diff --git a/nulib/lib_provisioning/utils/mod.nu b/nulib/lib_provisioning/utils/mod.nu
index 2c51258..e3b9e8f 100644
--- a/nulib/lib_provisioning/utils/mod.nu
+++ b/nulib/lib_provisioning/utils/mod.nu
@@ -1,24 +1,46 @@
+# utils/ subsystem facade — selective re-exports (ADR-025 Phase 3 Layer 3).
+# Each `export use X *` replaced by an explicit symbol list so transitivity
+# checks can verify what propagates through consumers of `use lib_provisioning/utils *`.
 
-#  Exclude minor or specific parts for global 'export use'
-export use interface.nu *
-export use clean.nu *
-export use error.nu *
-export use help.nu *
-export use init.nu *
-
-export use generate.nu *
-export use undefined.nu *
-export use logging.nu *
-
- export use qr.nu *
- export use ssh.nu *
-
- export use settings.nu *
- export use templates.nu *
-# export use test.nu
-
- export use format.nu *
- export use files.nu *
-
-export use on_select.nu *
-export use imports.nu *
+export use interface.nu [
+    _ansi _print desktop_run_notify detect_claude_code end_run format_out
+    get-notify-icon get-provisioning-no-terminal get-provisioning-out log_debug
+    set-provisioning-no-terminal set-provisioning-out show_clip_to
+]
+export use clean.nu [cleanup]
+export use error.nu [safe-execute throw-error]
+export use help.nu [parse_help_command]
+export use init.nu [
+    detect-infra-from-pwd get-effective-workspace get-provisioning-args
+    get-provisioning-infra-path get-provisioning-name get-provisioning-resources
+    get-provisioning-url get-provisioning-use-sops get-work-format
+    get-workspace-path provisioning_init show_titles use_titles
+]
+export use generate.nu [
+    generate_data_def generate_data_items generate_title github_latest_tag
+    value_input value_input_list
+]
+export use undefined.nu [invalid_task option_undefined]
+export use logging.nu [
+    is-debug-check-enabled is-debug-enabled is-metadata-enabled
+    log-debug log-error log-info log-progress log-section log-step
+    log-subsection log-success log-warning set-debug-enabled set-metadata-enabled
+]
+export use qr.nu [make_qr]
+export use ssh.nu [check_connection scp_from scp_to ssh_cmd ssh_cp_run]
+export use settings.nu [
+    check_env find_get_settings get_context_infra_path get_file_format
+    get_infra get_provider_data_path get_provider_env load load_defaults
+    load_from_wk_format load_provider_env load_provider_settings load_settings
+    parse_nickel_file save_provider_env save_servers_settings save_settings_file
+    set-wk-cnprov settings_with_env
+]
+export use templates.nu [on_template_path run_from_template]
+export use format.nu [datalist_to_format money_conversion]
+export use files.nu [copy_file copy_prov_files find_file select_file_list]
+export use on_select.nu [run_on_selection]
+export use imports.nu [
+    aws-env aws-servers core-clusters core-servers core-taskservs
+    import-path lib-ai lib-secrets lib-sops lib-utils local-env local-servers
+    prov-env-middleware prov-middleware upcloud-env upcloud-servers
+]