@abide/abide 0.123.1 → 0.123.3

package/src/shared/reactive/Reactive.ts

@@ -22,13 +22,18 @@ import { CELL } from './CELL.ts'
 import { CAUGHT_UP, Cursor, hasCursorBehind, keepPlaces } from './Cursor.ts'
 import { ENTRY_LIVES } from './ENTRY_LIVES.ts'
 import { armTimer, type Expiry, expiryFor } from './Expiry.ts'
-import { FOLLOWED } from './FOLLOWED.ts'
 import { isReactive } from './isReactive.ts'
 import { isThenable } from './isThenable.ts'
 import { MUTATION } from './MUTATION.ts'
 import { NO_INITIAL } from './NO_INITIAL.ts'
 import { NotLanded } from './NotLanded.ts'
-import { PATCH_SINKS, type PatchOp } from './PATCH_SINKS.ts'
+import {
+    holdLog,
+    logOf,
+    PatchLog,
+    type PatchOp,
+    sendInvalidate,
+} from './patchLog.ts'
 import { REACTIVE_BRAND } from './REACTIVE_BRAND.ts'
 import { recordWrites } from './recordWrites.ts'
 import { currentScope, runInScope, type Scope } from './scoping.ts'
@@ -3522,7 +3527,7 @@ function patchCell(cell: Cell, mutate: (value: unknown) => void): void {
         // served: patching the served one overwrote the held production with it, and the write
         // the window held was never seen.
         const head = cap?.holding && cell.body === null ? cap.held : cell.value
-        recordWrites(head, mutate, PATCH_SINKS.get(cell))
+        recordWrites(head, mutate, logOf(cell))
         // 5.7: REPLACES THE HEAD PRODUCTION RATHER THAN APPENDING ONE, so the ordinal does not
         // move: the follow's version tells a patch from a production by exactly that, and sends a
         // patch as its writes (18.11). A cursor reads the change off the object's patch epoch
@@ -3542,10 +3547,8 @@ function patchCell(cell: Cell, mutate: (value: unknown) => void): void {
     const before = stream.chunks.length
     // A CURSOR BEHIND needs where the patch wrote, which its ops say: the follow's own sink, or one
     // of this patch's alone where nothing follows the value.
-    const followed = PATCH_SINKS.get(cell)
     const sink =
-        followed ??
-        (hasCursorBehind(cell) ? { ops: [], lost: false } : undefined)
+        logOf(cell) ?? (hasCursorBehind(cell) ? new PatchLog() : undefined)
     const from = sink === undefined ? 0 : sink.ops.length
     recordWrites(stream.chunks, mutate, sink)
     // 5.7 AS THE VALUE BRANCH KEEPS IT: a patch mints no ordinal, so an accumulation it grew or
@@ -3681,8 +3684,7 @@ function reloadOwed(cell: Cell): void {
  */
 function invalidateOne(cell: Cell): void {
     // 7.6 — sent on to the browsers following it whether or not there is a producer to mark.
-    const followed = FOLLOWED.get(cell)
-    if (followed !== undefined) for (const sendOn of followed) sendOn()
+    sendInvalidate(cell)
     if (!reloads(cell)) return
     // Not directly servable, so the next read goes a frame in and settles the debt.
     cell.direct = false
@@ -4493,6 +4495,17 @@ export function servedCellOf(value: unknown): { readonly ordinal: number } {
     return adoptedCellOf(value)
 }
 
+/**
+ * Holds a patch log on the cell `value` serves from, with `invalidated` called on its every
+ * invalidate; returns what releases both. 18.11, 7.10.
+ */
+export function followServed(
+    value: unknown,
+    invalidated: () => void,
+): () => void {
+    return holdLog(adoptedCellOf(value), invalidated)
+}
+
 /**
  * When the production `value` serves stops being servable, as a wall-clock time.
  *

package/src/shared/reactive/argsContract.ts

@@ -1,7 +1,9 @@
 // WHAT A KEYED VALUE'S ARGS ARE HELD TO, past the face an app is handed: the `args` schema it was
-// declared with (19.7) and the defaults its body's parameter writes (11.29). A `Keyed` is where the
-// contract starts; a server's forwarder and an `Rpc` are faces built over one, and each carries it
-// through `contractOf` so a transport reads it off whichever face it was handed.
+// declared with (19.7), the defaults its body's parameter writes (11.29), and — on a server's `Rpc`
+// — the schema its annotation derives (19.9). A `Keyed` is where the contract starts; a server's
+// forwarder and an `Rpc` are faces built over one, and each carries it through `contractOf` so a
+// transport reads it off whichever face it was handed. What a server adds before a call off the wire
+// reaches here — its text coerced, its path's parameters laid in — is `#server/argsContract.ts`.
 //
 // DEFAULTS BEFORE THE KEY, IN ONE PLACE. 11.27: a call that left a member to the parameter and one
 // that wrote it are one entry, so every reach, call and lookup takes the key through `normalized`
@@ -10,9 +12,11 @@
 //
 // Imports no part of the core, so `scoped.ts` can carry the contract without reaching `Keyed.ts`.
 
+import { DERIVED_ARGS } from '../DERIVED_ARGS.ts'
+import type { Issues } from '../Issues.ts'
 import { putOwn } from '../putOwn.ts'
+import { validationError } from '../refuse.ts'
 import type { Schema } from '../Schema.ts'
-import { canonicalKey } from './canonicalKey.ts'
 import type { Defaults } from './parameterDefaults.ts'
 
 export const ARGS_GATE: unique symbol = Symbol.for('abide.argsGate')
@@ -62,6 +66,35 @@ export function normalized<Args>(
     return defaults === null ? args : withDefaults(args, defaults)
 }
 
+/**
+ * 19.9 — the issues an `Rpc`'s args leave against the schema its annotation derives, `null` where
+ * they hold: `undefined` until the module its handler is loaded through stamps it (`derivedArgs`),
+ * and so in a browser always. A function rather than the schema, so this seam never carries the
+ * validator (19.13).
+ */
+export type HeldToAnnotation = {
+    [DERIVED_ARGS]: ((args: unknown) => Issues<unknown> | null) | undefined
+}
+
+/**
+ * The args a call of `face` is made with: `normalized`, then held to the schema its annotation
+ * derives. Throws the `ValidationError` where they do not hold.
+ *
+ * 15.8, 19.9 — ONE STEP FOR EVERY WAY A HANDLER IS CALLED, in process and over the wire alike: a
+ * type an in-process caller wrote holds nothing at run time (`as never`, a value off JSON), so it is
+ * refused as the wire refuses it rather than handed to the body. 11.27 — the defaults first, so the
+ * check reads what the handler will.
+ */
+export function acceptedArgs(
+    face: Pick<Gated<unknown>, typeof PARAMETER_DEFAULTS> & HeldToAnnotation,
+    given: unknown,
+): unknown {
+    const args = normalized(face, given)
+    const issues = face[DERIVED_ARGS]?.(args) ?? null
+    if (issues !== null) throw validationError(issues)
+    return args
+}
+
 /** The entry key a call with `args` is filed under: `normalized`, then 11.24's canonical form. */
 export function keyOf(
     face: Pick<Gated<unknown>, typeof PARAMETER_DEFAULTS>,
@@ -95,3 +128,97 @@ function withDefaults<Args>(args: Args, defaults: Defaults): Args {
     }
     return (filled ?? given) as Args
 }
+
+/**
+ * The entry key for an `Args` value: its canonical wire form, as a string.
+ *
+ * RULEBOOK 11.24: members sorted by name, `undefined` members dropped, `Date` written ISO.
+ *
+ * 11.26: the key is taken BEFORE any gate runs, because a browser holds no copy of the gate — a
+ * key taken after normalizing is computed one way on a server and another in a browser, and every
+ * handler with a normalizing schema would miss its seed buffer and re-issue the call on hydration.
+ *
+ * 11.64: WHAT THE WIRE FORM CANNOT WRITE IS REFUSED AT THE REACH. `JSON.stringify` does not fail
+ * on any of it — a `Set`, a `Map` and a class instance each have no own enumerable keys and
+ * canonicalize to `{}`, and a non-finite number is written `null` — so two different reaches
+ * produced one key and 1.8 joined the second to the first's standing work. The value was right
+ * for the first caller and wrong for every other one, with nothing to see.
+ */
+export function canonicalKey(args: unknown): string {
+    if (args === undefined) return ''
+    return JSON.stringify(canonical(args, []))
+}
+
+// THE PATH IS A STACK OF STEPS, joined only when a refusal names it. Built as a string per member
+// it was a concatenation for every element and every nested key on every reach, for a message the
+// success path never reads.
+type Steps = (string | number)[]
+
+function canonical(value: unknown, path: Steps): unknown {
+    if (value === null) return value
+    const kind = typeof value
+    if (kind === 'number') {
+        if (!Number.isFinite(value)) throw outside(String(value), path)
+        return value
+    }
+    if (kind !== 'object') {
+        if (kind === 'boolean' || kind === 'string') return value
+        // `undefined` reaches here from an ARRAY element alone — a member is dropped above.
+        throw outside(kind === 'undefined' ? 'undefined' : `a ${kind}`, path)
+    }
+    if (value instanceof Date) return value.toISOString()
+    if (Array.isArray(value)) {
+        const out: unknown[] = []
+        for (let index = 0; index < value.length; index += 1) {
+            path.push(index)
+            out.push(canonical(value[index], path))
+            path.pop()
+        }
+        return out
+    }
+    const prototype = Object.getPrototypeOf(value)
+    if (prototype !== Object.prototype && prototype !== null)
+        throw outside(named(value as object), path)
+    const source = value as Record<string, unknown>
+    const keys = Object.keys(source).sort()
+    // AN ORDINARY OBJECT, AND `putOwn` FOR THE ONE KEY THAT NEEDS IT: `__proto__` is a SETTER on
+    // `Object.prototype`, so `out[key] = …` for that key creates no own property and
+    // `JSON.stringify` never sees it — `{id: 1, __proto__: {role: 'admin'}}` and `{id: 1}` then
+    // canonicalize to one string, and 1.8 joins the second reach to the first's standing work.
+    // `Object.create(null)` closed that too, and V8 builds it in DICTIONARY mode: the shipped key
+    // took 49-56% of the time without it there, and a standing keyed reach 53%, where JSC reads
+    // level to 110% (`abide/bench/sharedCases.ts`, two runs per engine).
+    const out: Record<string, unknown> = {}
+    for (let index = 0; index < keys.length; index += 1) {
+        const key = keys[index] as string
+        const member = source[key]
+        if (member === undefined) continue
+        path.push(key)
+        putOwn(out, key, canonical(member, path))
+        path.pop()
+    }
+    return out
+}
+
+function named(value: object): string {
+    const from = value.constructor as { name?: unknown } | undefined
+    return typeof from?.name === 'string' && from.name !== ''
+        ? `a ${from.name}`
+        : 'a class instance'
+}
+
+function outside(what: string, steps: Steps): Error {
+    let path = ''
+    for (const step of steps)
+        path +=
+            typeof step === 'number'
+                ? `[${step}]`
+                : path === ''
+                  ? step
+                  : `.${step}`
+    return new Error(
+        `An Args key cannot carry ${what} at ${
+            path === '' ? 'the arguments themselves' : `"${path}"`
+        }: the canonical wire form writes it as another entry's key (RULEBOOK 11.64).`,
+    )
+}

package/src/shared/reactive/index.ts

@@ -47,6 +47,7 @@ export {
     deadlineOf,
     failedTransiently,
     flushSync,
+    followServed,
     heldGenerationOf,
     type Identity,
     isStreaming,

package/src/shared/reactive/patchLog.ts

@@ -0,0 +1,79 @@
+// 18.11 — WHAT A PATCH WROTE, KEPT AS DATA for a value the server follows over the mux, by the cell
+// it was written to. Only a followed value has a log, so every other patch records nothing but its
+// marks (32.33). And 7.10 — what an invalidate of that value sends on: the core calls the log's
+// followers for every cell it invalidates, however the trigger was spelled, so every other
+// invalidate is one miss.
+//
+// HELD WHILE ANYONE IS FED THE VALUE, and gone with the last: a log nobody drains grows with every
+// patch.
+
+/**
+ * One JSON Patch operation (RFC 6902), its `path` and `from` JSON Pointers (RFC 6901).
+ *
+ * A patch abide records is `add`, `remove` and `replace` alone; `move`, `copy` and `test` are
+ * applied where a client sends them.
+ */
+export type PatchOp =
+    | { op: 'add'; path: string; value: unknown }
+    | { op: 'remove'; path: string }
+    | { op: 'replace'; path: string; value: unknown }
+    | { op: 'move'; from: string; path: string }
+    | { op: 'copy'; from: string; path: string }
+    | { op: 'test'; path: string; value: unknown }
+
+/**
+ * The writes patches made, as `recordWrites` keeps them. `lost` where one could not be kept as data,
+ * and then the change is sent as the value (18.13). `followers` stays empty on a log one patch keeps
+ * for itself rather than one the server holds.
+ */
+export class PatchLog {
+    ops: PatchOp[] = []
+    lost = false
+    readonly followers = new Set<() => void>()
+}
+
+const LOGS = new WeakMap<object, PatchLog>()
+
+/** The log held on `cell`, or `undefined` where nothing follows it. */
+export function logOf(cell: object): PatchLog | undefined {
+    return LOGS.get(cell)
+}
+
+/**
+ * Holds a log on `cell`, with `invalidated` called on its every invalidate; returns what releases
+ * both.
+ */
+export function holdLog(cell: object, invalidated: () => void): () => void {
+    let log = LOGS.get(cell)
+    if (log === undefined) {
+        log = new PatchLog()
+        LOGS.set(cell, log)
+    }
+    const held = log
+    const followers = held.followers
+    followers.add(invalidated)
+    // A release run twice, after another follower opened a fresh log, leaves that log standing.
+    return () => {
+        followers.delete(invalidated)
+        if (followers.size === 0 && LOGS.get(cell) === held) LOGS.delete(cell)
+    }
+}
+
+/**
+ * The writes kept on `cell` since the last drain, or `null` where there are none or one was lost —
+ * and the log starts over either way.
+ */
+export function drainLog(cell: object): PatchOp[] | null {
+    const log = LOGS.get(cell)
+    if (log === undefined) return null
+    const ops = log.lost || log.ops.length === 0 ? null : log.ops
+    log.ops = []
+    log.lost = false
+    return ops
+}
+
+/** Calls every follower of `cell`'s log: an invalidate reached it. 7.6. */
+export function sendInvalidate(cell: object): void {
+    const log = LOGS.get(cell)
+    if (log !== undefined) for (const sendOn of log.followers) sendOn()
+}

package/src/shared/reactive/patchMarks.ts

@@ -0,0 +1,34 @@
+// 32.33 — WHICH OBJECTS AN `s.patch` WROTE TO, AND WHEN. The epoch moves once per patch and each
+// object written holds the epoch it was last written at, so a row that took its item at epoch `e` is
+// stale exactly where its item was written since `e`. No imports, because `reconcile` and the
+// socket wire read it on the client and must not drag the core into the runtime chunk with it.
+
+let epoch = 0
+const WRITTEN = new WeakMap<object, number>()
+
+/** The epoch the last patch wrote at, 0 before any. */
+export function patchEpoch(): number {
+    return epoch
+}
+
+/** Opens a patch: moves the epoch, and returns the one its writes are marked at. */
+export function openPatch(): number {
+    epoch += 1
+    return epoch
+}
+
+/** Marks `written` as written by the patch at `at`. */
+export function markWritten(written: object, at: number): void {
+    WRITTEN.set(written, at)
+}
+
+/** The epoch a patch last wrote to `value` at, 0 where none has or it is not an object. */
+export function writtenAt(value: unknown): number {
+    if (value === null || typeof value !== 'object') return 0
+    return WRITTEN.get(value) ?? 0
+}
+
+/** Whether a patch wrote to `value` after epoch `since`. */
+export function writtenSince(value: unknown, since: number): boolean {
+    return writtenAt(value) > since
+}

package/src/shared/reactive/recordWrites.ts

@@ -22,8 +22,8 @@
 // holds it directly: `list.push(row); row.name = x`. So a placed object is SENT AS IT STANDS WHEN THE
 // CALLBACK RETURNS — every op's value is copied then rather than at its write — and a write made
 // under one is not kept, since that copy already carries it.
-import type { PatchOp } from './PATCH_SINKS.ts'
-import { PATCHES } from './PATCHES.ts'
+import type { PatchLog, PatchOp } from './patchLog.ts'
+import { markWritten, openPatch } from './patchMarks.ts'
 import { RESHAPING } from './RESHAPING.ts'
 
 // The reshaping methods JSON Patch has no op for: the array they leave is sent whole instead.
@@ -39,7 +39,7 @@ const REORDERING: ReadonlySet<string> = new Set([
 const TARGET = Symbol('target')
 
 /**
- * Runs `mutate` over a proxy of `root`, marking every object it writes to in `PATCHES`.
+ * Runs `mutate` over a proxy of `root`, marking every object it writes to (`patchMarks.ts`).
  *
  * Where a `sink` is handed in, each write is also kept there as a `PatchOp`, or the sink is marked
  * `lost` where it cannot be. A `root` that is not an array or a plain object is handed over as is.
@@ -47,7 +47,7 @@ const TARGET = Symbol('target')
 export function recordWrites<Value>(
     root: Value,
     mutate: (value: Value) => void,
-    sink?: { ops: PatchOp[]; lost: boolean },
+    sink?: PatchLog,
 ): void {
     if (!isWrappable(root)) {
         // A root no proxy can stand in for is written as a whole: what the callback reads out of it
@@ -56,14 +56,12 @@ export function recordWrites<Value>(
             mutate(root)
             return
         }
-        PATCHES.epoch += 1
-        PATCHES.written.set(root, PATCHES.epoch)
-        mutate(heldView(root, PATCHES.epoch) as Value)
+        const epoch = openPatch()
+        markWritten(root, epoch)
+        mutate(heldView(root, epoch) as Value)
         return
     }
-    PATCHES.epoch += 1
-    const epoch = PATCHES.epoch
-    const written = PATCHES.written
+    const epoch = openPatch()
     // EVERY OBJECT THE PATCH REACHED, by what it is: the one proxy it is handed out as, so
     // `list[0] === list[0]` inside the callback, and its parent. ONE ENTRY rather than a map for each,
     // because a row read is the loop this runs per row and each map is a lookup and an insert there.
@@ -83,7 +81,7 @@ export function recordWrites<Value>(
         const entry = reached.get(held) as Reached
         if (entry.marked) return
         entry.marked = true
-        written.set(held, epoch)
+        markWritten(held, epoch)
         const above = entry.parent
         if (above instanceof Parents) for (const one of above.all) mark(one)
         else mark(above)
@@ -428,7 +426,7 @@ class Reached {
     proxy: object | null
     parent: object | Parents | null
     /**
-     * Written in this patch, directly or below — `PATCHES.written` holds this patch's epoch for it.
+     * Written in this patch, directly or below — its mark is this patch's epoch.
      */
     marked: boolean
     /** What one no proxy can stand in for is handed out as: `heldView` of it. */
@@ -556,8 +554,7 @@ function* markedEach(
 }
 
 function markedOut<Value>(value: Value, epoch: number): Value {
-    if (typeof value === 'object' && value !== null)
-        PATCHES.written.set(value, epoch)
+    if (typeof value === 'object' && value !== null) markWritten(value, epoch)
     return value
 }
 

package/src/shared/reactive/share.ts

@@ -64,14 +64,15 @@ export function share<Key extends string, Value>(
  * Opens a share scope around an emitted component's body, and returns the previous one.
  *
  * The PREVIOUS scope comes back rather than the new one: restoring is the whole of the close
- * (`leaveShare`), and a component that threw still has to restore it.
+ * (`leaveShare`), and a component that threw still has to restore it. `level` is handed in by a
+ * routed level opening its own scope (39.1); every other scope carries its parent's down.
  */
-export function enterShare(): ShareScope | null {
+export function enterShare(level?: unknown): ShareScope | null {
     const previous = CURRENT
     CURRENT = {
         parent: previous,
         values: new Map(),
-        level: previous === null ? undefined : previous.level,
+        level: level ?? previous?.level,
     }
     return previous
 }

package/src/shared/rpc.ts

@@ -14,7 +14,7 @@
 // handler's own.
 
 import { DERIVED_ARGS } from './DERIVED_ARGS.ts'
-import { type Failed, isFailedNamed } from './Failed.ts'
+import { type Failed, isFailed, isFailedNamed } from './Failed.ts'
 import { GLOBAL_GETS } from './GLOBAL_GETS.ts'
 import { HandlerRoute } from './HandlerRoute.ts'
 import { IN_PROCESS_ORIGIN } from './IN_PROCESS_ORIGIN.ts'
@@ -23,11 +23,12 @@ import { compose, type Rung } from './Middleware.ts'
 import { outbox, type QueuedCall, sendingFor } from './outbox.ts'
 import { principalRotated } from './principalRotated.ts'
 import {
+    acceptedArgs,
     contractOf,
     type Gated,
     gateOf,
+    type HeldToAnnotation,
     keyOf,
-    normalized,
 } from './reactive/argsContract.ts'
 import { callLoad } from './reactive/callLoad.ts'
 import {
@@ -52,7 +53,7 @@ import { MUTATION } from './reactive/MUTATION.ts'
 import { dropAnswered } from './reactive/Reactive.ts'
 import { builtHere, isForwarder } from './reactive/scoped.ts'
 import { SELECTION_MEMBERS } from './reactive/SELECTION_MEMBERS.ts'
-import { checkArgs, validationError } from './refuse.ts'
+import { checkArgs } from './refuse.ts'
 import { RPC_SERVER } from './RPC_SERVER.ts'
 import { rpcRequest } from './rpcRequest.ts'
 import type { Schema } from './Schema.ts'
@@ -162,16 +163,6 @@ type Derived<Member, Whole = Member> = Member extends
           : never
       : never
 
-/**
- * 19.9 — the issues an `Rpc`'s args leave against the schema its annotation derives, `null` where
- * they hold: `undefined` until the module its handler is loaded through stamps it (`derivedArgs`),
- * and so in a browser always. A function rather than the schema, so this seam never carries the
- * validator (19.13).
- */
-export type HeldToAnnotation = {
-    [DERIVED_ARGS]: ((args: unknown) => Issues<unknown> | null) | undefined
-}
-
 /** Which generated surfaces carry a handler (20.1). */
 export type Clients = {
     ui?: boolean
@@ -453,12 +444,14 @@ export function declare(method: Method): Declare {
             return route
         }
         const call = (given?: unknown, options?: CallOptions): unknown => {
-            const args = normalized(contract, given)
-            // 15.8, 19.9 — AND HELD TO ITS ANNOTATION, where the build derived a schema off it: a
-            // type an in-process caller wrote holds nothing at run time (`as never`, a value off
-            // JSON), so the call is refused as the wire refuses it rather than handed to the body.
-            const issues = rpc[DERIVED_ARGS]?.(args) ?? null
-            if (issues !== null) return reactive(() => validationError(issues))
+            // 15.8, 19.9 — the args every way of calling the handler is held to.
+            let args: unknown
+            try {
+                args = acceptedArgs(rpc, given)
+            } catch (refused) {
+                if (!isFailed(refused)) throw refused
+                return reactive(() => refused)
+            }
             const route =
                 rpc.address === undefined ? undefined : routeAt(rpc.address)
             if (route?.segments !== undefined) {

package/src/shared/validateJson.ts

@@ -486,6 +486,17 @@ function checkArray(
         check(items, value[index], join(path, String(index)), found)
 }
 
+/**
+ * Whether `value` carries `key` as JSON would: an own member, and not one left `undefined`.
+ *
+ * 19.25 — `undefined` IS NOT A JSON VALUE, so a member holding it is the member the wire leaves out:
+ * JSON drops it and a URL omits it (30.28). Read as present, `note?: string` refused a call in process
+ * passing `note: undefined` at 422 that the same call over the wire was answered for.
+ */
+function holds(value: Record<string, unknown>, key: string): boolean {
+    return value[key] !== undefined && Object.hasOwn(value, key)
+}
+
 function checkObject(
     node: Node,
     value: Record<string, unknown>,
@@ -504,7 +515,7 @@ function checkObject(
             // `required: ['toString']` was satisfied by `{}`, and — the one that matters —
             // `'__proto__' in declared` answered true, so `additionalProperties: false` accepted
             // `{"__proto__": …}` as a declared member and handed the object on unchecked.
-            if (!Object.hasOwn(value, key))
+            if (!holds(value, key))
                 noteOr(found, join(path, key), 'is required')
         }
     }
@@ -515,7 +526,7 @@ function checkObject(
             if (!Object.hasOwn(declared, key)) continue
             // An absent member is `required`'s business, not its schema's — checking it
             // here would report every optional member as the wrong type.
-            if (!Object.hasOwn(value, key)) continue
+            if (!holds(value, key)) continue
             check(
                 declared[key] as JsonValue,
                 value[key],
@@ -527,7 +538,7 @@ function checkObject(
     const extra = node.additionalProperties
     if (extra === undefined) return
     for (const key in value) {
-        if (!Object.hasOwn(value, key)) continue
+        if (!holds(value, key)) continue
         if (declared !== null && Object.hasOwn(declared, key)) continue
         if (extra === false) {
             noteOr(found, join(path, key), 'is not a known member')

package/src/ui/ArmRegion.ts

@@ -88,10 +88,7 @@ export class ArmRegion {
 
     swap(next: unknown): void {
         const region = this.region
-        const filling =
-            this.at !== undefined ||
-            isEmptyRegion(region) ||
-            this.paintedOther(next)
+        const filling = this.fills(next)
         const arm = this.armOf(next)
         const scope = this.scope
         if (filling) {
@@ -102,6 +99,15 @@ export class ArmRegion {
         this.at = next
     }
 
+    /** Whether swapping in `next` fills the region rather than hydrating what the server painted. */
+    fills(next: unknown): boolean {
+        return (
+            this.at !== undefined ||
+            isEmptyRegion(this.region) ||
+            this.paintedOther(next)
+        )
+    }
+
     armOf(next: unknown): Arm {
         return (this.arms[next as number] as ArmMakers[number])(undefined)
     }

package/src/ui/Level.ts

@@ -1,7 +1,7 @@
 import {
     currentShare,
+    enterShare,
     leaveShare,
-    resumeShare,
     type ShareScope,
 } from '#shared/reactive/share.ts'
 import { untracked } from '#shared/reactive/tracking.ts'
@@ -14,18 +14,14 @@ import type { Scope } from './Scope.ts'
 /**
  * ONE LEVEL OF A ROUTED CHAIN — a layout or the page — and the head it contributes (39.1, 39.14).
  *
- * 41.11 — the router holds these rather than letting each level own the one below it, which is
- * what makes a shared layout something it can KEEP: a scope stopped from above takes its children
- * with it, and a layout that survives a navigation must not take the page it was holding a moment
- * ago. The module standing here is the router's `chain` at the same index.
+ * 41.11 — a `LevelChain` holds these rather than letting each level own the one below it.
  *
  * ON EVERY PAGE'S STATIC CLOSURE, because `contributeHead` is on the runtime barrel — so it knows
- * nothing of the router, and the router knows it only through `levels`.
+ * the chain it stands in only as what reconciles the head, and nothing of the router.
  */
 export class Level {
-    /** The chain this level stands in, and where: a live head yields to every level below it. */
-    levels: Level[]
-    at: number
+    /** The chain this level stands in: a live head yields to every level below it. */
+    chain: { reconcile(): void }
     scope: Scope | undefined = undefined
     /**
      * Where this level's `<slot/>` is, learned when the level below it mounted there, and
@@ -64,9 +60,8 @@ export class Level {
      */
     contributed = new Set<HeadContribution>()
 
-    constructor(levels: Level[], at: number) {
-        this.levels = levels
-        this.at = at
+    constructor(chain: { reconcile(): void }) {
+        this.chain = chain
     }
 
     /** Left by the level's mount (`emitClient`), painted or not. */
@@ -85,7 +80,7 @@ export class Level {
 
     /** Reconciles the document head from the chain this level stands in (`reconcileHead`). */
     reconcile(): void {
-        Level.reconcile(this.levels)
+        this.chain.reconcile()
     }
 
     /**
@@ -94,11 +89,11 @@ export class Level {
      * a head read here is followed by its own watch, not by whatever wrote.
      */
     static reconcile(levels: Level[]): void {
-        reconcileHead(untracked(Level.chain, levels, undefined))
+        reconcileHead(untracked(Level.contributors, levels, undefined))
     }
 
     /** Every contributor in `levels` and the head it reads now, outermost first. */
-    static chain(
+    static contributors(
         levels: Level[],
         _?: undefined,
     ): [who: object, text: string][] {
@@ -146,11 +141,7 @@ export class Level {
     mount<Result>(run: () => Result): Result {
         // 39.1 — THE LEVEL RIDES THE SHARE SCOPE, so a component finds it as it finds a shared key,
         // whether it mounts now or in an arm or a row after (`contributeHead`).
-        const back = resumeShare({
-            parent: currentShare(),
-            values: new Map(),
-            level: this,
-        })
+        const back = enterShare(this)
         this.unapplied = false
         let unapplied: boolean
         let result: Result