator")}.`
     ]
   };
 }
@@ -2002,11 +2203,12 @@ async function direct({ root, engine, requirements, withMap = true, previous = n
       const checked = await checkLaws(engine, sources);
       base.laws = checked.laws;
       base.lawsError = checked.error;
-      base.rules = (requirements.rules ?? []).map((r) => judgeRule(r, base.laws));
+      for (const rule of requirements.rules ?? []) base.rules.push(await judgeRule(rule, base.laws, report, root, engine, sources));
       base.hasActions = report.surface.routes.length > 0;
+      let access = null;
       if (base.hasActions || requirements.scenarios?.length) {
         try {
-          const access = await call(engine, "api_access_check", { sources });
+          access = await call(engine, "api_access_check", { sources });
           const record = WhatHappens.parse(buildWhatHappens({ structure: structureRaw, access }, { program: base.project }));
           base.whatHappens = base.hasActions ? record : { ...record, entries: [], ghosts: [], claims: [], witnesses: [], refused: [], notes: [] };
         } catch (error) {
@@ -2023,7 +2225,7 @@ async function direct({ root, engine, requirements, withMap = true, previous = n
               await call(engine, "api_organize", { sources, lens: "abstractions" }),
               await call(engine, "api_organize", { sources, lens: "layers" })
             ];
-            base.map = buildSystemMap({ report, structure: structureRaw, abstractions, layers }, { program: base.project });
+            base.map = buildSystemMap({ report, structure: structureRaw, abstractions, layers, ...access ? { access } : {} }, { program: base.project });
             base.layers = layers;
           } catch (error) {
             base.mapError = error instanceof Error ? error.message : String(error);
@@ -2050,6 +2252,7 @@ function readState(root) {
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
 import { z as z10 } from "zod";
+import { OpenFamilies } from "@yichus/api-mcp";
 
 // src/studio/marks.ts
 import fs4 from "fs";
@@ -2202,6 +2405,7 @@ function recordMarks(root, args, now) {
 }
 
 // src/studio/page.ts
+var HOLDING = ["proven", "bounded", "assumed", "no-check"];
 var PAGE_STATUS = {
   unanswered: ["waiting for your answer", "quiet"],
   decided: ["decided", "good"],
@@ -2217,6 +2421,9 @@ var PAGE_STATUS = {
   "no-check": ["no check needed", "quiet"],
   pending: ["answered, waiting for your agent to check", "quiet"]
 };
+function ruleUnchecked(across) {
+  return `Anything in your words that its laws do not state: your agent wrote the laws from your words.${across ? " Across actions, only the starting records and requests its scenario lists." : ""}`;
+}
 var PAGE_HEADINGS = {
   asked: "What you asked for",
   now: "What is happening now",
@@ -2366,6 +2573,7 @@ import { mount } from './system-map.js';
 import { mountSections, mountWhatHappens, reportViewing, showMarks } from './studio-views.js';
 
 const STATUS = ${JSON.stringify(PAGE_STATUS)};
+const HOLDING = ${JSON.stringify(HOLDING)};
 const NO_ACTIONS = ${JSON.stringify(NO_ACTIONS)};
 const el = (tag, props = {}, ...kids) => { const n = Object.assign(document.createElement(tag), props); n.append(...kids); return n; };
 let mapHash = null, drawn = '';
@@ -2400,7 +2608,9 @@ function questionCard(q, saved) {
 function ruleRow(r) {
   const [words, tone] = STATUS[r.status];
   const li = el('li', {}, el('span', { textContent: 'A rule you gave: ' }, el('em', { textContent: r.rule })), el('span', { className: 'chip ' + tone, textContent: words }));
-  li.append(el('span', { className: 'choice-said', textContent: 'Checked with ' + (r.laws === 1 ? '1 law' : r.laws + ' laws') + ' your agent wrote.' }));
+  li.append(el('span', { className: 'choice-said', textContent: 'Checked with ' + (r.laws === 1 ? '1 law' : r.laws + ' laws') + ' your agent wrote'
+    + (r.across ? ', and a scenario that runs every action that changes these records.' : '.') }));
+  if (r.unchecked) li.append(el('span', { className: 'choice-said', textContent: 'Not checked: ' + r.unchecked }));
   return li;
 }
 
@@ -2412,6 +2622,8 @@ function propertyRow(p, saved) {
   const li = el('li', {}, el('span', { textContent: p.question.ask }), el('span', { className: 'chip ' + tone, textContent: words }));
   li.dataset.property = p.question.id;
   li.append(el('span', { className: 'choice-said', textContent: 'You chose: ' + label + (answer.words && answer.words !== label ? ' ("' + answer.words + '")' : '') }));
+  const unchecked = !stale && HOLDING.includes(p.status) && p.question.choices.find(c => c.id === answer.choice)?.unchecked;
+  if (unchecked) li.append(el('span', { className: 'choice-said', textContent: 'Not checked: ' + unchecked }));
   return li;
 }
 
@@ -2419,7 +2631,8 @@ async function refresh() {
   const { state, requirements } = await (await fetch('/state')).json();
   const savedOf = id => requirements.answers.find(a => a.question === id);
   if (requirements.description) document.getElementById('description').textContent = requirements.description;
-  if (!state) return;
+  // Before the first check there is nothing drawn, but the person may already be looking.
+  if (!state) { viewing(null); return; }
   document.getElementById('project').textContent = ': ' + state.project;
   document.getElementById('updated').textContent = 'Last checked ' + new Date(state.updatedAt).toLocaleTimeString() + '.';
   document.getElementById('summary').textContent = state.summary;
@@ -2488,7 +2701,14 @@ var Report2 = z9.object({
   /** The drawing the anchors belong to (person.ts), or null before one is drawn. */
   drawing: z9.string().max(64).nullable()
 }).strict();
-var Viewing = Report2.extend({ schemaVersion: z9.literal("yichus-viewing-1"), at: z9.string() }).strict();
+var Viewing = Report2.extend({
+  schemaVersion: z9.literal("yichus-viewing-1"),
+  at: z9.string(),
+  /** The page server the report came through: only it can tell that its page went. */
+  server: z9.string().optional(),
+  /** When the last copy of the page open on that server went away, until a page connects again. */
+  closed: z9.string().optional()
+}).strict();
 var viewingPath = (root) => path5.join(studioDir(root), "viewing.json");
 function loadViewing(root) {
   const file = viewingPath(root);
@@ -2497,14 +2717,28 @@ function loadViewing(root) {
   if (!parsed.success) throw new Error(`${file} is not a yichus-viewing-1 file: ${z9.prettifyError(parsed.error)}`);
   return parsed.data;
 }
-function recordViewing(root, report, now) {
-  const parsed = Report2.safeParse(report);
-  if (!parsed.success) return { ok: false, error: `The page's report is not one this studio reads. ${z9.prettifyError(parsed.error)}` };
+function writeViewing(root, viewing) {
   ensureStudioDir(root);
   const file = viewingPath(root), written = `${file}.${process.pid}.tmp`;
-  fs5.writeFileSync(written, `${JSON.stringify(Viewing.parse({ schemaVersion: "yichus-viewing-1", at: now.toISOString(), ...parsed.data }), null, 2)}
+  fs5.writeFileSync(written, `${JSON.stringify(Viewing.parse(viewing), null, 2)}
 `);
   fs5.renameSync(written, file);
+}
+function recordClosed(root, server, now) {
+  const last = loadViewing(root);
+  if (last?.server === server) writeViewing(root, { ...last, closed: now.toISOString() });
+}
+function recordOpened(root, server) {
+  const last = loadViewing(root);
+  if (last?.server === server && last.closed) {
+    const { closed: _, ...open } = last;
+    writeViewing(root, open);
+  }
+}
+function recordViewing(root, server, report, now) {
+  const parsed = Report2.safeParse(report);
+  if (!parsed.success) return { ok: false, error: `The page's report is not one this studio reads. ${z9.prettifyError(parsed.error)}` };
+  writeViewing(root, { schemaVersion: "yichus-viewing-1", at: now.toISOString(), server, ...parsed.data });
   return { ok: true };
 }
 
@@ -2552,13 +2786,16 @@ function pageText(root, pageUrl, now, surface) {
   const chosen = (state?.properties ?? []).filter((p) => p.answer || savedOf(p.question.id));
   const rules = state?.rules ?? [];
   if (!chosen.length && !rules.length) out.push("No properties chosen yet.");
-  for (const r of rules) out.push(`A rule the person gave: "${r.rule}" Status: ${PAGE_STATUS[r.status][0]}. Checked with ${r.laws.length === 1 ? "1 law" : `${r.laws.length} laws`} you wrote.`);
+  for (const r of rules) {
+    out.push(`A rule the person gave: "${r.rule}" Status: ${PAGE_STATUS[r.status][0]}. Checked with ${r.laws.length === 1 ? "1 law" : `${r.laws.length} laws`} you wrote${r.across ? `, and a scenario that runs every action that changes these records (${r.across.actions.join(", ")})` : ""}.${r.status === "proven" || r.status === "bounded" ? ` Not checked: ${ruleUnchecked(r.across !== void 0)}` : ""}`);
+  }
   for (const p of chosen) {
     const saved = savedOf(p.question.id);
     const stale = saved && (!p.answer || p.answer.answeredAt !== saved.answeredAt);
     const answer = stale ? saved : p.answer;
     const label2 = p.question.choices.find((c) => c.id === answer.choice)?.label ?? answer.choice;
-    out.push(`question ${p.question.id}: ${p.question.ask} Status: ${PAGE_STATUS[stale ? "pending" : p.status][0]}. They chose ${label2}${answer.words && answer.words !== label2 ? ` ("${answer.words}")` : ""}.`);
+    const unchecked = !stale && HOLDING.includes(p.status) && p.question.choices.find((c) => c.id === answer.choice)?.unchecked;
+    out.push(`question ${p.question.id}: ${p.question.ask} Status: ${PAGE_STATUS[stale ? "pending" : p.status][0]}. They chose ${label2}${answer.words && answer.words !== label2 ? ` ("${answer.words}")` : ""}.${unchecked ? ` Not checked: ${unchecked}` : ""}`);
   }
   heading("happens");
   const step = (s, pad) => {
@@ -2611,7 +2848,10 @@ function pageText(root, pageUrl, now, surface) {
 `;
 }
 function inViewLines(viewing, codeAt, said2, now, pageUrl) {
-  if (!viewing) return [`The page has not said what is on screen: it may not be open. ${pageUrl ? `Give the person its link: ${pageUrl}` : "The page is not running: start `yichus studio --page` in the background in this folder, then run this again for its link."}`];
+  const link = pageUrl ? `Give the person its link: ${pageUrl}` : "The page is not running: start `yichus studio --page` in the background in this folder, then run this again for its link.";
+  if (!viewing) return [`The page has not said what is on screen: it may not be open. ${link}`];
+  if (viewing.closed) return [`The person closed the page ${ago(viewing.closed, now)}, so it is not open now. ${pageUrl ? `If you want them to look at it, give them its link again: ${pageUrl}` : link}`];
+  if (!pageUrl) return [`The page is not open: its server stopped after it last said what was on screen. ${link}`];
   const parts = (anchors) => !viewing.current ? [] : anchors.flatMap((a) => codeAt.has(a) ? [`[${codeAt.get(a)}] ${said2.get(codeAt.get(a))}`] : []);
   const list = (what, items) => items.length ? [`${what}:`, ...items.map((i) => `  ${i}`)] : [];
   const { touched } = viewing;
@@ -2678,12 +2918,20 @@ var reference_default = {
     ]
   },
   "protocol-case": {
-    about: "The failure scenarios the studio checks for an action that must be all or nothing, or must survive an outside service failing: the case format and a complete worked case.",
+    about: "The scenarios the studio checks for an action that must be all or nothing or must survive an outside service failing, and for a rule other actions could go around: the case format and complete worked cases.",
     files: [
       { name: "protocol-cases.md", from: "docs/studio/protocol-cases.md" },
       { name: "protocol-specification.md", from: "docs/protocol-verification.md", sections: ["Case format: protocol-case-1.0", "Observation predicates", "Trace assertions", "Reachability witnesses", "Interpretation and limits"] },
       { name: "withdrawal-case.json", from: "eval/corpus/webmcp-traps/iteration-003/programs/Q15/twin/case.json" },
-      { name: "withdrawal.bosatsu", from: "eval/corpus/webmcp-traps/iteration-003/programs/Q15/twin/ledger.bosatsu" }
+      { name: "withdrawal.bosatsu", from: "eval/corpus/webmcp-traps/iteration-003/programs/Q15/twin/ledger.bosatsu" },
+      { name: "signups.bosatsu", from: "docs/studio/laws-example/signups/signups.bosatsu" },
+      { name: "signups-laws.bosatsu", from: "docs/studio/laws-example/signups/signups-laws.bosatsu" },
+      { name: "signups-case.json", from: "docs/studio/laws-example/signups/cases/signups-case.json" },
+      { name: "spots.bosatsu", from: "docs/studio/laws-example/signups/cases/spots.bosatsu" },
+      { name: "near-miss-signups.bosatsu", from: "docs/studio/laws-example/signups/near-miss/signups.bosatsu" },
+      { name: "near-miss-case.json", from: "docs/studio/laws-example/signups/cases/near-miss-case.json" },
+      { name: "mutants/double-signup.bosatsu", from: "docs/studio/laws-example/signups/mutants/double-signup.bosatsu" },
+      { name: "mutants/overfill.bosatsu", from: "docs/studio/laws-example/signups/mutants/overfill.bosatsu" }
     ]
   },
   calculator: {
@@ -2761,7 +3009,7 @@ function stepText(state, pageUrl) {
   }
   if (state.rules.length) {
     lines.push("", "Rules the person stated:");
-    for (const r of state.rules) lines.push(`  "${r.rule}" (${r.laws.join(", ")}): ${STATUS_WORDS[r.status]}`);
+    for (const r of state.rules) lines.push(`  "${r.rule}" (${[...r.laws, ...r.across ? [r.across.casePath] : []].join(", ")}): ${STATUS_WORDS[r.status]}`);
   }
   if (pageUrl) lines.push("", `Studio page: ${pageUrl}`);
   return `${lines.join("\n")}
@@ -2784,7 +3032,7 @@ The loop:
 8. While you talk with the person, point at what you mean on the studio page with yichus_point: a section of their app, an action, or a step in one, with a sentence or two as you would say it in the chat. The page shows each note over the pictures as yours, not checked, so never use a note to say something holds; the checks say that. Point again as the conversation moves on, and clear the marks when they no longer help.
 9. You drive the conversation, and the person reads the studio page while you talk. Call yichus_page to see what the page shows them, in words: what they asked for, the questions, each property with its status, what happens in each action, the sections of their app, your notes, and what they have on screen and last clicked. Call it whenever they refer to something on the page ("this one", "the red one", "what does that mean"), and after they answer on the page.
 
-Every api_* tool is available too. Leave out sources and the studio supplies the project's files. Pages on yich.us, such as calculators and the playground, come through a separate connection (@yichus/mcp); building needs only this one.`;
+The core api_* tools are listed too, and api_tools opens a specialist family (access, concurrency, proofs and more): its tools join the list. Leave out sources and the studio supplies the project's files. Pages on yich.us, such as data apps and the playground, come through a separate connection (@yichus/mcp); building needs only this one.`;
 var START = {
   name: "yichus_start",
   description: "Record what the person wants built, in their own words, and get the studio page link to give them. Call this first.",
@@ -2953,7 +3201,7 @@ function pageNote(pageUrl, say2) {
   ].join("\n");
 }
 function createStudioMcpServer({ root, engine, catalog, pageUrl, now = () => /* @__PURE__ */ new Date(), locate = builtCopy }) {
-  const server = new Server({ name: "yichus-studio", version: "0.3.2" }, { capabilities: { tools: {} }, instructions: INSTRUCTIONS });
+  const server = new Server({ name: "yichus-studio", version: "0.3.4" }, { capabilities: { tools: { listChanged: true } }, instructions: INSTRUCTIONS });
   const active = /* @__PURE__ */ new Set();
   const track = (task) => {
     active.add(task);
@@ -2961,10 +3209,12 @@ function createStudioMcpServer({ root, engine, catalog, pageUrl, now = () => /*
     });
     return task;
   };
-  let tools = null;
-  const catalogTools2 = async () => tools ??= (await catalog()).map(studioTool);
+  let entries = null;
+  const catalogEntries2 = async () => entries ??= (await catalog()).map((e) => ({ ...e, tool: studioTool(e.tool) }));
+  const catalogTools = async () => (await catalogEntries2()).map((e) => e.tool);
+  const families = new OpenFamilies(false, Object.values(DIRECTED_TOOLS));
   let last = readState(root);
-  server.setRequestHandler(ListToolsRequestSchema, () => track((async () => ({ tools: [START, NEXT, NAME, ANSWER, RULES, SCENARIO, POINT, PAGE, REFERENCE_TOOL, ...await catalogTools2()] }))()));
+  server.setRequestHandler(ListToolsRequestSchema, () => track((async () => ({ tools: [START, NEXT, NAME, ANSWER, RULES, SCENARIO, POINT, PAGE, REFERENCE_TOOL, ...families.listed(await catalogEntries2())] }))()));
   server.setRequestHandler(CallToolRequestSchema, (request) => track(callTool(request.params)));
   async function callTool(params) {
     const { name, arguments: args = {} } = params;
@@ -3009,7 +3259,7 @@ Next: call yichus_next.`, { pageUrl });
       return said2 ? text(said2) : text(`No reference topic ${String(args.topic)}.
 ${topicList((topic) => `topic "${topic}"`)}`, void 0, true);
     }
-    const tool = (await catalogTools2()).find((t) => t.name === name);
+    const tool = (await catalogTools()).find((t) => t.name === name);
     if (!tool) return text(`Unknown tool ${name}.`, void 0, true);
     const filled = { ...args };
     const props = tool.inputSchema.properties ?? {};
@@ -3019,15 +3269,7 @@ ${topicList((topic) => `topic "${topic}"`)}`, void 0, true);
     const topology2 = loadRequirements(root).answers.find((a) => a.question === "topology")?.choice;
     if ("instances" in props && filled.instances === void 0 && topology2) filled.instances = topology2 === "one" ? "1" : "many";
     const result = await engine.call(name, filled);
-    if (name === "api_guide" && filled.section === void 0 && Array.isArray(result.sections)) {
-      const titles = {
-        ok: true,
-        tool: "api_guide",
-        titles: result.sections.map((s) => s.title),
-        note: "The whole guide is long. Call api_guide with section set to one of these titles, or to part of one."
-      };
-      return text(JSON.stringify(titles), titles);
-    }
+    if (families.record(name, result)) await server.sendToolListChanged();
     return text(JSON.stringify(result), result, result.ok !== true);
   }
   return {
@@ -3222,7 +3464,7 @@ ${said2}
 var HELP = `yichus \u2014 the Yichus WebMCP analysis engine, locally
 
   yichus tools
-  yichus call TOOL [--args JSON_FILE|-] [--source FILE ... | --project DIR]
+  yichus call TOOL [--args JSON_FILE|-] [--arg-file NAME=JSON_FILE ...] [--source FILE ... | --project DIR]
   yichus verify FILE ... [--instances 1|many] [--block-on-warning ID ...]
   yichus lean FILE ... --lean-wasm-root DIRECTORY [--timeout-ms N]
 ${STUDIO_HELP}
@@ -3234,6 +3476,8 @@ Options:
                       (default the current folder), as the studio reads
                       it (call only).
   --args FILE|-       Tool arguments as a JSON object; - reads stdin.
+  --arg-file NAME=FILE  Set one argument to the JSON in FILE, such as a
+                      saved snapshot (repeatable; call only).
   --block-on-warning ID  A property id whose warning blocks the verdict, as a
                       violation would (repeatable; all names every property;
                       verify only). An id the verdict lacks exits 2.
@@ -3297,6 +3541,7 @@ var objectJson = (raw, label2) => objectValue(JSON.parse(raw), label2);
 var FLAGS = {
   source: { type: "string", multiple: true },
   args: { type: "string" },
+  "arg-file": { type: "string", multiple: true },
   project: { type: "string" },
   instances: { type: "string" },
   "block-on-warning": { type: "string", multiple: true },
@@ -3317,7 +3562,7 @@ function parse(argv2) {
   if (command !== "tools" && command !== "call" && command !== "verify" && command !== "lean") {
     throw new Error("Expected tools, call TOOL, verify FILE, or lean FILE; use --help for usage.");
   }
-  const opts = { command, sources: [], expects: [], blockOnWarnings: values["block-on-warning"] ?? [] };
+  const opts = { command, sources: [], argFiles: [], expects: [], blockOnWarnings: values["block-on-warning"] ?? [] };
   if (command === "call") {
     opts.tool = rest.shift();
     if (!opts.tool) throw new Error("call requires a tool name");
@@ -3325,6 +3570,14 @@ function parse(argv2) {
   if ((command === "tools" || command === "call") && rest.length) throw new Error(`Unexpected argument: ${rest[0]}`);
   opts.sources = [...rest, ...values.source ?? []];
   opts.args = values.args;
+  for (const value of values["arg-file"] ?? []) {
+    const equal = value.indexOf("=");
+    if (equal <= 0 || equal === value.length - 1) throw new Error("--arg-file requires NAME=FILE");
+    const name = value.slice(0, equal);
+    if (opts.argFiles.some((a) => a.name === name)) throw new Error(`--arg-file names ${name} twice`);
+    opts.argFiles.push({ name, file: value.slice(equal + 1) });
+  }
+  if (opts.argFiles.length && command !== "call") throw new Error("--arg-file is for call");
   opts.project = values.project;
   if (opts.project !== void 0 && command !== "call") throw new Error("--project is for call");
   if (opts.project !== void 0 && opts.sources.length) throw new Error("Use either --source files or --project, not both");
@@ -3430,6 +3683,15 @@ function sourceNames(paths) {
 }
 async function argumentsFor(opts, io) {
   const args = opts.args ? objectJson(opts.args === "-" ? await io.readStdin() : readInput(opts.args), "Arguments") : {};
+  for (const { name, file } of opts.argFiles) {
+    if (Object.hasOwn(args, name)) throw new Error(`Use either --arg-file ${name}=... or args.${name}, not both`);
+    try {
+      args[name] = JSON.parse(readInput(file));
+    } catch (error) {
+      if (error instanceof SyntaxError) throw new Error(`--arg-file ${name}: ${file} is not JSON (${error.message})`);
+      throw error;
+    }
+  }
   if (opts.sources.length) {
     if (Object.hasOwn(args, "sources")) throw new Error("Use either --source files or args.sources, not both");
     const names = sourceNames(opts.sources);
@@ -3457,7 +3719,7 @@ function clearOutput(opts) {
   if (!opts.output) return;
   const output = path9.resolve(opts.output);
   const outputStat = fs9.existsSync(output) ? fs9.statSync(output) : void 0;
-  for (const input of [...opts.sources, opts.args, opts.bundle].filter((p) => !!p && p !== "-")) {
+  for (const input of [...opts.sources, ...opts.argFiles.map((a) => a.file), opts.args, opts.bundle].filter((p) => !!p && p !== "-")) {
     const inputStat = fs9.existsSync(input) ? fs9.statSync(input) : void 0;
     if (path9.resolve(input) === output || outputStat && inputStat && inputStat.dev === outputStat.dev && inputStat.ino === outputStat.ino) {
       throw new Error("--output must not overwrite an input file");
@@ -3492,16 +3754,22 @@ async function runCli(argv2, io) {
         timeoutMs
       ), "Lean result");
     } else {
-      if (opts.command === "call") {
-        const files = Array.isArray(args.sources) ? args.sources.length : void 0;
-        const progress = callProgress(opts.tool, files);
-        if (progress) io.stderr(progress);
-      }
+      const progress = opts.command === "call" ? callProgress(opts.tool, Array.isArray(args.sources) ? args.sources.length : void 0) : void 0;
+      let stageStart = io.now();
+      const finished = (stage) => {
+        const now = io.now();
+        io.stderr(`  ${stage} in ${((now - stageStart) / 1e3).toFixed(1)} s.
+`);
+        stageStart = now;
+      };
+      if (progress) io.stderr(progress);
       const engine = await io.loadEngine(opts.bundle);
+      if (progress) finished("Loaded the engine");
       if (opts.command === "call" && !Object.hasOwn(args, "sources") && readsProgram(engine, opts.tool)) {
         args.sources = folderSources(opts.tool, opts.project);
       }
-      const raw = opts.command === "tools" ? engine.listTools() : engine.callTool(opts.command === "verify" ? "api_verify" : opts.tool, JSON.stringify(args));
+      const tool = opts.command === "verify" ? "api_verify" : opts.tool;
+      const raw = opts.command === "tools" ? engine.listTools() : progress ? engine.callTool(tool, JSON.stringify(args), finished) : engine.callTool(tool, JSON.stringify(args));
       result = objectJson(raw, "Engine result");
     }
     if (typeof result.ok !== "boolean") throw new Error("Engine result must explicitly contain boolean ok");
@@ -3547,7 +3815,7 @@ async function runCli(argv2, io) {
 import { once } from "events";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
-import { EngineWorkerClient, catalogTools } from "@yichus/api-mcp";
+import { EngineWorkerClient, catalogEntries } from "@yichus/api-mcp";
 
 // src/studio/page-server.ts
 import fs10 from "fs";
@@ -3573,7 +3841,13 @@ function personView(state, names, marks = null) {
       status: p.status
     })),
     // A state written before rules were kept has none.
-    rules: (state.rules ?? []).map((r) => ({ rule: r.rule, status: r.status, laws: r.laws.length })),
+    rules: (state.rules ?? []).map((r) => ({
+      rule: r.rule,
+      status: r.status,
+      laws: r.laws.length,
+      across: r.across !== void 0,
+      unchecked: r.status === "proven" || r.status === "bounded" ? ruleUnchecked(r.across !== void 0) : null
+    })),
     map: state.map ? relabelSystemMap(state.map, names) : null,
     mapError: state.mapError,
     sections,
@@ -3601,9 +3875,10 @@ async function startPageServer(root, assetsDir, port = null, now = () => /* @__P
   };
   for (const file of watched) fs10.watchFile(file, { interval: 250 }, changed);
   const hosts = /* @__PURE__ */ new Set();
+  let self = "", closing = false;
   const takes = /* @__PURE__ */ new Map([
     ["/answer", (args) => recordAnswer(root, args, now())],
-    ["/viewing", (args) => recordViewing(root, args, now())]
+    ["/viewing", (args) => recordViewing(root, self, args, now())]
   ]);
   const server = http.createServer((req, res) => {
     const send = (status, type, body) => {
@@ -3624,7 +3899,11 @@ async function startPageServer(root, assetsDir, port = null, now = () => /* @__P
       res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-store", connection: "keep-alive" });
       res.write(": connected\n\n");
       clients.add(res);
-      req.on("close", () => clients.delete(res));
+      recordOpened(root, self);
+      req.on("close", () => {
+        clients.delete(res);
+        if (!clients.size && !closing) recordClosed(root, self, now());
+      });
       return;
     }
     const asset = PAGE_ASSETS.find((a) => url.pathname === `/${a}`);
@@ -3667,9 +3946,11 @@ async function startPageServer(root, assetsDir, port = null, now = () => /* @__P
   }
   const bound = server.address().port;
   hosts.add(`127.0.0.1:${bound}`).add(`localhost:${bound}`);
+  self = `http://127.0.0.1:${bound}/`;
   return {
-    url: `http://127.0.0.1:${bound}/`,
+    url: self,
     async close() {
+      closing = true;
       for (const file of watched) fs10.unwatchFile(file, changed);
       const closed = new Promise((resolve) => server.close(() => resolve()));
       server.closeAllConnections();
@@ -3697,7 +3978,7 @@ function workerEngine(bundle) {
       return objectResult(await worker.callTool(tool, JSON.stringify(args), `studio-${++id}`), tool);
     },
     async catalog() {
-      return catalogTools(await worker.listTools(`studio-${++id}`));
+      return catalogEntries(await worker.listTools(`studio-${++id}`));
     },
     close: () => worker.close()
   };
@@ -3757,6 +4038,7 @@ process.exitCode = STUDIO_COMMANDS.has(argv[0] ?? "") ? await runStudioCommand(a
   // fails a synchronous read with EAGAIN on macOS.
   readStdin: () => text2(process.stdin),
   stdout: (text3) => process.stdout.write(text3),
-  stderr: (text3) => process.stderr.write(text3)
+  stderr: (text3) => process.stderr.write(text3),
+  now: () => performance.now()
 });
 //# sourceMappingURL=main.js.map