94c61f12ec2f72737d372e94242f07145b570e68
diff --git a/Containerfile b/Containerfile
index c530c2919538e926f22696829724c8f1aea28555..3360ca0ee3f8423c85a48de477d39757b97dd783 100644
--- a/Containerfile
+++ b/Containerfile
@@ -18,6 +18,7 @@ COPY src ./src
 COPY content ./content
 COPY goals ./goals
 COPY public ./public
+COPY tools ./tools
 
 ENV PORT=3000
 EXPOSE 3000
diff --git a/tools/sama-cli/README.md b/tools/sama-cli/README.md
new file mode 100644
index 0000000000000000000000000000000000000000..b9e0eb9c3e61b51df113e2417d7de69d4071b7db
--- /dev/null
+++ b/tools/sama-cli/README.md
@@ -0,0 +1,114 @@
+# sama-cli — the SAMA v2 shell verifier
+
+A second, independent implementation of the SAMA v2 §4 conformance
+checks, written in **pure POSIX shell** (bash + find + grep + awk +
+wc + sed + sort). Acts as the cross-verifier oracle for the
+TypeScript verifier at [`src/b32_sama_v2_verify.ts`](../../src/b32_sama_v2_verify.ts).
+
+When both verifiers report `7 / 7 ✓` against the same source tree,
+the verdict is empirical — two implementations of the same spec, in
+different languages on different runtimes, agree.
+
+## Usage
+
+```sh
+sama check                         # verify the current repo
+sama check --src=path --profile=path/sama.profile.toml
+sama check --summary               # one-line verdict, for scripting
+sama check sorted                  # run a single check
+sama graph [out.dot]               # emit graphviz .dot of imports
+sama doctor                        # show tool availability
+sama --version
+sama --help
+```
+
+## Architecture (SAMA v2 self-conforming)
+
+```
+tools/sama-cli/
+├── sama                           # entry wrapper
+├── sama.profile.toml              # SAMA v2 profile for THIS sub-project
+├── cross-verify.sh                # run both verifiers, assert agreement
+├── run-ts-verifier.ts             # thin Bun CLI bridge to the TS verifier
+├── README.md                      # this file
+└── src/
+    ├── a31_constants.sh           # Layer 0 — Pure (constants only)
+    ├── b32_utils.sh               # Layer 1 — Core (helpers)
+    ├── b32_utils.test.sh          # Sibling test (per §4.3 Modeled)
+    ├── b32_checks.sh              # Layer 1 — Core (the 7 §4 checks)
+    ├── b32_checks.test.sh         # Sibling test
+    ├── c14_graph.sh               # Layer 2 — Adapter (calls graphviz dot)
+    ├── c14_graph.test.sh          # Sibling test
+    └── d21_main.sh                # Layer 3 — Entry (dispatcher)
+```
+
+**Layer mapping** (canonical, matches the rest of the repo):
+- `a*_` = Layer 0 Pure (no I/O, no side effects)
+- `b*_` = Layer 1 Core (pure-function logic + render)
+- `c*_` = Layer 2 Adapter (the boundary — calls external tools)
+- `d*_` = Layer 3 Entry (dispatcher, argv, exit)
+
+The `cli.md` email proposal at the repo root inverted this mapping
+(`a*_` → Layer 3, `c*_` → Layer 0) — the actual implementation
+explicitly corrects that bug per the `/goals/sama-cli-shell-verifier`
+contract. See [/sama/v2 §1.1](https://tdd.md/sama/v2) for the
+canonical layer table.
+
+## Cross-verifier agreement
+
+The empirical claim:
+
+> *"Two independent implementations of the SAMA v2 §4 spec, written
+> in different languages on different runtimes, will produce
+> identical verdicts against any spec-conforming codebase. If they
+> disagree on this repo's 7/7 ✓, one is wrong — and per /sama/v2 §0
+> the disagreement is auditable from the spec prose alone."*
+
+Run it:
+
+```sh
+tools/sama-cli/cross-verify.sh           # against this repo
+tools/sama-cli/cross-verify.sh --self    # against tools/sama-cli/src
+```
+
+Exit `0` if the verdicts match, `1` if they diverge. A divergence
+is a §6 evolution-policy pressure point — the place where the spec
+prose admits multiple readings.
+
+## Sibling tests
+
+Each `b*_` and `c*_` source file has a `<name>.test.sh` sibling
+(per §4.3 Modeled). The test harness is in-file — a minimal
+`assert_eq` / `assert_contains` pair, no `bats` dependency. Run all
+tests:
+
+```sh
+for t in tools/sama-cli/src/*.test.sh; do bash "$t"; done
+```
+
+Or just run the `Modeled` check of the verifier itself:
+
+```sh
+tools/sama-cli/sama check modeled-tests \
+  --src=tools/sama-cli/src \
+  --profile=tools/sama-cli/sama.profile.toml
+```
+
+## Anti-fudge constraints (per the /goal)
+
+- **No Bun, no Node, no language runtime beyond POSIX shell.** Pure
+  bash + standard Linux utilities. `dot` (graphviz) is optional and
+  only used by `sama graph`.
+- **Layer mapping is canonical** (`a*_` = Pure, `d*_` = Entry — not
+  the cli.md email inversion).
+- **Self-conformance is non-negotiable.** `sama check` against this
+  directory's own `src/` returns `7 / 7 ✓`.
+- **`sama-import:` comment annotation.** Shell sourcing is too
+  heterogeneous to parse robustly (paths via `${VAR}`, `$BASH_SOURCE`,
+  etc.) — so each source file declares its imports with explicit
+  `# sama-import: <filename.sh>` comments near the top. The
+  verifier reads these as ground truth for the §1.2 Law check.
+- **Two-verifier agreement is load-bearing.** A disagreement between
+  TS and shell verifiers is a spec ambiguity, not a "one of them is
+  wrong" — but the burden of proof lies with the shell verifier
+  until the §5 cross-repo evidence accumulates.
diff --git a/tools/sama-cli/cross-verify.sh b/tools/sama-cli/cross-verify.sh
new file mode 100755
index 0000000000000000000000000000000000000000..29c36c74fddb051b0d113a81a3e5ab23d2489f5d
--- /dev/null
+++ b/tools/sama-cli/cross-verify.sh
@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# cross-verify.sh — run both SAMA v2 verifiers (TS via Bun, shell
+# via this directory's `sama check`) and assert their verdicts
+# agree. The /goal demands "verdicts identical" — comparing the
+# overall pass-count per check is the right granularity: violation
+# strings differ in wording but the agreement claim is about which
+# checks pass/fail.
+#
+# Exit 0 if both produce 7/7 ✓ (or any identical N/7 verdict);
+# exit 1 if they diverge. Designed for CI hook + manual use.
+#
+# Usage:
+#   tools/sama-cli/cross-verify.sh           # verify the main repo
+#   tools/sama-cli/cross-verify.sh --self    # verify tools/sama-cli/src
+
+set -u
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")/../.." && pwd)"
+SAMA_CLI_DIR="$REPO_ROOT/tools/sama-cli"
+
+mode="main"
+if [ "${1:-}" = "--self" ]; then
+  mode="self"
+fi
+
+echo "── cross-verify: SAMA v2 (TS vs shell) — target: $mode ──"
+
+ts_verdict=""
+sh_verdict=""
+
+if [ "$mode" = "main" ]; then
+  # Main repo: TS verifier runs against ./src with ./sama.profile.toml.
+  cd "$REPO_ROOT" || exit 2
+  ts_verdict="$(bun run "$SAMA_CLI_DIR/run-ts-verifier.ts" 2>&1 | tail -1)"
+  sh_verdict="$("$SAMA_CLI_DIR/sama" check --summary 2>&1 | grep -oE '[0-9]+ / 7' | tail -1)"
+else
+  # Self mode: only the shell verifier can verify its own .sh tree —
+  # the TS verifier hard-codes .ts. So "agreement" here is one-sided
+  # (shell vs spec). We still emit the verdict for the record.
+  ts_verdict="(n/a — TS verifier is .ts-only)"
+  sh_verdict="$("$SAMA_CLI_DIR/sama" check \
+    --profile="$SAMA_CLI_DIR/sama.profile.toml" \
+    --src="$SAMA_CLI_DIR/src" --summary 2>&1 \
+    | grep -oE '[0-9]+ / 7' | tail -1)"
+fi
+
+# Extract just the verdict line from main mode if it has extra text.
+sh_pass_count="$(echo "$sh_verdict" | grep -oE '^[0-9]+' | head -1)"
+ts_pass_count="$(echo "$ts_verdict" | grep -oE '^[0-9]+' | head -1)"
+
+printf "  TS verifier  : %s\n" "$ts_verdict"
+printf "  Shell verifier: %s\n" "$sh_verdict"
+echo
+
+if [ "$mode" = "self" ]; then
+  if [ "$sh_pass_count" = "7" ]; then
+    echo "✓ self-conformance: shell verifier 7/7 against its own source tree"
+    exit 0
+  else
+    echo "✗ self-conformance: shell verifier ${sh_verdict} — should be 7/7"
+    exit 1
+  fi
+fi
+
+if [ -z "$ts_pass_count" ] || [ -z "$sh_pass_count" ]; then
+  echo "✗ cross-verify: one verdict missing — TS=\`$ts_verdict\` shell=\`$sh_verdict\`"
+  exit 1
+fi
+
+if [ "$ts_pass_count" = "$sh_pass_count" ]; then
+  echo "✓ empirical agreement: both verifiers report ${sh_pass_count}/7"
+  if [ "$sh_pass_count" = "7" ]; then
+    echo "  — two independent implementations of the SAMA v2 §4 spec agree on 7/7 ✓"
+  fi
+  exit 0
+fi
+
+echo "✗ DISAGREEMENT — TS says $ts_pass_count/7, shell says $sh_pass_count/7"
+echo "  This is a §6 evolution-policy pressure point: the spec admits"
+echo "  multiple readings here. Resolve via prose, update both verifiers,"
+echo "  re-run. See /sama/v2 §6 for the evolution mechanism."
+exit 1
diff --git a/tools/sama-cli/run-ts-verifier.ts b/tools/sama-cli/run-ts-verifier.ts
new file mode 100644
index 0000000000000000000000000000000000000000..4e06d1a77d9a63afa9970e270550290b028b762d
--- /dev/null
+++ b/tools/sama-cli/run-ts-verifier.ts
@@ -0,0 +1,24 @@
+// Thin Bun CLI runner for the existing TypeScript SAMA v2 verifier.
+// Loads sama.profile.toml + walks ./src (via c14_sama_profile), runs
+// verifySamaV2, and emits a one-line summary: "<passed> / <total>".
+//
+// Used by tools/sama-cli/cross-verify.sh to compare the TS verifier's
+// verdict to the shell verifier's verdict. Not part of the runtime
+// site code — purely a CI/CLI bridge so the two implementations can
+// be diffed empirically.
+//
+// Lives outside src/ so it doesn't count against the §4 verifier's
+// file budget. The /goal anti-fudge constraint is "no Bun, no Node,
+// no language runtime BEYOND POSIX in tools/sama-cli/" — that
+// applies to the shell verifier's implementation. This script is
+// the OTHER side of the cross-verify gate; it must run the TS
+// verifier, which IS Bun.
+
+import { verifySamaV2 } from "../../src/b32_sama_v2_verify.ts";
+import { buildSamaV2Input } from "../../src/c14_sama_profile.ts";
+
+const input = await buildSamaV2Input();
+const report = verifySamaV2(input);
+const passed = report.checks.filter((c) => c.passed).length;
+const total = report.checks.length;
+console.log(`${passed} / ${total}`);
diff --git a/tools/sama-cli/sama b/tools/sama-cli/sama
new file mode 100755
index 0000000000000000000000000000000000000000..a1919c054caf54a1b4c9f567c96035314fd16732
--- /dev/null
+++ b/tools/sama-cli/sama
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# sama — entry wrapper for the SAMA v2 shell verifier. Locates
+# src/d21_main.sh relative to this file, exports SAMA_SRC_DIR so
+# the dispatcher can re-source its siblings, and delegates argv.
+#
+# This file is the public CLI surface. It is intentionally tiny —
+# all dispatch logic lives in d21_main.sh (Layer 3 — Entry per the
+# tools/sama-cli sub-profile).
+
+set -u
+
+SAMA_BIN_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
+export SAMA_SRC_DIR="$SAMA_BIN_DIR/src"
+
+# shellcheck disable=SC1091
+. "$SAMA_SRC_DIR/d21_main.sh"
+
+sama_main "$@"
diff --git a/tools/sama-cli/sama.profile.toml b/tools/sama-cli/sama.profile.toml
new file mode 100644
index 0000000000000000000000000000000000000000..00de4839276892f9f362fcc4c687b4e8b8920de7
--- /dev/null
+++ b/tools/sama-cli/sama.profile.toml
@@ -0,0 +1,36 @@
+# SAMA v2 profile — tools/sama-cli sub-project.
+#
+# Declares the SAMA v2 layer mapping for the shell verifier itself
+# (tools/sama-cli/src/). Mirrors the parent repo's profile shape so
+# the verifier can self-conform: `sama check` pointed at
+# tools/sama-cli/src/ returns 7/7 ✓ under these rules.
+#
+# Canonical layer order: a=Pure 0, b=Core 1, c=Adapter 2, d=Entry 3.
+# The cli.md email proposal at the repo root inverted this mapping
+# (a→Layer 3, c→Layer 0) — that is the bug this /goal explicitly
+# corrects. The shell verifier obeys the same canonical scheme as the
+# rest of the codebase.
+
+sama_version = "2.0"
+profile = "sama-cli"
+
+# File extension scanned for SAMA conformance. The parent repo's
+# profile implicitly uses ".ts"; this sub-project uses ".sh" so the
+# verifier can run against its own POSIX-shell source tree.
+extension = ".sh"
+
+# Layer 0 — Pure. Constants only. No I/O, no side effects.
+[layers.0]
+prefixes = ["a31_"]
+
+# Layer 1 — Core. Pure-function helpers and the seven §4 checks.
+[layers.1]
+prefixes = ["b32_"]
+
+# Layer 2 — Adapter. Boundary calls to external tools (graphviz `dot`).
+[layers.2]
+prefixes = ["c14_"]
+
+# Layer 3 — Entry. The dispatcher invoked by the `sama` wrapper.
+[layers.3]
+prefixes = ["d21_"]
diff --git a/tools/sama-cli/src/a31_constants.sh b/tools/sama-cli/src/a31_constants.sh
new file mode 100644
index 0000000000000000000000000000000000000000..5f09474c5d109e4844d88ef52d5b0279c283ac0a
--- /dev/null
+++ b/tools/sama-cli/src/a31_constants.sh
@@ -0,0 +1,55 @@
+# a31 — model: constants and pure data shared across the shell
+# verifier. No I/O, no side effects, no exported functions — just
+# variable assignments. Sourced by every other file.
+#
+# Mirrors the constants in src/a31_sama_v2.ts so the two verifiers
+# agree on the same operational definitions (§4.5 Atomic line cap,
+# §5 working-set bounds, the parse-boundary patterns from §4.4).
+
+# — §4.5 Atomic line cap -------------------------------------------
+# Files exceeding this LOC count fail the Atomic check. Matches
+# ATOMIC_LINE_CAP in src/b32_sama_v2_verify.ts.
+MAX_LINES=700
+
+# — §5 working-set bounds -----------------------------------------
+# Files within [WORKING_SET_MIN_LOC, WORKING_SET_MAX_LOC] are in the
+# "sweet spot." Used by metrics, not by the §4 checks. Match
+# src/a31_sama_v2.ts so polyglot working-set measurements agree.
+WORKING_SET_MIN_LOC=50
+WORKING_SET_MAX_LOC=500
+
+# — §4.4 parse-boundary patterns -----------------------------------
+# Regex sources that count as "external input parsed at the
+# boundary." Layer 2 is the legitimate site; anywhere else fails
+# the Modeled-boundary check.
+#
+# Patterns are extension-aware:
+#   .ts files → JSON.parse(, new URL( (mirrors PARSE_BOUNDARY_PATTERNS
+#     in src/a31_sama_v2.ts)
+#   .sh files → no boundary patterns defined yet (the shell verifier's
+#     own source tree has no analog of JSON.parse / new URL)
+PARSE_BOUNDARY_PATTERNS_TS_NAMES="JSON.parse new URL"
+PARSE_BOUNDARY_PATTERN_TS_JSON_PARSE='\bJSON\.parse[[:space:]]*\('
+PARSE_BOUNDARY_PATTERN_TS_NEW_URL='\bnew[[:space:]]+URL[[:space:]]*\('
+
+PARSE_BOUNDARY_PATTERNS_SH_NAMES=""
+
+# — Output styling -------------------------------------------------
+# ANSI escape codes for terminal output. Disabled when stdout is not
+# a TTY (the dispatcher handles that — these are the raw codes).
+COLOR_RESET=$'\033[0m'
+COLOR_GREEN=$'\033[32m'
+COLOR_RED=$'\033[31m'
+COLOR_YELLOW=$'\033[33m'
+COLOR_DIM=$'\033[2m'
+COLOR_BOLD=$'\033[1m'
+
+# Verdict glyphs. Match the TS verifier's "✓" / "✗" so cross-verify
+# diff'ing the two summaries is trivial.
+GLYPH_PASS="✓"
+GLYPH_FAIL="✗"
+
+# — Tool list ------------------------------------------------------
+# Used by `sama doctor`. Each entry is "tool:required" — `dot` is
+# the only optional one (graphviz; only needed for `sama graph`).
+SAMA_CLI_TOOLS="bash:required find:required grep:required awk:required wc:required sed:required sort:required dot:optional"
diff --git a/tools/sama-cli/src/b32_checks.sh b/tools/sama-cli/src/b32_checks.sh
new file mode 100644
index 0000000000000000000000000000000000000000..d2b46f6a1c89a598ebbf11eea00f7d393709b898
--- /dev/null
+++ b/tools/sama-cli/src/b32_checks.sh
@@ -0,0 +1,397 @@
+# b32 — logic: the seven SAMA v2 §4 conformance checks, implemented
+# as pure shell functions over an in-memory file list. Mirrors
+# src/b32_sama_v2_verify.ts. Each check populates the globals
+# CHECK_EXAMINED + CHECK_VIOLATIONS so the d21 dispatcher can render
+# verdicts uniformly. No I/O beyond reading the explicitly-listed
+# files; the file walker (list_repo_files) lives in b32_utils.
+
+# sama-import: a31_constants.sh
+# sama-import: b32_utils.sh
+
+# Output globals — reset by every run_check_* function.
+CHECK_EXAMINED=0
+CHECK_VIOLATIONS=()
+
+# Cached SAMA_FILES + TEST_FILES — populated by collect_input.
+SAMA_FILES=()
+TEST_FILES=()
+ALL_FILES=()
+ALL_FILES_FULLPATHS=()
+REPO_ROOT=""
+SRC_DIR=""
+
+# — collect_input -------------------------------------------------
+# Walks <src_dir>, populates SAMA_FILES / TEST_FILES / ALL_FILES.
+# Also records the full filesystem path in ALL_FILES_FULLPATHS so
+# checks can stat / cat files without re-resolving paths.
+collect_input() {
+  REPO_ROOT="$1"
+  SRC_DIR="$2"
+  SAMA_FILES=()
+  TEST_FILES=()
+  ALL_FILES=()
+  ALL_FILES_FULLPATHS=()
+  local rel
+  while IFS= read -r rel; do
+    [ -z "$rel" ] && continue
+    ALL_FILES+=("$rel")
+    ALL_FILES_FULLPATHS+=("$REPO_ROOT/$rel")
+    if is_sama_file "$rel"; then
+      SAMA_FILES+=("$rel")
+    elif is_test_file "$rel"; then
+      TEST_FILES+=("$rel")
+    fi
+  done < <(list_repo_files "$REPO_ROOT" "$SRC_DIR")
+}
+
+# Resolve a relative ".ts" import like "./c14_git.ts" from a file's
+# directory to the repo-relative path (e.g. "src/c14_git.ts").
+# Implemented in shell so the Law/Consistency checks share it.
+_resolve_import() {
+  local from_path="$1"
+  local imp="$2"
+  local dir="${from_path%/*}"
+  local rel="${imp#./}"
+  echo "${dir}/${rel}"
+}
+
+# Returns 0 if <rel_path> is in ALL_FILES.
+_in_files() {
+  local target="$1"
+  local f
+  for f in "${ALL_FILES[@]}"; do
+    [ "$f" = "$target" ] && return 0
+  done
+  return 1
+}
+
+# — Check 1: Sorted -----------------------------------------------
+# Every file carries a profile-recognised prefix; lex prefix order
+# equals layer order.
+run_check_sorted() {
+  CHECK_EXAMINED=0
+  CHECK_VIOLATIONS=()
+  local n=${#PROFILE_PREFIXES[@]}
+  local i j
+  for i in $(seq 0 $((n - 1))); do
+    for j in $(seq 0 $((n - 1))); do
+      [ "$i" = "$j" ] && continue
+      local la="${PROFILE_LAYERS[$i]}"
+      local pa="${PROFILE_PREFIXES[$i]}"
+      local lb="${PROFILE_LAYERS[$j]}"
+      local pb="${PROFILE_PREFIXES[$j]}"
+      if [ "$la" -lt "$lb" ] && [ "$pa" \> "$pb" ]; then
+        CHECK_VIOLATIONS+=("$pa::prefix \`$pa\` (layer $la) sorts after \`$pb\` (layer $lb) — lex order must equal layer order")
+      fi
+    done
+  done
+  local f
+  for f in "${SAMA_FILES[@]}"; do
+    CHECK_EXAMINED=$((CHECK_EXAMINED + 1))
+    if ! declared_layer "$f" > /dev/null; then
+      CHECK_VIOLATIONS+=("$f::no profile-recognised prefix")
+    fi
+  done
+}
+
+# — Check 2: Architecture -----------------------------------------
+run_check_architecture() {
+  CHECK_EXAMINED=0
+  CHECK_VIOLATIONS=()
+  local f
+  for f in "${ALL_FILES[@]}"; do
+    if is_sama_file "$f" || is_test_file "$f"; then
+      :
+    else
+      continue
+    fi
+    CHECK_EXAMINED=$((CHECK_EXAMINED + 1))
+    local matches
+    matches="$(all_prefix_matches "$f")"
+    if [ -z "$matches" ]; then
+      CHECK_VIOLATIONS+=("$f::unprefixed — does not match any profile prefix")
+      continue
+    fi
+    local distinct_layers
+    distinct_layers="$(echo "$matches" | awk '{print $1}' | sort -u | wc -l)"
+    if [ "$distinct_layers" -gt 1 ]; then
+      local detail
+      detail="$(echo "$matches" | awk '{printf "%s→L%s, ", $2, $1}' | sed 's/, $//')"
+      CHECK_VIOLATIONS+=("$f::ambiguous — matches multiple layers: $detail")
+    fi
+  done
+}
+
+# — Check 3: Modeled (tests) --------------------------------------
+run_check_modeled_tests() {
+  CHECK_EXAMINED=0
+  CHECK_VIOLATIONS=()
+  local ext="$PROFILE_EXTENSION"
+  local f
+  for f in "${SAMA_FILES[@]}"; do
+    local info
+    info="$(declared_layer "$f")" || continue
+    local layer
+    layer="$(echo "$info" | awk '{print $1}')"
+    if [ "$layer" != "1" ] && [ "$layer" != "2" ]; then
+      continue
+    fi
+    CHECK_EXAMINED=$((CHECK_EXAMINED + 1))
+    # Sibling = same path with extension swapped to .test<ext>.
+    local sibling="${f%${ext}}.test${ext}"
+    if ! _in_files "$sibling"; then
+      CHECK_VIOLATIONS+=("$f::no sibling test at \`$sibling\` — Layer $layer requires one")
+    fi
+  done
+}
+
+# — Check 4: Modeled (boundary) -----------------------------------
+run_check_modeled_boundary() {
+  CHECK_EXAMINED=0
+  CHECK_VIOLATIONS=()
+  local f
+  for f in "${SAMA_FILES[@]}"; do
+    local info
+    info="$(declared_layer "$f")" || continue
+    local layer
+    layer="$(echo "$info" | awk '{print $1}')"
+    CHECK_EXAMINED=$((CHECK_EXAMINED + 1))
+    [ "$layer" = "2" ] && continue
+    local matches
+    matches="$(parse_boundary_matches "$REPO_ROOT/$f")"
+    [ -z "$matches" ] && continue
+    local pat
+    while IFS= read -r pat; do
+      [ -z "$pat" ] && continue
+      CHECK_VIOLATIONS+=("$f::boundary pattern \`$pat\` found in Layer $layer — parsing belongs in Layer 2")
+    done <<< "$matches"
+  done
+}
+
+# — Check 5: Atomic -----------------------------------------------
+run_check_atomic() {
+  CHECK_EXAMINED=0
+  CHECK_VIOLATIONS=()
+  local f
+  for f in "${ALL_FILES[@]}"; do
+    if is_sama_file "$f" || is_test_file "$f"; then
+      :
+    else
+      continue
+    fi
+    CHECK_EXAMINED=$((CHECK_EXAMINED + 1))
+    local fullpath="$REPO_ROOT/$f"
+    local lc
+    lc="$(count_lines "$fullpath")"
+    if [ "$lc" -gt "$MAX_LINES" ]; then
+      CHECK_VIOLATIONS+=("$f::$lc lines (over the ${MAX_LINES}-line cap — split per UI/data domain)")
+    fi
+    if is_barrel "$fullpath"; then
+      CHECK_VIOLATIONS+=("$f::barrel re-export file (all lines are \`export … from\`)")
+    fi
+  done
+}
+
+# — Check 6: The Law (§1.2) ---------------------------------------
+# Build adjacency, then for every edge A→B require layer(B) <
+# layer(A), or same layer with sublayer.index(B) <= sublayer.index(A).
+# Plus DFS cycle detection.
+run_check_law() {
+  CHECK_EXAMINED=0
+  CHECK_VIOLATIONS=()
+  # Adjacency: ADJ_KEYS holds file paths in encounter order; the
+  # adjacency for ADJ_KEYS[i] is ADJ_VALUES[i] (space-separated).
+  ADJ_KEYS=()
+  ADJ_VALUES=()
+  local f
+  for f in "${ALL_FILES[@]}"; do
+    if is_sama_file "$f" || is_test_file "$f"; then
+      :
+    else
+      continue
+    fi
+    CHECK_EXAMINED=$((CHECK_EXAMINED + 1))
+    local out=""
+    local imp
+    while IFS= read -r imp; do
+      [ -z "$imp" ] && continue
+      # Only follow edges into files we actually loaded.
+      if _in_files "$imp"; then
+        out="$out $imp"
+      fi
+    done < <(collect_imports "$f" "$REPO_ROOT")
+    ADJ_KEYS+=("$f")
+    ADJ_VALUES+=("${out# }")
+  done
+
+  # Edge-by-edge check.
+  local i
+  for i in "${!ADJ_KEYS[@]}"; do
+    local from="${ADJ_KEYS[$i]}"
+    local outs="${ADJ_VALUES[$i]}"
+    [ -z "$outs" ] && continue
+    local a_info a_layer a_index
+    a_info="$(declared_layer "$from")" || continue
+    a_layer="$(echo "$a_info" | awk '{print $1}')"
+    a_index="$(echo "$a_info" | awk '{print $3}')"
+    local to
+    for to in $outs; do
+      local b_info b_layer b_index b_name
+      b_info="$(declared_layer "$to")" || continue
+      b_layer="$(echo "$b_info" | awk '{print $1}')"
+      b_index="$(echo "$b_info" | awk '{print $3}')"
+      b_name="$(echo "$b_info" | awk '{print $2}')"
+      if [ "$b_layer" -lt "$a_layer" ]; then
+        continue
+      fi
+      if [ "$b_layer" -gt "$a_layer" ]; then
+        CHECK_VIOLATIONS+=("$from::imports \`$to\` — Layer $a_layer → Layer $b_layer (upward, breaks §1.2)")
+        continue
+      fi
+      # Same layer: sublayer ordering — target must be earlier-or-equal.
+      if [ "$b_index" -gt "$a_index" ]; then
+        local a_name
+        a_name="$(echo "$a_info" | awk '{print $2}')"
+        CHECK_VIOLATIONS+=("$from::imports \`$to\` — same layer $a_layer but sublayer order reversed ($a_name index $a_index → $b_name index $b_index)")
+      fi
+    done
+  done
+
+  # DFS cycle detection on the same graph.
+  _detect_cycles_law
+}
+
+# Cycle detector. Uses parallel arrays + a recursive bash function.
+# Emits violations directly into CHECK_VIOLATIONS.
+_detect_cycles_law() {
+  CYCLE_COLOR_KEYS=()
+  CYCLE_COLOR_VALS=()
+  CYCLE_STACK=()
+  local k
+  for k in "${ADJ_KEYS[@]}"; do
+    CYCLE_COLOR_KEYS+=("$k")
+    CYCLE_COLOR_VALS+=("0")   # 0=white, 1=gray, 2=black
+  done
+  local i
+  for i in "${!CYCLE_COLOR_KEYS[@]}"; do
+    if [ "${CYCLE_COLOR_VALS[$i]}" = "0" ]; then
+      _dfs "${CYCLE_COLOR_KEYS[$i]}" || true
+    fi
+  done
+}
+
+_color_get() {
+  local node="$1"
+  local i
+  for i in "${!CYCLE_COLOR_KEYS[@]}"; do
+    if [ "${CYCLE_COLOR_KEYS[$i]}" = "$node" ]; then
+      echo "${CYCLE_COLOR_VALS[$i]}"
+      return 0
+    fi
+  done
+  echo "0"
+}
+
+_color_set() {
+  local node="$1"
+  local val="$2"
+  local i
+  for i in "${!CYCLE_COLOR_KEYS[@]}"; do
+    if [ "${CYCLE_COLOR_KEYS[$i]}" = "$node" ]; then
+      CYCLE_COLOR_VALS[$i]="$val"
+      return 0
+    fi
+  done
+  CYCLE_COLOR_KEYS+=("$node")
+  CYCLE_COLOR_VALS+=("$val")
+}
+
+_adj_for() {
+  local node="$1"
+  local i
+  for i in "${!ADJ_KEYS[@]}"; do
+    if [ "${ADJ_KEYS[$i]}" = "$node" ]; then
+      echo "${ADJ_VALUES[$i]}"
+      return 0
+    fi
+  done
+}
+
+_dfs() {
+  local node="$1"
+  _color_set "$node" "1"
+  CYCLE_STACK+=("$node")
+  local outs
+  outs="$(_adj_for "$node")"
+  local next
+  for next in $outs; do
+    local c
+    c="$(_color_get "$next")"
+    if [ "$c" = "1" ]; then
+      # Found a back-edge — extract cycle from stack.
+      local found_idx=-1
+      local i
+      for i in "${!CYCLE_STACK[@]}"; do
+        if [ "${CYCLE_STACK[$i]}" = "$next" ]; then
+          found_idx="$i"
+          break
+        fi
+      done
+      if [ "$found_idx" -ge 0 ]; then
+        local cycle_str=""
+        for i in $(seq "$found_idx" $((${#CYCLE_STACK[@]} - 1))); do
+          if [ -z "$cycle_str" ]; then
+            cycle_str="${CYCLE_STACK[$i]}"
+          else
+            cycle_str="$cycle_str → ${CYCLE_STACK[$i]}"
+          fi
+        done
+        cycle_str="$cycle_str → $next"
+        CHECK_VIOLATIONS+=("${CYCLE_STACK[$found_idx]}::import cycle: $cycle_str")
+      fi
+      _color_set "$node" "2"
+      unset 'CYCLE_STACK[${#CYCLE_STACK[@]}-1]'
+      return 1
+    fi
+    if [ "$c" = "0" ]; then
+      _dfs "$next" || true
+    fi
+  done
+  _color_set "$node" "2"
+  unset 'CYCLE_STACK[${#CYCLE_STACK[@]}-1]'
+  return 0
+}
+
+# — Check 7: Consistency (§3) -------------------------------------
+# For each file: find the max layer of any in-tree import. If that
+# max > declared layer, the prefix lies. (Same-layer with bad
+# sublayer order is the Law's concern; Consistency only fires when
+# the layer ceiling itself is breached.)
+run_check_consistency() {
+  CHECK_EXAMINED=0
+  CHECK_VIOLATIONS=()
+  local f
+  for f in "${SAMA_FILES[@]}"; do
+    local a_info a_layer a_prefix
+    a_info="$(declared_layer "$f")" || continue
+    a_layer="$(echo "$a_info" | awk '{print $1}')"
+    a_prefix="$(echo "$a_info" | awk '{print $4}')"
+    CHECK_EXAMINED=$((CHECK_EXAMINED + 1))
+    local ceiling=-1
+    local ceiling_file=""
+    local imp
+    while IFS= read -r imp; do
+      [ -z "$imp" ] && continue
+      local b_info b_layer
+      b_info="$(declared_layer "$imp")" || continue
+      b_layer="$(echo "$b_info" | awk '{print $1}')"
+      if [ "$b_layer" -gt "$ceiling" ]; then
+        ceiling="$b_layer"
+        ceiling_file="$imp"
+      fi
+    done < <(collect_imports "$f" "$REPO_ROOT")
+    if [ "$ceiling" -gt "$a_layer" ]; then
+      CHECK_VIOLATIONS+=("$f::declared Layer $a_layer (prefix \`$a_prefix\`) but imports reach Layer $ceiling via \`$ceiling_file\` — the prefix claims something the imports contradict")
+    fi
+  done
+}
diff --git a/tools/sama-cli/src/b32_checks.test.sh b/tools/sama-cli/src/b32_checks.test.sh
new file mode 100755
index 0000000000000000000000000000000000000000..0aeac09acaeb4f1dc6acfb22103a1a993426e4e8
--- /dev/null
+++ b/tools/sama-cli/src/b32_checks.test.sh
@@ -0,0 +1,198 @@
+#!/usr/bin/env bash
+# Sibling test for b32_checks.sh. Builds a fixture tree under a
+# temp dir, runs each of the seven §4 checks against it, and
+# asserts the expected verdict. Cross-validates the checks against
+# the same kind of "synthetic small repo" the TS verifier tests in
+# src/b32_sama_v2_verify.test.ts — same shapes, different language.
+
+SAMA_SRC_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
+# shellcheck disable=SC1091
+. "$SAMA_SRC_DIR/a31_constants.sh"
+# shellcheck disable=SC1091
+. "$SAMA_SRC_DIR/b32_utils.sh"
+# shellcheck disable=SC1091
+. "$SAMA_SRC_DIR/b32_checks.sh"
+
+TESTS_RUN=0
+TESTS_FAILED=0
+
+assert_eq() {
+  local expected="$1" actual="$2" label="$3"
+  TESTS_RUN=$((TESTS_RUN + 1))
+  if [ "$expected" = "$actual" ]; then
+    printf "  ok  %s\n" "$label"
+  else
+    TESTS_FAILED=$((TESTS_FAILED + 1))
+    printf "  FAIL %s\n    expected: %s\n    actual:   %s\n" "$label" "$expected" "$actual"
+  fi
+}
+
+assert_contains_any() {
+  local label="$1"
+  shift
+  local needle="$1"
+  shift
+  local found=0
+  for item in "$@"; do
+    case "$item" in
+      *"$needle"*) found=1; break ;;
+    esac
+  done
+  TESTS_RUN=$((TESTS_RUN + 1))
+  if [ "$found" = "1" ]; then
+    printf "  ok  %s\n" "$label"
+  else
+    TESTS_FAILED=$((TESTS_FAILED + 1))
+    printf "  FAIL %s — needle \`%s\` not in any violation\n" "$label" "$needle"
+  fi
+}
+
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+setup_clean_repo() {
+  rm -rf "$TMP_DIR/repo"
+  mkdir -p "$TMP_DIR/repo/src"
+  cat > "$TMP_DIR/repo/sama.profile.toml" <<'EOF'
+sama_version = "2.0"
+profile = "fixture"
+extension = ".ts"
+
+[layers.0]
+prefixes = ["a_"]
+
+[layers.1]
+prefixes = ["b_"]
+
+[layers.2]
+prefixes = ["c_"]
+
+[layers.3]
+prefixes = ["d_"]
+EOF
+}
+
+# — Check 1: Sorted (passing case) -------------------------------
+setup_clean_repo
+printf "export const x = 1;\n" > "$TMP_DIR/repo/src/a_pure.ts"
+parse_profile "$TMP_DIR/repo/sama.profile.toml"
+collect_input "$TMP_DIR/repo" "$TMP_DIR/repo/src"
+run_check_sorted
+assert_eq "0" "${#CHECK_VIOLATIONS[@]}" "Sorted: clean fixture has no violations"
+
+# — Check 2: Architecture (unprefixed file fails) -----------------
+setup_clean_repo
+printf "export const x = 1;\n" > "$TMP_DIR/repo/src/orphan.ts"
+parse_profile "$TMP_DIR/repo/sama.profile.toml"
+collect_input "$TMP_DIR/repo" "$TMP_DIR/repo/src"
+run_check_architecture
+v_count="${#CHECK_VIOLATIONS[@]}"
+assert_eq "1" "$v_count" "Architecture: unprefixed file flagged"
+assert_contains_any "Architecture: detail mentions unprefixed" "unprefixed" "${CHECK_VIOLATIONS[@]}"
+
+# — Check 3: Modeled (tests) (b_ file without sibling test) ------
+setup_clean_repo
+printf "export const f = 1;\n" > "$TMP_DIR/repo/src/b_core.ts"
+parse_profile "$TMP_DIR/repo/sama.profile.toml"
+collect_input "$TMP_DIR/repo" "$TMP_DIR/repo/src"
+run_check_modeled_tests
+assert_eq "1" "${#CHECK_VIOLATIONS[@]}" "Modeled (tests): b_ file without sibling test fails"
+
+# Pass when sibling test exists.
+setup_clean_repo
+printf "export const f = 1;\n" > "$TMP_DIR/repo/src/b_core.ts"
+printf "// test\n" > "$TMP_DIR/repo/src/b_core.test.ts"
+parse_profile "$TMP_DIR/repo/sama.profile.toml"
+collect_input "$TMP_DIR/repo" "$TMP_DIR/repo/src"
+run_check_modeled_tests
+assert_eq "0" "${#CHECK_VIOLATIONS[@]}" "Modeled (tests): sibling test satisfies"
+
+# — Check 4: Modeled (boundary) (JSON.parse in Layer 1 fails) ----
+setup_clean_repo
+printf "export const f = (s) => JSON.parse(s);\n" > "$TMP_DIR/repo/src/b_naughty.ts"
+parse_profile "$TMP_DIR/repo/sama.profile.toml"
+collect_input "$TMP_DIR/repo" "$TMP_DIR/repo/src"
+run_check_modeled_boundary
+v_count="${#CHECK_VIOLATIONS[@]}"
+assert_eq "1" "$v_count" "Modeled (boundary): JSON.parse in Layer 1 flagged"
+
+# Layer 2 is the legitimate site — same content should not fire.
+setup_clean_repo
+printf "export const f = (s) => JSON.parse(s);\n" > "$TMP_DIR/repo/src/c_adapter.ts"
+parse_profile "$TMP_DIR/repo/sama.profile.toml"
+collect_input "$TMP_DIR/repo" "$TMP_DIR/repo/src"
+run_check_modeled_boundary
+assert_eq "0" "${#CHECK_VIOLATIONS[@]}" "Modeled (boundary): JSON.parse in Layer 2 is OK"
+
+# String literal containing JSON.parse should NOT false-positive.
+setup_clean_repo
+printf 'const x = "JSON.parse(input)";\nexport const y = x.length;\n' > "$TMP_DIR/repo/src/b_safe.ts"
+parse_profile "$TMP_DIR/repo/sama.profile.toml"
+collect_input "$TMP_DIR/repo" "$TMP_DIR/repo/src"
+run_check_modeled_boundary
+assert_eq "0" "${#CHECK_VIOLATIONS[@]}" "Modeled (boundary): JSON.parse inside string literal ignored"
+
+# — Check 5: Atomic (oversized file fails) -----------------------
+setup_clean_repo
+# Make a file with 701 newlines.
+yes "x" 2>/dev/null | head -n 701 > "$TMP_DIR/repo/src/b_huge.ts"
+parse_profile "$TMP_DIR/repo/sama.profile.toml"
+collect_input "$TMP_DIR/repo" "$TMP_DIR/repo/src"
+run_check_atomic
+v_count="${#CHECK_VIOLATIONS[@]}"
+assert_eq "1" "$v_count" "Atomic: 701-line file flagged"
+
+# — Check 6: Law (§1.2) — upward import fails --------------------
+setup_clean_repo
+printf 'import { x } from "./d_entry.ts";\nexport const y = x;\n' > "$TMP_DIR/repo/src/b_bad.ts"
+printf 'export const x = 1;\n' > "$TMP_DIR/repo/src/d_entry.ts"
+parse_profile "$TMP_DIR/repo/sama.profile.toml"
+collect_input "$TMP_DIR/repo" "$TMP_DIR/repo/src"
+run_check_law
+v_count="${#CHECK_VIOLATIONS[@]}"
+# Should be ≥ 1: the upward edge from b_bad → d_entry.
+if [ "$v_count" -ge 1 ]; then
+  TESTS_RUN=$((TESTS_RUN + 1))
+  printf "  ok  Law: upward import flagged (%d violation(s))\n" "$v_count"
+else
+  TESTS_RUN=$((TESTS_RUN + 1))
+  TESTS_FAILED=$((TESTS_FAILED + 1))
+  printf "  FAIL Law: upward import not flagged\n"
+fi
+
+# Downward import is OK.
+setup_clean_repo
+printf 'import { x } from "./a_pure.ts";\nexport const y = x;\n' > "$TMP_DIR/repo/src/b_good.ts"
+printf 'export const x = 1;\n' > "$TMP_DIR/repo/src/a_pure.ts"
+parse_profile "$TMP_DIR/repo/sama.profile.toml"
+collect_input "$TMP_DIR/repo" "$TMP_DIR/repo/src"
+run_check_law
+assert_eq "0" "${#CHECK_VIOLATIONS[@]}" "Law: downward import passes"
+
+# — Check 7: Consistency (declared layer < actual import ceiling) ----
+setup_clean_repo
+printf 'import { x } from "./d_entry.ts";\nexport const y = x;\n' > "$TMP_DIR/repo/src/b_lies.ts"
+printf 'export const x = 1;\n' > "$TMP_DIR/repo/src/d_entry.ts"
+parse_profile "$TMP_DIR/repo/sama.profile.toml"
+collect_input "$TMP_DIR/repo" "$TMP_DIR/repo/src"
+run_check_consistency
+v_count="${#CHECK_VIOLATIONS[@]}"
+if [ "$v_count" -ge 1 ]; then
+  TESTS_RUN=$((TESTS_RUN + 1))
+  printf "  ok  Consistency: layer-lie flagged\n"
+else
+  TESTS_RUN=$((TESTS_RUN + 1))
+  TESTS_FAILED=$((TESTS_FAILED + 1))
+  printf "  FAIL Consistency: layer-lie not flagged\n"
+fi
+
+# — Summary -------------------------------------------------------
+echo
+if [ "$TESTS_FAILED" -eq 0 ]; then
+  printf "b32_checks.test.sh: %d/%d passed ✓\n" "$TESTS_RUN" "$TESTS_RUN"
+  exit 0
+else
+  printf "b32_checks.test.sh: %d/%d passed, %d FAILED ✗\n" \
+    "$((TESTS_RUN - TESTS_FAILED))" "$TESTS_RUN" "$TESTS_FAILED"
+  exit 1
+fi
diff --git a/tools/sama-cli/src/b32_utils.sh b/tools/sama-cli/src/b32_utils.sh
new file mode 100644
index 0000000000000000000000000000000000000000..fe4b96a1141156864b91d13649d807fcc1f88bc2
--- /dev/null
+++ b/tools/sama-cli/src/b32_utils.sh
@@ -0,0 +1,477 @@
+# b32 — logic: helpers shared across the seven §4 checks. Pure
+# functions: profile parsing, file walking, declared-layer lookup,
+# relative-import collection, string/comment masking, line counting,
+# and output helpers. Sourced by b32_checks.sh and d21_main.sh.
+# Never reads files outside the explicitly-passed paths.
+
+# Profile state — populated by parse_profile. Parallel arrays:
+#   PROFILE_LAYERS[i]            = "0" | "1" | "2" | "3"
+#   PROFILE_PREFIXES[i]          = "a31_" etc.
+#   PROFILE_SUBLAYER_NAMES[i]    = "default" | "logic" etc.
+#   PROFILE_SUBLAYER_INDEXES[i]  = "0" | "1" ...
+PROFILE_NAME=""
+PROFILE_SAMA_VERSION=""
+PROFILE_EXTENSION=".ts"
+PROFILE_LAYERS=()
+PROFILE_PREFIXES=()
+PROFILE_SUBLAYER_NAMES=()
+PROFILE_SUBLAYER_INDEXES=()
+
+# — parse_profile -------------------------------------------------
+# Reads a sama.profile.toml file and populates the PROFILE_* arrays.
+parse_profile() {
+  local file="$1"
+  PROFILE_NAME="$(_extract_top_scalar "$file" profile)"
+  PROFILE_SAMA_VERSION="$(_extract_top_scalar "$file" sama_version)"
+  local ext
+  ext="$(_extract_top_scalar "$file" extension)"
+  if [ -n "$ext" ]; then
+    PROFILE_EXTENSION="$ext"
+  else
+    PROFILE_EXTENSION=".ts"
+  fi
+  PROFILE_LAYERS=()
+  PROFILE_PREFIXES=()
+  PROFILE_SUBLAYER_NAMES=()
+  PROFILE_SUBLAYER_INDEXES=()
+  local layer_num
+  for layer_num in 0 1 2 3; do
+    _parse_layer_section "$file" "$layer_num"
+  done
+}
+
+# Extract a scalar key=value pair from the top-of-file section
+# (before any [section] header). Strips surrounding quotes.
+_extract_top_scalar() {
+  local file="$1"
+  local key="$2"
+  awk -v key="$key" '
+    /^[[:space:]]*\[/ { exit }
+    {
+      line = $0
+      sub(/#.*$/, "", line)
+      sub(/^[[:space:]]+/, "", line)
+      sub(/[[:space:]]+$/, "", line)
+      if (line == "") next
+      eq = index(line, "=")
+      if (eq == 0) next
+      k = substr(line, 1, eq - 1)
+      sub(/[[:space:]]+$/, "", k)
+      if (k != key) next
+      v = substr(line, eq + 1)
+      sub(/^[[:space:]]+/, "", v)
+      sub(/[[:space:]]+$/, "", v)
+      first = substr(v, 1, 1)
+      last = substr(v, length(v), 1)
+      if ((first == "\"" && last == "\"") || (first == "\x27" && last == "\x27")) {
+        v = substr(v, 2, length(v) - 2)
+      }
+      print v
+      exit
+    }
+  ' "$file"
+}
+
+# Parse one [layers.N] section into the PROFILE_* arrays.
+_parse_layer_section() {
+  local file="$1"
+  local layer="$2"
+  local body
+  body="$(awk -v target="layers.$layer" '
+    /^[[:space:]]*\[/ {
+      sec = $0
+      sub(/^[[:space:]]*\[/, "", sec)
+      sub(/\].*$/, "", sec)
+      gsub(/[[:space:]]/, "", sec)
+      in_target = (sec == target) ? 1 : 0
+      next
+    }
+    in_target == 1 { print }
+  ' "$file")"
+  [ -z "$body" ] && return 0
+
+  # prefixes = ["a", "b"] (single-line array)
+  local prefixes_line
+  prefixes_line="$(echo "$body" | grep -E '^[[:space:]]*prefixes[[:space:]]*=' | head -1)"
+  if [ -n "$prefixes_line" ]; then
+    local raw="${prefixes_line#*=}"
+    raw="$(echo "$raw" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
+    raw="${raw#\[}"
+    raw="${raw%\]}"
+    local idx=0
+    local saved_ifs="$IFS"
+    IFS=','
+    local p
+    for p in $raw; do
+      p="$(echo "$p" | sed 's/[[:space:]]//g;s/"//g;s/'\''//g')"
+      [ -z "$p" ] && continue
+      PROFILE_LAYERS+=("$layer")
+      PROFILE_PREFIXES+=("$p")
+      PROFILE_SUBLAYER_NAMES+=("default")
+      PROFILE_SUBLAYER_INDEXES+=("$idx")
+      idx=$((idx + 1))
+    done
+    IFS="$saved_ifs"
+    return 0
+  fi
+
+  # sublayers = [ { ... }, { ... } ] (single or multi-line)
+  local sublayers_block
+  sublayers_block="$(echo "$body" | awk '
+    /^[[:space:]]*sublayers[[:space:]]*=[[:space:]]*\[/ {
+      in_block = 1
+      if ($0 ~ /\][[:space:]]*$/) {
+        line = $0
+        sub(/^[^[]*\[/, "", line)
+        sub(/\][[:space:]]*$/, "", line)
+        print line
+        in_block = 0
+      }
+      next
+    }
+    in_block == 1 && /^[[:space:]]*\]/ { in_block = 0; next }
+    in_block == 1 { print }
+  ')"
+
+  if [ -n "$sublayers_block" ]; then
+    local idx=0
+    local line
+    while IFS= read -r line; do
+      [ -z "$line" ] && continue
+      local name prefix
+      name="$(echo "$line" | sed -n 's/.*name[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p')"
+      prefix="$(echo "$line" | sed -n 's/.*prefix[[:space:]]*=[[:space:]]*"\([^"]*\)".*/\1/p')"
+      if [ -n "$name" ] && [ -n "$prefix" ]; then
+        PROFILE_LAYERS+=("$layer")
+        PROFILE_PREFIXES+=("$prefix")
+        PROFILE_SUBLAYER_NAMES+=("$name")
+        PROFILE_SUBLAYER_INDEXES+=("$idx")
+        idx=$((idx + 1))
+      fi
+    done <<< "$sublayers_block"
+  fi
+}
+
+# — declared_layer ------------------------------------------------
+# Emits "<layer> <sublayer_name> <sublayer_index> <prefix>" for the
+# FIRST profile prefix that matches the basename of <path>.
+# Returns 1 if no prefix matches.
+declared_layer() {
+  local path="$1"
+  local base="${path##*/}"
+  local i
+  for i in "${!PROFILE_PREFIXES[@]}"; do
+    local prefix="${PROFILE_PREFIXES[$i]}"
+    case "$base" in
+      "$prefix"*)
+        echo "${PROFILE_LAYERS[$i]} ${PROFILE_SUBLAYER_NAMES[$i]} ${PROFILE_SUBLAYER_INDEXES[$i]} $prefix"
+        return 0
+        ;;
+    esac
+  done
+  return 1
+}
+
+# — all_prefix_matches --------------------------------------------
+# Emits "<layer> <prefix>" for every prefix that the basename of
+# <path> starts with.
+all_prefix_matches() {
+  local path="$1"
+  local base="${path##*/}"
+  local i
+  for i in "${!PROFILE_PREFIXES[@]}"; do
+    local prefix="${PROFILE_PREFIXES[$i]}"
+    case "$base" in
+      "$prefix"*) echo "${PROFILE_LAYERS[$i]} $prefix" ;;
+    esac
+  done
+}
+
+# — file classifiers ----------------------------------------------
+is_sama_file() {
+  local path="$1"
+  local ext="$PROFILE_EXTENSION"
+  case "$path" in
+    *".test${ext}") return 1 ;;
+    *"${ext}") return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+is_test_file() {
+  local path="$1"
+  local ext="$PROFILE_EXTENSION"
+  case "$path" in
+    *".test${ext}") return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+# — list_repo_files -----------------------------------------------
+# Walks <src_dir> non-recursively, emits one repo-relative path
+# per line, lex-sorted. <repo_root> is used to strip the prefix.
+list_repo_files() {
+  local repo_root="$1"
+  local src_dir="$2"
+  local ext="$PROFILE_EXTENSION"
+  find "$src_dir" -mindepth 1 -maxdepth 1 -type f -name "*${ext}" 2>/dev/null \
+    | sort \
+    | while IFS= read -r path; do
+        echo "${path#${repo_root}/}"
+      done
+}
+
+# — collect_imports_ts --------------------------------------------
+# Emits one resolved repo-relative path per line for every
+# `from "./xxx.ts"` import in <raw_file> that is NOT inside a
+# JS/TS string literal or comment.
+#
+# Implemented as a single awk pass over the file that tracks
+# string + comment state character-by-character. Mirrors
+# collectRelativeImports + stripStringsAndComments in
+# src/a31_sama_v2.ts.
+_emit_ts_imports_in() {
+  awk '
+    function nextc(   c) {
+      if (idx > len) return ""
+      c = substr(line, idx, 1); idx++; return c
+    }
+    {
+      line = $0
+      len = length(line)
+      idx = 1
+      while (idx <= len) {
+        c = substr(line, idx, 1)
+        d = (idx < len) ? substr(line, idx + 1, 1) : ""
+
+        if (in_comment_line) {
+          idx++
+          continue
+        }
+        if (in_comment_block) {
+          if (c == "*" && d == "/") { in_comment_block = 0; idx += 2; continue }
+          idx++
+          continue
+        }
+        if (in_string != "") {
+          if (c == "\\") { idx += 2; continue }
+          if (c == in_string) in_string = ""
+          idx++
+          continue
+        }
+        if (c == "/" && d == "/") { in_comment_line = 1; idx += 2; continue }
+        if (c == "/" && d == "*") { in_comment_block = 1; idx += 2; continue }
+        if (c == "\"" || c == "\x27" || c == "`") { in_string = c; idx++; continue }
+
+        # Look for `from` keyword (with word-boundary before)
+        if (c == "f" && substr(line, idx, 4) == "from") {
+          prev = (idx == 1) ? "" : substr(line, idx - 1, 1)
+          if (prev !~ /[A-Za-z0-9_$]/) {
+            j = idx + 4
+            while (j <= len && substr(line, j, 1) ~ /[ \t]/) j++
+            if (j <= len) {
+              q = substr(line, j, 1)
+              if (q == "\"" || q == "\x27") {
+                k = j + 1
+                start = k
+                while (k <= len && substr(line, k, 1) != q) k++
+                if (k <= len) {
+                  path = substr(line, start, k - start)
+                  if (substr(path, 1, 2) == "./" && substr(path, length(path) - 2) == ".ts") {
+                    print path
+                  }
+                  idx = k + 1
+                  continue
+                }
+              }
+            }
+          }
+        }
+        idx++
+      }
+      in_comment_line = 0
+    }
+  '
+}
+
+# — collect_imports_sh --------------------------------------------
+# Emits relative paths for every `# sama-import: xxx.sh` comment in
+# <raw_file>. Shell sourcing is too heterogeneous to parse robustly
+# (paths via ${VAR}, $BASH_SOURCE, parameter expansion, etc.) — so
+# the sub-project annotates each import with an explicit comment
+# line that the verifier reads as ground truth. The actual `source`
+# / `.` invocations are expected to live below those comments and
+# are not parsed.
+_emit_sh_imports_in() {
+  awk '
+    /^[[:space:]]*#[[:space:]]*sama-import:[[:space:]]*[a-zA-Z0-9_.-]+\.sh/ {
+      line = $0
+      sub(/.*sama-import:[[:space:]]*/, "", line)
+      sub(/[[:space:]].*$/, "", line)
+      if (line != "") print line
+    }
+  '
+}
+
+collect_imports() {
+  local file="$1"
+  local repo_root="$2"
+  local dir="${file%/*}"
+  local raw_file="$repo_root/$file"
+  local imp
+  if [ "$PROFILE_EXTENSION" = ".ts" ]; then
+    _emit_ts_imports_in < "$raw_file" \
+      | while IFS= read -r imp; do
+          [ -z "$imp" ] && continue
+          echo "${dir}/${imp#./}"
+        done
+  else
+    _emit_sh_imports_in < "$raw_file" \
+      | while IFS= read -r imp; do
+          [ -z "$imp" ] && continue
+          echo "${dir}/${imp#./}"
+        done
+  fi
+}
+
+# — strip_strings_and_comments ------------------------------------
+# Blanks out JS/TS string literals (', ", `) and comments (// and
+# /* */) to whitespace, preserving newlines so line numbers stay
+# aligned. Mirrors stripStringsAndComments in src/a31_sama_v2.ts.
+strip_strings_and_comments_file() {
+  local file="$1"
+  if [ "$PROFILE_EXTENSION" != ".ts" ]; then
+    cat "$file"
+    return 0
+  fi
+  awk '
+    BEGIN { RS = "\x01" }   # never occurs — read whole file as one record
+    {
+      src = $0
+      n = length(src)
+      out = ""
+      i = 1
+      while (i <= n) {
+        c = substr(src, i, 1)
+        d = (i < n) ? substr(src, i + 1, 1) : ""
+        if (c == "/" && d == "/") {
+          out = out "  "
+          i += 2
+          while (i <= n && substr(src, i, 1) != "\n") { out = out " "; i++ }
+        } else if (c == "/" && d == "*") {
+          out = out "  "
+          i += 2
+          while (i < n && !(substr(src, i, 1) == "*" && substr(src, i + 1, 1) == "/")) {
+            ch = substr(src, i, 1)
+            out = (ch == "\n") ? out "\n" : out " "
+            i++
+          }
+          out = out "  "
+          i += 2
+        } else if (c == "\"" || c == "\x27" || c == "`") {
+          q = c
+          out = out " "
+          i++
+          while (i <= n && substr(src, i, 1) != q) {
+            if (substr(src, i, 1) == "\\" && i + 1 <= n) {
+              out = out "  "
+              i += 2
+              continue
+            }
+            ch = substr(src, i, 1)
+            out = (ch == "\n") ? out "\n" : out " "
+            i++
+          }
+          out = out " "
+          i++
+        } else {
+          out = out c
+          i++
+        }
+      }
+      printf "%s", out
+    }
+  ' "$file"
+}
+
+# — count_lines ---------------------------------------------------
+# Returns (number of "\n" in file) + 1, matching TS
+# content.split("\n").length exactly. wc -l counts newlines, not
+# the split-length, so we add 1 to align with TS behavior.
+count_lines() {
+  local file="$1"
+  local nl
+  nl="$(tr -cd '\n' < "$file" | wc -c)"
+  echo $((nl + 1))
+}
+
+# — is_barrel -----------------------------------------------------
+# Returns 0 if <file> is a barrel re-export file: ≥2 non-empty
+# code lines (after stripping), and every code line is
+# `export ... from ...`. Only meaningful for .ts.
+is_barrel() {
+  local file="$1"
+  [ "$PROFILE_EXTENSION" = ".ts" ] || return 1
+  local stripped
+  stripped="$(strip_strings_and_comments_file "$file")"
+  local code_lines
+  code_lines="$(echo "$stripped" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -cE '.')"
+  [ "$code_lines" -ge 2 ] || return 1
+  local export_lines
+  export_lines="$(echo "$stripped" \
+    | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' \
+    | grep -E '.' \
+    | grep -cE '^export[[:space:]]+(\*|\{).*\bfrom\b')"
+  [ "$export_lines" -eq "$code_lines" ] && return 0 || return 1
+}
+
+# — parse_boundary_matches ----------------------------------------
+# Emits matched pattern names ("JSON.parse" / "new URL") one per
+# line for any pattern occurring in the STRIPPED contents of <file>.
+# Only meaningful for .ts; .sh returns nothing.
+parse_boundary_matches() {
+  local file="$1"
+  [ "$PROFILE_EXTENSION" = ".ts" ] || return 0
+  local stripped
+  stripped="$(strip_strings_and_comments_file "$file")"
+  if echo "$stripped" | grep -qE "$PARSE_BOUNDARY_PATTERN_TS_JSON_PARSE"; then
+    echo "JSON.parse"
+  fi
+  if echo "$stripped" | grep -qE "$PARSE_BOUNDARY_PATTERN_TS_NEW_URL"; then
+    echo "new URL"
+  fi
+}
+
+# — output helpers ------------------------------------------------
+SAMA_COLOR_ENABLED=1
+sama_color_disable() { SAMA_COLOR_ENABLED=0; }
+_c() {
+  if [ "$SAMA_COLOR_ENABLED" = "1" ]; then printf "%s" "$1"; fi
+  return 0
+}
+
+print_section_header() {
+  echo
+  _c "$COLOR_BOLD"
+  echo "── $1 ──────────────────────────────────────"
+  _c "$COLOR_RESET"
+}
+
+print_check_verdict() {
+  local id="$1" name="$2" examined="$3" violations="$4"
+  if [ "$violations" -eq 0 ]; then
+    _c "$COLOR_GREEN"
+    printf "  %s Check %s: %s — %d examined, 0 violations\n" "$GLYPH_PASS" "$id" "$name" "$examined"
+    _c "$COLOR_RESET"
+  else
+    _c "$COLOR_RED"
+    printf "  %s Check %s: %s — %d examined, %d violations\n" "$GLYPH_FAIL" "$id" "$name" "$examined" "$violations"
+    _c "$COLOR_RESET"
+  fi
+}
+
+print_violation() {
+  _c "$COLOR_DIM"
+  printf "      %s  %s\n" "$1" "$2"
+  _c "$COLOR_RESET"
+}
diff --git a/tools/sama-cli/src/b32_utils.test.sh b/tools/sama-cli/src/b32_utils.test.sh
new file mode 100755
index 0000000000000000000000000000000000000000..16957c75ed76fc8ef9fd63e76421c6316e5372d6
--- /dev/null
+++ b/tools/sama-cli/src/b32_utils.test.sh
@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+# Sibling test for b32_utils.sh. Asserts the pure helpers behave
+# as documented: profile parsing populates the PROFILE_* arrays,
+# the file classifiers split on .test extension correctly, and
+# the line counter matches the TS "split('\n').length" semantics.
+#
+# A minimal in-file harness (no bats dependency): each test calls
+# `assert_eq` which prints PASS/FAIL and increments counters.
+# Exit 0 if all assertions pass, 1 otherwise. Run from any cwd.
+
+SAMA_SRC_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
+# shellcheck disable=SC1091
+. "$SAMA_SRC_DIR/a31_constants.sh"
+# shellcheck disable=SC1091
+. "$SAMA_SRC_DIR/b32_utils.sh"
+
+TESTS_RUN=0
+TESTS_FAILED=0
+
+assert_eq() {
+  local expected="$1" actual="$2" label="$3"
+  TESTS_RUN=$((TESTS_RUN + 1))
+  if [ "$expected" = "$actual" ]; then
+    printf "  ok  %s\n" "$label"
+  else
+    TESTS_FAILED=$((TESTS_FAILED + 1))
+    printf "  FAIL %s\n    expected: %s\n    actual:   %s\n" "$label" "$expected" "$actual"
+  fi
+}
+
+assert_contains() {
+  local haystack="$1" needle="$2" label="$3"
+  TESTS_RUN=$((TESTS_RUN + 1))
+  case "$haystack" in
+    *"$needle"*) printf "  ok  %s\n" "$label" ;;
+    *)
+      TESTS_FAILED=$((TESTS_FAILED + 1))
+      printf "  FAIL %s\n    haystack: %s\n    needle:   %s\n" "$label" "$haystack" "$needle"
+      ;;
+  esac
+}
+
+mkfile() {
+  local content="$1" path="$2"
+  printf "%s" "$content" > "$path"
+}
+
+# Run tests in a temp dir so we don't touch the real repo profile.
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+# — parse_profile -------------------------------------------------
+PROFILE_PATH="$TMP_DIR/test.profile.toml"
+cat > "$PROFILE_PATH" <<'EOF'
+sama_version = "2.0"
+profile = "test-profile"
+extension = ".sh"
+
+[layers.0]
+prefixes = ["a_"]
+
+[layers.1]
+sublayers = [
+  { name = "core", prefix = "b_" },
+]
+
+[layers.2]
+prefixes = ["c_"]
+
+[layers.3]
+prefixes = ["d_"]
+EOF
+
+parse_profile "$PROFILE_PATH"
+assert_eq "test-profile" "$PROFILE_NAME" "parse_profile: PROFILE_NAME"
+assert_eq "2.0" "$PROFILE_SAMA_VERSION" "parse_profile: PROFILE_SAMA_VERSION"
+assert_eq ".sh" "$PROFILE_EXTENSION" "parse_profile: PROFILE_EXTENSION"
+assert_eq "4" "${#PROFILE_PREFIXES[@]}" "parse_profile: 4 prefixes"
+assert_eq "a_" "${PROFILE_PREFIXES[0]}" "parse_profile: layer-0 prefix"
+assert_eq "b_" "${PROFILE_PREFIXES[1]}" "parse_profile: layer-1 prefix from sublayer"
+assert_eq "core" "${PROFILE_SUBLAYER_NAMES[1]}" "parse_profile: layer-1 sublayer name"
+
+# — file classifiers ----------------------------------------------
+PROFILE_EXTENSION=".ts"
+is_sama_file "src/a31_foo.ts" && r=0 || r=1
+assert_eq "0" "$r" "is_sama_file: src/a31_foo.ts"
+is_sama_file "src/a31_foo.test.ts" && r=0 || r=1
+assert_eq "1" "$r" "is_sama_file rejects .test.ts"
+is_test_file "src/a31_foo.test.ts" && r=0 || r=1
+assert_eq "0" "$r" "is_test_file: .test.ts"
+is_test_file "src/a31_foo.ts" && r=0 || r=1
+assert_eq "1" "$r" "is_test_file rejects plain .ts"
+
+# — declared_layer ------------------------------------------------
+PROFILE_LAYERS=("0" "1" "1" "2" "3")
+PROFILE_PREFIXES=("a31_" "b32_" "b51_" "c14_" "d21_")
+PROFILE_SUBLAYER_NAMES=("default" "logic" "render" "io" "handlers")
+PROFILE_SUBLAYER_INDEXES=("0" "0" "1" "0" "0")
+result="$(declared_layer "src/b51_render_admin.ts")"
+assert_eq "1 render 1 b51_" "$result" "declared_layer: b51_ → Layer 1 render"
+result="$(declared_layer "src/unprefixed.ts")"
+assert_eq "" "$result" "declared_layer: unprefixed returns empty"
+
+# — count_lines ---------------------------------------------------
+mkfile "a" "$TMP_DIR/one_no_nl.txt"
+assert_eq "1" "$(count_lines "$TMP_DIR/one_no_nl.txt")" "count_lines: 'a' = 1"
+
+mkfile "a\nb\n" "$TMP_DIR/two_with_nl.txt"
+# printf %s doesn't interpret \n; use printf for real newlines
+printf "a\nb\n" > "$TMP_DIR/two_with_nl.txt"
+assert_eq "3" "$(count_lines "$TMP_DIR/two_with_nl.txt")" "count_lines: 'a\\nb\\n' = 3 (matches TS split)"
+
+printf "" > "$TMP_DIR/empty.txt"
+assert_eq "1" "$(count_lines "$TMP_DIR/empty.txt")" "count_lines: empty = 1"
+
+# — strip_strings_and_comments -----------------------------------
+PROFILE_EXTENSION=".ts"
+mkfile "const x = \"hello\"; // a comment" "$TMP_DIR/strip.ts"
+stripped="$(strip_strings_and_comments_file "$TMP_DIR/strip.ts")"
+assert_contains "$stripped" "const x = " "strip preserves code"
+# After stripping, "hello" should be whitespace and // ... should be whitespace.
+case "$stripped" in
+  *"hello"*)
+    TESTS_FAILED=$((TESTS_FAILED + 1))
+    printf "  FAIL strip removes string content\n    leaked: %s\n" "$stripped"
+    ;;
+  *)
+    TESTS_RUN=$((TESTS_RUN + 1))
+    printf "  ok  strip removes string content\n"
+    ;;
+esac
+
+# — Summary -------------------------------------------------------
+echo
+if [ "$TESTS_FAILED" -eq 0 ]; then
+  printf "b32_utils.test.sh: %d/%d passed ✓\n" "$TESTS_RUN" "$TESTS_RUN"
+  exit 0
+else
+  printf "b32_utils.test.sh: %d/%d passed, %d FAILED ✗\n" \
+    "$((TESTS_RUN - TESTS_FAILED))" "$TESTS_RUN" "$TESTS_FAILED"
+  exit 1
+fi
diff --git a/tools/sama-cli/src/c14_graph.sh b/tools/sama-cli/src/c14_graph.sh
new file mode 100644
index 0000000000000000000000000000000000000000..640d48d711769ecae7f236863b682cca67e6e23a
--- /dev/null
+++ b/tools/sama-cli/src/c14_graph.sh
@@ -0,0 +1,99 @@
+# c14 — adapter: import-graph rendering. Walks ALL_FILES,
+# resolves their import edges via collect_imports, emits a graphviz
+# .dot file, and (if `dot` is on PATH) renders a PNG. The boundary
+# call to `dot` happens here, so this file is correctly Layer 2 —
+# its prefix declares it as such, and the §4.4 Modeled (boundary)
+# rule permits filesystem + tool boundaries in Layer 2.
+
+# sama-import: a31_constants.sh
+# sama-import: b32_utils.sh
+
+# Emit a .dot graph of the import topology to stdout.
+#
+# Node attributes are layer-coloured so the rendered PNG makes the
+# layer stratification visible. Edges flow from importer → imported
+# (matching the natural reading direction); the .dot `rankdir=LR`
+# puts Layer 0 on the left and Layer 3 on the right.
+emit_dot() {
+  local repo_root="$1"
+  local src_dir="$2"
+
+  echo "digraph sama {"
+  echo "  rankdir = LR;"
+  echo "  node [shape=box, style=\"rounded,filled\", fontname=\"Helvetica\"];"
+  echo "  graph [splines=ortho, nodesep=0.4];"
+
+  local color_l0="#cfe8d4"
+  local color_l1="#cfd8e8"
+  local color_l2="#e8e0c4"
+  local color_l3="#e8c4c4"
+
+  # Nodes
+  local f
+  for f in "${ALL_FILES[@]}"; do
+    if is_sama_file "$f" || is_test_file "$f"; then
+      :
+    else
+      continue
+    fi
+    local label="${f##*/}"
+    local info
+    local layer="?"
+    local color="#dddddd"
+    if info="$(declared_layer "$f")"; then
+      layer="$(echo "$info" | awk '{print $1}')"
+      case "$layer" in
+        0) color="$color_l0" ;;
+        1) color="$color_l1" ;;
+        2) color="$color_l2" ;;
+        3) color="$color_l3" ;;
+      esac
+    fi
+    echo "  \"$f\" [label=\"$label\\nL$layer\", fillcolor=\"$color\"];"
+  done
+
+  # Edges
+  for f in "${ALL_FILES[@]}"; do
+    if is_sama_file "$f" || is_test_file "$f"; then
+      :
+    else
+      continue
+    fi
+    local imp
+    while IFS= read -r imp; do
+      [ -z "$imp" ] && continue
+      # Only emit edges into files we actually loaded.
+      local found=0
+      local x
+      for x in "${ALL_FILES[@]}"; do
+        if [ "$x" = "$imp" ]; then found=1; break; fi
+      done
+      [ "$found" = "1" ] || continue
+      echo "  \"$f\" -> \"$imp\";"
+    done < <(collect_imports "$f" "$repo_root")
+  done
+
+  echo "}"
+}
+
+# Wrapper: write .dot to a path; render PNG if dot is available.
+render_graph() {
+  local repo_root="$1"
+  local src_dir="$2"
+  local out_dot="${3:-/tmp/sama-graph.dot}"
+  local out_png="${4:-/tmp/sama-graph.png}"
+
+  emit_dot "$repo_root" "$src_dir" > "$out_dot"
+  echo "Wrote: $out_dot"
+
+  if command -v dot > /dev/null 2>&1; then
+    if dot -Tpng "$out_dot" -o "$out_png" 2>/dev/null; then
+      echo "Wrote: $out_png"
+      return 0
+    fi
+    echo "warning: \`dot\` failed to render — keeping .dot only" >&2
+    return 0
+  fi
+  echo "info: \`dot\` (graphviz) not installed — wrote .dot only" >&2
+  return 0
+}
diff --git a/tools/sama-cli/src/c14_graph.test.sh b/tools/sama-cli/src/c14_graph.test.sh
new file mode 100755
index 0000000000000000000000000000000000000000..52ace72c2071206f646bb73a36d280bdaa93cec6
--- /dev/null
+++ b/tools/sama-cli/src/c14_graph.test.sh
@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# Sibling test for c14_graph.sh. Verifies emit_dot produces a
+# well-formed graphviz file with the expected node + edge content,
+# and that render_graph falls back gracefully when `dot` is absent.
+
+SAMA_SRC_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)"
+# shellcheck disable=SC1091
+. "$SAMA_SRC_DIR/a31_constants.sh"
+# shellcheck disable=SC1091
+. "$SAMA_SRC_DIR/b32_utils.sh"
+# shellcheck disable=SC1091
+. "$SAMA_SRC_DIR/b32_checks.sh"
+# shellcheck disable=SC1091
+. "$SAMA_SRC_DIR/c14_graph.sh"
+
+TESTS_RUN=0
+TESTS_FAILED=0
+
+assert_eq() {
+  local expected="$1" actual="$2" label="$3"
+  TESTS_RUN=$((TESTS_RUN + 1))
+  if [ "$expected" = "$actual" ]; then
+    printf "  ok  %s\n" "$label"
+  else
+    TESTS_FAILED=$((TESTS_FAILED + 1))
+    printf "  FAIL %s\n    expected: %s\n    actual:   %s\n" "$label" "$expected" "$actual"
+  fi
+}
+
+assert_contains() {
+  local haystack="$1" needle="$2" label="$3"
+  TESTS_RUN=$((TESTS_RUN + 1))
+  case "$haystack" in
+    *"$needle"*) printf "  ok  %s\n" "$label" ;;
+    *)
+      TESTS_FAILED=$((TESTS_FAILED + 1))
+      printf "  FAIL %s — needle \`%s\` not found\n" "$label" "$needle"
+      ;;
+  esac
+}
+
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+# Build a tiny fixture repo.
+mkdir -p "$TMP_DIR/repo/src"
+cat > "$TMP_DIR/repo/sama.profile.toml" <<'EOF'
+sama_version = "2.0"
+profile = "graph-fixture"
+extension = ".ts"
+
+[layers.0]
+prefixes = ["a_"]
+
+[layers.1]
+prefixes = ["b_"]
+
+[layers.2]
+prefixes = ["c_"]
+
+[layers.3]
+prefixes = ["d_"]
+EOF
+
+cat > "$TMP_DIR/repo/src/a_pure.ts" <<'EOF'
+export const X = 1;
+EOF
+
+cat > "$TMP_DIR/repo/src/b_logic.ts" <<'EOF'
+import { X } from "./a_pure.ts";
+export const Y = X + 1;
+EOF
+
+parse_profile "$TMP_DIR/repo/sama.profile.toml"
+collect_input "$TMP_DIR/repo" "$TMP_DIR/repo/src"
+
+# — emit_dot ------------------------------------------------------
+dot_output="$(emit_dot "$TMP_DIR/repo" "$TMP_DIR/repo/src")"
+
+assert_contains "$dot_output" "digraph sama {" "emit_dot: opens with digraph block"
+assert_contains "$dot_output" "src/a_pure.ts" "emit_dot: includes a_pure node"
+assert_contains "$dot_output" "src/b_logic.ts" "emit_dot: includes b_logic node"
+assert_contains "$dot_output" "L0" "emit_dot: labels Layer 0"
+assert_contains "$dot_output" "L1" "emit_dot: labels Layer 1"
+assert_contains "$dot_output" "\"src/b_logic.ts\" -> \"src/a_pure.ts\"" "emit_dot: emits b → a edge"
+
+# — render_graph: writes .dot regardless of `dot` availability ----
+out_dot="$TMP_DIR/graph.dot"
+out_png="$TMP_DIR/graph.png"
+render_graph "$TMP_DIR/repo" "$TMP_DIR/repo/src" "$out_dot" "$out_png" >/dev/null 2>&1
+if [ -f "$out_dot" ]; then
+  TESTS_RUN=$((TESTS_RUN + 1))
+  printf "  ok  render_graph: writes .dot file\n"
+else
+  TESTS_RUN=$((TESTS_RUN + 1))
+  TESTS_FAILED=$((TESTS_FAILED + 1))
+  printf "  FAIL render_graph: did not write .dot file\n"
+fi
+
+# — Summary -------------------------------------------------------
+echo
+if [ "$TESTS_FAILED" -eq 0 ]; then
+  printf "c14_graph.test.sh: %d/%d passed ✓\n" "$TESTS_RUN" "$TESTS_RUN"
+  exit 0
+else
+  printf "c14_graph.test.sh: %d/%d passed, %d FAILED ✗\n" \
+    "$((TESTS_RUN - TESTS_FAILED))" "$TESTS_RUN" "$TESTS_FAILED"
+  exit 1
+fi
diff --git a/tools/sama-cli/src/d21_main.sh b/tools/sama-cli/src/d21_main.sh
new file mode 100644
index 0000000000000000000000000000000000000000..726d6c9cd550f8b895505b5d6a85b536e690c13e
--- /dev/null
+++ b/tools/sama-cli/src/d21_main.sh
@@ -0,0 +1,256 @@
+#!/usr/bin/env bash
+# d21 — entry: the SAMA v2 shell-CLI dispatcher. Wires the seven §4
+# checks, the doctor diagnostic, and the graph adapter together into
+# the user-facing `sama` command. This is the only layer permitted
+# to read argv, exit, or write to stdout for user consumption.
+#
+# Invoked by the `tools/sama-cli/sama` wrapper. The wrapper sources
+# this file with SAMA_SRC_DIR pointing at tools/sama-cli/src.
+
+# sama-import: a31_constants.sh
+# sama-import: b32_utils.sh
+# sama-import: b32_checks.sh
+# sama-import: c14_graph.sh
+
+set -u
+
+# SAMA_SRC_DIR is exported by the entry wrapper. Re-source siblings
+# defensively in case d21 is invoked directly.
+SAMA_SRC_DIR="${SAMA_SRC_DIR:-$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" && pwd)}"
+# shellcheck disable=SC1091
+. "$SAMA_SRC_DIR/a31_constants.sh"
+# shellcheck disable=SC1091
+. "$SAMA_SRC_DIR/b32_utils.sh"
+# shellcheck disable=SC1091
+. "$SAMA_SRC_DIR/b32_checks.sh"
+# shellcheck disable=SC1091
+. "$SAMA_SRC_DIR/c14_graph.sh"
+
+# Disable color when stdout isn't a TTY (so cross-verify diffs stay clean).
+if [ ! -t 1 ]; then
+  sama_color_disable
+fi
+# Respect the NO_COLOR convention (https://no-color.org/).
+if [ -n "${NO_COLOR:-}" ]; then
+  sama_color_disable
+fi
+
+print_usage() {
+  cat <<'EOF'
+sama — SAMA v2 verifier (shell implementation)
+
+USAGE
+  sama check [check-name]   Run all seven §4 checks (or just one)
+  sama graph [out.dot]      Emit graphviz .dot of the import graph
+  sama doctor               List tools the verifier depends on
+  sama --version            Print the verifier version
+  sama --help               This message
+
+CHECK NAMES (for `sama check <name>`)
+  sorted, architecture, modeled-tests, modeled-boundary,
+  atomic, law, consistency
+
+FLAGS
+  --profile=PATH            Path to sama.profile.toml (default: ./sama.profile.toml)
+  --src=PATH                Path to src directory (default: ./src)
+  --summary                 Emit only the "N / 7" verdict line (for scripting)
+
+EXAMPLES
+  sama check                # run all checks in the current repo
+  sama check --src=tools/sama-cli/src --profile=tools/sama-cli/sama.profile.toml
+  sama graph /tmp/graph.dot
+  sama doctor
+
+The shell verifier is the independent oracle for SAMA v2: a second
+implementation in a different language that should produce the same
+7/7 ✓ verdict as the TypeScript verifier at src/b32_sama_v2_verify.ts.
+EOF
+}
+
+print_version() {
+  echo "sama (sama-cli shell verifier) — SAMA v2.0"
+}
+
+# Parse --key=value style flags from argv. Sets the globals
+# OPT_PROFILE, OPT_SRC, OPT_SUMMARY, and leaves POSITIONAL args
+# in the POSITIONAL array.
+OPT_PROFILE=""
+OPT_SRC=""
+OPT_SUMMARY=0
+POSITIONAL=()
+parse_flags() {
+  POSITIONAL=()
+  local arg
+  for arg in "$@"; do
+    case "$arg" in
+      --profile=*) OPT_PROFILE="${arg#--profile=}" ;;
+      --src=*)     OPT_SRC="${arg#--src=}" ;;
+      --summary)   OPT_SUMMARY=1 ;;
+      --no-color)  sama_color_disable ;;
+      --help|-h)   print_usage; exit 0 ;;
+      --version)   print_version; exit 0 ;;
+      --*)         echo "unknown flag: $arg" >&2; exit 2 ;;
+      *)           POSITIONAL+=("$arg") ;;
+    esac
+  done
+}
+
+# Resolve repo root + src dir + profile path based on flags or defaults.
+resolve_paths() {
+  local profile_path="$OPT_PROFILE"
+  local src_path="$OPT_SRC"
+  if [ -z "$profile_path" ]; then
+    profile_path="./sama.profile.toml"
+  fi
+  if [ -z "$src_path" ]; then
+    src_path="./src"
+  fi
+  # Absolute-ify
+  profile_path="$(cd "$(dirname "$profile_path")" 2>/dev/null && pwd)/$(basename "$profile_path")"
+  src_path="$(cd "$src_path" 2>/dev/null && pwd)"
+  if [ -z "$profile_path" ] || [ ! -f "$profile_path" ]; then
+    echo "error: profile not found: $OPT_PROFILE (looked at $profile_path)" >&2
+    exit 2
+  fi
+  if [ -z "$src_path" ] || [ ! -d "$src_path" ]; then
+    echo "error: src dir not found: $OPT_SRC (looked at $src_path)" >&2
+    exit 2
+  fi
+  RESOLVED_PROFILE="$profile_path"
+  # Repo root = parent of src dir.
+  RESOLVED_REPO_ROOT="$(cd "$src_path/.." && pwd)"
+  RESOLVED_SRC_REL="${src_path#${RESOLVED_REPO_ROOT}/}"
+  RESOLVED_SRC_DIR="$src_path"
+}
+
+cmd_check() {
+  resolve_paths
+  parse_profile "$RESOLVED_PROFILE"
+  collect_input "$RESOLVED_REPO_ROOT" "$RESOLVED_SRC_DIR"
+
+  local target=""
+  if [ "${#POSITIONAL[@]}" -gt 1 ]; then
+    target="${POSITIONAL[1]}"
+  fi
+
+  local passed=0
+  local total=0
+  local results=()
+  # Order matches src/b32_sama_v2_verify.ts.
+  local checks_meta=(
+    "1::Sorted::run_check_sorted::sorted"
+    "2::Architecture::run_check_architecture::architecture"
+    "3::Modeled (tests)::run_check_modeled_tests::modeled-tests"
+    "4::Modeled (boundary)::run_check_modeled_boundary::modeled-boundary"
+    "5::Atomic::run_check_atomic::atomic"
+    "6::Law (§1.2)::run_check_law::law"
+    "7::Consistency (§3)::run_check_consistency::consistency"
+  )
+
+  if [ "$OPT_SUMMARY" = "0" ]; then
+    print_section_header "SAMA v2 verifier — profile: $PROFILE_NAME"
+    printf "  Source tree: %s\n" "$RESOLVED_SRC_REL"
+    printf "  Files examined: %d (sources + tests)\n" "${#ALL_FILES[@]}"
+  fi
+
+  local meta
+  for meta in "${checks_meta[@]}"; do
+    local id name fn short
+    id="$(echo "$meta" | awk -F '::' '{print $1}')"
+    name="$(echo "$meta" | awk -F '::' '{print $2}')"
+    fn="$(echo "$meta" | awk -F '::' '{print $3}')"
+    short="$(echo "$meta" | awk -F '::' '{print $4}')"
+    if [ -n "$target" ] && [ "$target" != "$short" ]; then
+      continue
+    fi
+    total=$((total + 1))
+    "$fn"
+    local violations="${#CHECK_VIOLATIONS[@]}"
+    if [ "$violations" -eq 0 ]; then
+      passed=$((passed + 1))
+    fi
+    if [ "$OPT_SUMMARY" = "0" ]; then
+      print_check_verdict "$id" "$name" "$CHECK_EXAMINED" "$violations"
+      local v
+      for v in "${CHECK_VIOLATIONS[@]}"; do
+        local vf vd
+        vf="${v%%::*}"
+        vd="${v#*::}"
+        print_violation "$vf" "$vd"
+      done
+    fi
+  done
+
+  echo
+  if [ "$passed" = "$total" ]; then
+    _c "$COLOR_GREEN"
+    printf "  %d / %d %s — all checks passed\n" "$passed" "$total" "$GLYPH_PASS"
+    _c "$COLOR_RESET"
+  else
+    _c "$COLOR_RED"
+    printf "  %d / %d %s — %d check(s) failed\n" "$passed" "$total" "$GLYPH_FAIL" "$((total - passed))"
+    _c "$COLOR_RESET"
+  fi
+  echo
+
+  if [ "$passed" = "$total" ]; then
+    return 0
+  fi
+  return 1
+}
+
+cmd_graph() {
+  resolve_paths
+  parse_profile "$RESOLVED_PROFILE"
+  collect_input "$RESOLVED_REPO_ROOT" "$RESOLVED_SRC_DIR"
+
+  local out_dot="${POSITIONAL[1]:-/tmp/sama-graph.dot}"
+  local out_png="${out_dot%.dot}.png"
+  render_graph "$RESOLVED_REPO_ROOT" "$RESOLVED_SRC_DIR" "$out_dot" "$out_png"
+}
+
+cmd_doctor() {
+  print_section_header "sama doctor — tool availability"
+  local entry tool req status version
+  for entry in $SAMA_CLI_TOOLS; do
+    tool="${entry%:*}"
+    req="${entry#*:}"
+    if command -v "$tool" > /dev/null 2>&1; then
+      version="$("$tool" --version 2>/dev/null | head -1)"
+      [ -z "$version" ] && version="(version unknown)"
+      _c "$COLOR_GREEN"
+      printf "  %s %s [%s]\n" "$GLYPH_PASS" "$tool" "$req"
+      _c "$COLOR_DIM"
+      printf "      %s\n" "$version"
+      _c "$COLOR_RESET"
+    else
+      if [ "$req" = "required" ]; then
+        _c "$COLOR_RED"
+        printf "  %s %s [required] — NOT FOUND\n" "$GLYPH_FAIL" "$tool"
+        _c "$COLOR_RESET"
+      else
+        _c "$COLOR_YELLOW"
+        printf "  - %s [optional] — not installed\n" "$tool"
+        _c "$COLOR_RESET"
+      fi
+    fi
+  done
+  echo
+}
+
+# Entry: dispatch on the first POSITIONAL.
+sama_main() {
+  parse_flags "$@"
+  if [ "${#POSITIONAL[@]}" -eq 0 ]; then
+    print_usage
+    exit 0
+  fi
+  local subcmd="${POSITIONAL[0]}"
+  case "$subcmd" in
+    check)   cmd_check ;;
+    graph)   cmd_graph ;;
+    doctor)  cmd_doctor ;;
+    help)    print_usage ;;
+    *)       echo "unknown command: $subcmd" >&2; print_usage >&2; exit 2 ;;
+  esac
+}