@almadar/std 17.0.1 → 17.0.3

package/behaviors/lolo/cli/atoms/std-orb-lint-trait-ref-config.lolo

@@ -2,7 +2,7 @@ app std-orb-lint-trait-ref-config [
   version: "1.0.0",
   inbound: ["cli-lint-trait-ref-config"],
   env: ["PATH"],
-  exec: ["orb"],
+  exec: [exe],
   fs: { cwd: "**": [read], "/**": [read], "~/.orb/node_modules/**": [read] },
   description: "std-orb-lint-trait-ref-config — the `orb lint trait-ref-config <file>` command, the port of validate_trait_ref_config_diagnostics and its collection in phases/inline/trait.rs. For each trait entry that references an imported trait (`Alias.traits.Name`) it pairs the unresolved call site with the upstream trait (std-orb-lint-call-site-input: found by the entry's refId when it carries one and the import holds that id, else by name; read as the compiler's deferred import load sees it when the upstream file declares the trait inline, else from the resolved import) and reports ORB_T_CONFIG_UNKNOWN_CALL_SITE_KEY (a call-site config key that is neither a declared knob of the upstream trait nor a declaration-form knob of the alias), ORB_T_CONFIG_MISSING_REQUIRED_KEY (a `!`-required declared knob the call site omits) and ORB_T_EVENT_RENAME_UNKNOWN_KEY (an `events` rename source naming no event the upstream trait declares, emits, transitions on, or produces: the events std-orb-fired-events finds fired by its effects and controls), at `orbitals[name=<orbital>].traits[<index>]` with the compiler's paths, messages and valid values (status 500, exit 1). The pattern registry and the operator table are read once, by std-orb-lint-input, and only when a rename names an event the declaration alone does not. Clean answers `lint trait-ref-config: clean` (status 200, exit 0). Anything but one file argument is the usage (status 400, exit 2); an unreadable or unlowerable file is status 500. A call site whose import does not resolve is skipped: the compiler reports that failure itself. A trait entry of an orbital that references a trait declared inline in the same file (by `ref` last segment, else `name`; same-named traits of several orbitals are merged) and carries an `events` rename is also checked: ORB_T_EVENT_RENAME_UNKNOWN_KEY at `orbitals[i (Orbital)].traits[j (label)]` with the rename-map wording of validate_event_renames (the port of that second Rust emitter); an unknown target trait is skipped, and an `@config.K` emit resolves to the trait's own string default."
 ]

package/behaviors/lolo/cli/atoms/std-orb-lint-trait-refs.lolo

@@ -2,7 +2,7 @@ app std-orb-lint-trait-refs [
   version: "1.0.0",
   inbound: ["cli-lint-trait-refs"],
   env: ["PATH"],
-  exec: ["orb"],
+  exec: [exe],
   fs: { cwd: "**": [read], "/**": [read], "~/.orb/node_modules/**": [read] },
   description: "std-orb-lint-trait-refs - the `orb lint trait-refs <file>` command, the port of the trait reference, rebind and uniqueness checks of traits/trait_validator.rs. A trait entry of an orbital without a state machine is a reference: with neither `ref` nor `name` it is ORB_T_INVALID_FORMAT, naming a trait no orbital defines inline (and not a `std/` trait) it is ORB_T_UNDEFINED_TRAIT, and a `linkedEntity` no orbital declares (primary, auxiliary or expected entity) is ORB_E_INVALID_RELATION. An inline trait with an empty name is ORB_T_UNDEFINED_TRAIT at `.name` and an undeclared `linkedEntity` ORB_E_INVALID_RELATION. An inline trait imported from an atom (`sourceBehavior`) and rebound to an entity other than the atom's own is ORB_T_REBIND_TARGET_UNRESOLVED when the target names no entity of the program, else ORB_T_ENTITY_NOT_REBINDABLE when the atom's binding is not `@rebindable`, else ORB_T_REBIND_MISSING_FIELDS for the contract `requires` fields the target entity lacks. A trait name defined by more than one inline trait of the program is ORB_T_DUPLICATE_NAME at `orbitals`, once per name. Each finding carries the Rust path, message and suggestion (status 500, exit 1). Clean answers `lint trait-refs: clean` (status 200, exit 0). Anything but one file argument is the usage (status 400, exit 2); an unreadable or unlowerable file is status 500."
 ]

package/behaviors/lolo/cli/atoms/std-orb-lint-transition-refs.lolo

@@ -2,7 +2,7 @@ app std-orb-lint-transition-refs [
   version: "1.0.0",
   inbound: ["cli-lint-transition-refs"],
   env: ["PATH"],
-  exec: ["orb"],
+  exec: [exe],
   fs: { cwd: "**": [read], "/**": [read], "~/.orb/node_modules/**": [read] },
   description: "std-orb-lint-transition-refs — the `orb lint transition-refs <file>` command, the port of ORB_T_INVALID_TRANSITION and ORB_T_UNDEFINED_EVENT (trait_validator.rs validate_transitions). It lowers the file with program/read and, for every inline trait with at least one state, reports per transition a source state that is not declared (`*` allowed; list sources checked one by one), a target state that is not declared, and, when the trait declares events, an event other than INIT that is not among them, each with the Rust path and message (the Rust valid-values list is not printed). Status 500, exit 1. Clean answers `lint transition-refs: clean` (status 200, exit 0). Anything but one file argument is the usage (status 400, exit 2); an unreadable or unlowerable file is status 500."
 ]

package/behaviors/lolo/cli/atoms/std-orb-lint-type-param-sweep.lolo

@@ -2,7 +2,7 @@ app std-orb-lint-type-param-sweep [
   version: "1.0.0",
   inbound: ["cli-lint-type-param-sweep"],
   env: ["PATH"],
-  exec: ["orb"],
+  exec: [exe],
   fs: { cwd: "**": [read], "/**": [read], "~/.orb/node_modules/**": [read] },
   description: "std-orb-lint-type-param-sweep — the `orb lint type-param-sweep <file>` command, the port of ORB_T_UNRESOLVED_TYPE_PARAM (type_param_sweep.rs validate_type_param_sentinels). It lowers the file with program/read and reports every type-parameter sentinel that survived resolution: a type variable left in an entity field shape, in a trait's emit or event payload field (the `$v`, `[$v]` and bare `@entity` sentinels, deferred when the linked entity is licensed by the orbital's expects), in a config knob's items or properties or in the knob's own type, and a config knob still typed with an unresolved sigil (`@user`, `@payload(..)`, `@entity(..)`, `@entity`), with the Rust path, message and suggestion (status 500, exit 1). Clean answers `lint type-param-sweep: clean` (status 200, exit 0). Anything but one file argument is the usage (status 400, exit 2); an unreadable or unlowerable file is status 500."
 ]

package/behaviors/lolo/cli/atoms/std-orb-lint-unsigned-guard.lolo

@@ -2,7 +2,7 @@ app std-orb-lint-unsigned-guard [
   version: "1.0.0",
   inbound: ["cli-lint-unsigned-guard"],
   env: ["PATH"],
-  exec: ["orb"],
+  exec: [exe],
   fs: { cwd: "**": [read], "/**": [read], "~/.orb/node_modules/**": [read] },
   description: "std-orb-lint-unsigned-guard — the `orb lint unsigned-guard <file>` command: a literal `allowUnsigned: true` on a `jws/verify` call accepts an alg:none token, so the transition holding it must be env-guarded or it is an error (ORB_EFF_UNSIGNED_NOT_ENV_GUARDED). It lowers the file with program/read and reads every inline trait's transitions. A transition is env-guarded when its event is the success answer of an `os/getenv` effect of the trait and its guard compares the answered value (`=` over a `@payload.value` read, alone or as an argument of `and`), or when its event has no listens source, at least one transition of the trait names it as a literal in its effects (an `emit`, or the answer name of a fetch, persist or os/getenv) and none of those transitions is unguarded: guard is propagated from the env-guarded answer arms along those naming edges, a transition reached by no guarded arm (a cycle with no guarded entry) is not guarded, and any transition that is not guarded and has a listens-sourced event or no naming transition taints everything it names. Only inline traits are read; an event named only by a computed expression is not tracked. Clean answers `lint unsigned-guard: clean` (status 200, exit 0). Anything but one file argument is the usage (status 400, exit 2); an unreadable or unlowerable file is status 500.",
 ]

package/behaviors/lolo/cli/atoms/std-orb-lint-untyped-array.lolo

@@ -2,7 +2,7 @@ app std-orb-lint-untyped-array [
   version: "1.0.0",
   inbound: ["cli-lint-untyped-array"],
   env: ["PATH"],
-  exec: ["orb"],
+  exec: [exe],
   fs: { cwd: "**": [read], "/**": [read], "~/.orb/node_modules/**": [read] },
   description: "std-orb-lint-untyped-array — the `orb lint untyped-array <file>` command, the port of ORB_X_UNTYPED_ARRAY (array payload fields declare an element type). It lowers the file with program/read and checks the payload fields of every trait emit and event, through nested properties at any depth with tree/fold, and the top-level fields of each non-spec orbital's primary and auxiliary entities (an array without items, reported at `.items`). Status 500, exit 1. Clean answers `lint untyped-array: clean` (status 200, exit 0). Anything but one file argument is the usage (status 400, exit 2); an unreadable or unlowerable file is status 500."
 ]

package/behaviors/lolo/cli/atoms/std-orb-lint-user-field-exists.lolo

@@ -2,7 +2,7 @@ app std-orb-lint-user-field-exists [
   version: "1.0.0",
   inbound: ["cli-lint-user-field-exists"],
   env: ["PATH"],
-  exec: ["orb"],
+  exec: [exe],
   fs: { cwd: "**": [read], "/**": [read], "~/.orb/node_modules/**": [read] },
   description: "std-orb-lint-user-field-exists - the `orb lint user-field-exists <file>` command, the port of the `@user.<field>` existence checks of user_identity.rs (check_field_exists, walked over every inline trait) and entity_access.rs (unknown_user_field, walked over the @read/@create/@update/@delete directives of every inline entity). It lowers the file with program/read and reports an `@user.<field>` (and, in an access directive, `(object/get @user <field>)`) that names no field of the identity shape the orbital resolves against: the declared [identity] entity (ORB_S_UNKNOWN_IDENTITY_FIELD), the orbital's own `expects entity [identity] { shape }` (ORB_S_EXPECTATION_FIELD_UNDECLARED), or the default shape; every shape carries the installed language's Viewer members (read from LINT_LANGUAGE_FACTS). A declared roster also re-checks the authored traits against the orbital's expects shape. Bodies inlined from a uses import (sourceBehavior) are skipped against an expectation. Findings carry the Rust path, message and suggestion (status 500, exit 1). Clean answers `lint user-field-exists: clean` (status 200, exit 0). Anything but one file argument is the usage (status 400, exit 2); an unreadable or unlowerable file is status 500."
 ]

package/behaviors/lolo/cli/atoms/std-orb-lint-user-identity.lolo

@@ -2,7 +2,7 @@ app std-orb-lint-user-identity [
   version: "1.0.0",
   inbound: ["cli-lint-user-identity"],
   env: ["PATH"],
-  exec: ["orb"],
+  exec: [exe],
   fs: { cwd: "**": [read], "/**": [read], "~/.orb/node_modules/**": [read] },
   description: "std-orb-lint-user-identity — the `orb lint user-identity <file>` command, the port of user_identity.rs (validate_user_identity). It lowers the file with program/read and reports a literal compared against a closed-vocabulary `@user.<field>` of the [identity] entity (or of the orbital's own `expects entity [identity] { shape }`) that is not a declared member, through =, ==, !=, !==, eq, neq and array/includes with a list, bare or field haystack, in every inline trait (ORB_S_ROLE_LITERAL_NOT_MEMBER, at the Rust trait path), a page nav role no role field of the [identity] entity declares (same code, at orbitals[i].pages[k].roles) (status 500, exit 1). Not ported: the `@user.<field>` existence checks (ORB_S_UNKNOWN_IDENTITY_FIELD, ORB_S_EXPECTATION_FIELD_UNDECLARED), which need the installed language's Viewer members, and the role literals of config-held role lists (check_config_role_lists), which need the compiler's role_list_sites dataflow. Clean answers `lint user-identity: clean` (status 200, exit 0). Anything but one file argument is the usage (status 400, exit 2); an unreadable or unlowerable file is status 500."
 ]

package/behaviors/lolo/cli/atoms/std-orb-lint-viewer-stranded.lolo

@@ -2,7 +2,7 @@ app std-orb-lint-viewer-stranded [
   version: "1.0.0",
   inbound: ["cli-lint-viewer-stranded"],
   env: ["PATH"],
-  exec: ["orb"],
+  exec: [exe],
   fs: { cwd: "**": [read], "/**": [read], "~/.orb/node_modules/**": [read] },
   description: "std-orb-lint-viewer-stranded - the `orb lint viewer-stranded <file>` command, the port of ORB_CIRCUIT_VIEWER_STRANDED (circuit/closed_circuit.rs validate_viewer_stranded_for_owner). For each page whose content owner std-orb-lint-page-content-owner resolves to a channel or a sole writer, an arm of the owner that is a user-triggered affordance (an event some trait of the orbital fires by a control or an effect, emits or listens for, closed over listens routes; async-result events of fetch and persist and bus-excluded events are no affordance) and repaints a main slot with a body that offers no way on is ORB_CIRCUIT_VIEWER_STRANDED. A body offers a way on when it holds a content-body pattern (a pattern with an entity-kind prop), a pattern node whose event, event-ref, event-listen, callback or event-map prop (or the eventField of an event-list item) holds a live value (a binding, or a non-empty name the bus delivers), an @trait.X embed of a trait that is not inline in the orbital or whose own main bodies offer a way on (the least fixed point over the embed graph, so a cycle earns no credit), or an @entity.f or @config.k binding with no same-arm literal source (a set before the render-ui in the same arm, through let, do and if, or a tree-shaped config default), whose literal trees are read the same way. An arm that runs its own fetch or persist, a null body, an arm that leaves for a state with another producible arm, and a second arm of an event already reported are silent. Each finding carries the Rust path, message and suggestion (status 500, exit 1). Clean answers `lint viewer-stranded: clean` (status 200, exit 0). Anything but one file argument is the usage (status 400, exit 2); an unreadable or unlowerable file is status 500."
 ]

package/behaviors/lolo/cli/atoms/std-orb-mcp-install.lolo

@@ -1,7 +1,7 @@
 app std-orb-mcp-install [
   version: "1.0.0",
   inbound: ["cli-mcp-install"],
-  exec: ["orb"],
+  exec: [exe, "orb"],
   env: ["PATH", "HOME"],
   fs: { cwd: "**": [read, write, create] },
   description: "std-orb-mcp-install — the `orb mcp install --client claude|cursor|vscode` command. It registers the `orb` MCP server in the directory the command runs in (claude: .mcp.json, cursor: .cursor/mcp.json, vscode: .vscode/mcp.json): the entry runs `npx -y @almadar/orb mcp` (the vscode entry also carries type stdio) under `mcpServers` (claude, cursor) or `servers` (vscode). Every other entry and key of an existing config is kept; a config that is not a JSON object, or a servers key that is not an object, is left unchanged and answered with its path (status 500, exit 1); the parent directory is created when missing. A missing or unknown --client, or any further word, answers the usage (status 400, exit 2). On success the answer is `Registered `orb mcp` in <path>`; the installed language is then checked through std-cli (`orb list --global`) and a failure adds a warning line naming `npx -y @almadar/orb update --global`. The file is written as compact JSON followed by a newline."

package/behaviors/lolo/cli/atoms/std-orb-mcp.lolo

@@ -2,7 +2,7 @@ app std-orb-mcp [
   version: "1.0.0",
   env: ["ALMADAR_PERSONA_OWNS", "PATH"],
   inbound: ["cli-mcp"],
-  exec: ["orb"],
+  exec: [exe],
   stdio: [in, out],
   fs: { cwd: "**": [read, write], "/**": [read, write], "~/.orb/**": [read] },
   description: "std-orb-mcp — the `orb mcp [--program <file>]` command: the MCP server as a std program (spec/cli/mcp-server.lolo). The hook cli-mcp takes argv; `--program <file>` names the program whose inbound hooks are served as tools beside the language's. The server version is what `orb --version` answers (`orb X.Y.Z`), run from PATH (os/spawn takes a literal command, so the running binary's own path cannot be spawned). Stdin line framing is owned by std-stdio-lines; each line is acknowledged only after its tool answers, preserving serial requests, fragmented UTF-8 and the final unterminated line. Replies are compact JSON lines on stdout; EOF ends the command after every request is answered. Protocol: initialize, ping, tools/list, tools/call, prompts/list, prompts/get; a parse error is code -32700 with the text `parse error: invalid JSON` (the Rust server's serde wording is not reproduced), an unknown method -32601, an unknown prompt -32602, an unknown tool a tool result with isError. Tools served: validate, format (the text read from the file formatted by program/print { source }, comments kept; with `write: true` the file is rewritten with that text and the answer is still { source }), behaviors (with `scopes`: those registry folders cataloged; without: every installed package from behavior/packages cataloged one package at a time, vectors omitted, answering { behaviors, skipped: [{ package, error }] } where a package whose behaviors do not lower is reported and skipped; the host indexes a package whole, so the unit skipped is the package, not one behavior), describe_behavior, read_behavior ({ path, source } through behavior/source file: true), play, operators, patterns, evaluate (the expression in a one-transition program built with quasiquote, played through program/step with the request entity and payload). complete, reference and test run std-orb-complete, std-orb-reference and std-orb-test. Hook tools from --program are listed from program/inputs and called by program/dispatch with inbound; the guest-binding gap is recorded in the std ledger."
@@ -176,7 +176,7 @@ orbital OrbMcpOrbital {
     state versioning {
       INIT -> versioning
       MCP_PATH_READ -> versioning
-        (os/spawn "orb" ["--version"] { cwd: null env: { PATH: (default @payload.value "") } stdin: "null" stdout: "pipe" stderr: "null" detached: false } { key: "spawn" emit: { success: MCP_SPAWNED, failure: MCP_START_FAILED } })
+        (os/spawn { anchor: "exe" } ["--version"] { cwd: null env: { PATH: (default @payload.value "") } stdin: "null" stdout: "pipe" stderr: "null" detached: false } { key: "spawn" emit: { success: MCP_SPAWNED, failure: MCP_START_FAILED } })
       MCP_START_FAILED -> starting
         (emit MCP_ANSWERED { status: 500, body: (str/concat "orb mcp: " (default @payload.error "")) })
       MCP_SPAWNED -> versioning

package/behaviors/lolo/cli/atoms/std-orb-packages.lolo

@@ -6,7 +6,7 @@ app std-orb-packages [
   sys: [identity],
   fs: { cwd: "**": [read, write, create, remove], "/**": [read], "~/.orb/**": [read, write, create, remove], "~/.orb": [create] },
   net: { "registry.npmjs.org:443": [tcp] },
-  description: "std-orb-packages — the `orb list|add|update|remove [--global]` client of the npm registry (spec/cli/orb-packages.lolo; golden: orbital-cli packages.rs), bun-free. Packages live in <dir>/node_modules (dir = the working directory, or ~/.orb with --global) and the lockfile <dir>/<lockfile> holds { packages: [{ name, version, url, integrity }] }. Every command first reads the lockfile (absent = empty) and scans node_modules (scoped names included; the entry kind symlink is the workspace link), reading each package.json: a package is an orb package when it declares orbLanguage, orb, orbVocabulary or orbProgram.kind shell|desktop, and its kinds are those. list prints one row per orb package sorted by name (package 34, version 12, kinds 26, `ok`, ` (linked)`, ` [<prefix>/]`) or --json rows. remove refuses a behavior package whose prefix a .lolo or .orb file under the working directory still imports, deletes the package (a link is unlinked, never its target) and drops its lock entry. add parses name@exact-version (a range is refused ORB_PACKAGE_RANGE; a workspace-linked package is refused ORB_PACKAGE_LINKED) or a direct tarball URL (refused: it carries no integrity), and resolves name@version through GET <registry>/<name>/<version> (the npm version manifest: dist.tarball and dist.integrity). update reads the npm packument GET <registry>/<name> of every non-linked orb package and of every missing baseline package (an upgrade from nothing), and moves each to the newest stable, non-deprecated version above the installed one whose language is compatible: the running orb answers `orb --version` as `orb X.Y.Z (language R)` (any other form is refused) and keeps R; @almadar/core resolves first, and its candidate is compatible when its orbLanguage.version satisfies R; every other package is compatible when its language range (orb.language, orbLanguage.language, orbVocabulary.language or orbProgram.language, the first present) is satisfied by the target core language, the orbLanguage.version of the core version this update installs, else of the installed core; a version with no language is skipped ORB_PACKAGE_NO_LANGUAGE (compatibility is declared by the version itself, so one that declares nothing is never assumed compatible). The release version of orb is never compared with a package range. The tarball is downloaded from the registry knob (RegistryHttp) or the sourceOrigin knob (SourceHttp, one client per origin; any other host is refused ORB_PACKAGE_SOURCE), and its sha512 digest must equal the registry dist.integrity (sha512- plus base64, hash/sha): a different digest is refused `integrity-mismatch`, an unhashable one `integrity-unavailable`, and nothing is written or recorded. A verified tarball is gunzipped (maxUnpackedBytes) and read as a ustar archive (maxEntries) by the kernel; a codec refusal is ORB_PACKAGE_ARCHIVE (<code>), an entry outside package/ ORB_PACKAGE_LAYOUT. The files are written into node_modules/.orb-staging/<name>@<version> (mode 755 for executables, else 644), the old node_modules/<name> is renamed to node_modules/.orb-staging/<name>@<version>.old, the staging directory is renamed into place and only then is the backup removed (a failed rename into place renames the backup back and refuses the package ORB_PACKAGE_INSTALL, saying the previous version was restored; a failed restore names where the backup is kept; a leftover backup from an earlier crashed swap is never overwritten, it refuses the package); only then is the package's lock entry replaced and the lockfile written last. Every version may carry a top-level orbRelease block { severity security|critical|normal, advisory (one line), fixes (a semver range of the earlier versions it fixes) } in its registry manifest; no block is normal, and any other severity word is read as normal. update names, after the list rows, one `<severity> update: <name> <from> → <to>: <advisory>` line for each applied version whose own severity is security or critical. `orb update --urgent` (update only; with any other command it is refused with the usage line) installs only urgent updates: a package is urgent when some stable, non-deprecated version newer than the installed one is security or critical, declares a fixes range, the installed version satisfies that range (std-semver) and the version passes the language check above; the newest such version is installed through the same integrity check, staging swap and lockfile write, a baseline package that is not installed is never urgent, and stdout carries only the applied `<severity> update:` lines. An urgent version that fails the language check (ORB_PACKAGE_INCOMPATIBLE or ORB_PACKAGE_NO_LANGUAGE), whose fixes range std-semver refuses (ORB_PACKAGE_RELEASE), or that fails its download, integrity or install, is not applied: the installed version stays, the call answers 500, and stderr names the refusals and each confirmed-urgent advisory (a failed install leaves the old package in place, never half-installed). `orb update --global` also keeps this host's orb binary package (the orbPlatforms knob, matched on os/uname sysname and machine: @almadar/orb-darwin-arm64, -darwin-x64, -linux-x64, -linux-arm64, -windows-x64) installed like a baseline package, in the registry knob, with its own compatibility rule: it has no language range, so its newest stable, non-deprecated version is taken whose package.json declares orbReads, a range the target core language satisfies (a version without orbReads is skipped ORB_PACKAGE_NO_LANGUAGE; its orb and orbProgram blocks are not read); a package that declares orbReads is listed with kind `orb`; --urgent never installs it from nothing. A host that matches no entry, or whose os/uname fails (the Windows host does not implement it), prints one ORB_PACKAGE_PLATFORM line on stderr and no orb package is considered. Not yet ported: the kind-loads-for-this-orb problem column, the behaviors count, the update-check record and the engines subcommands; add does not remove a package that declares no orb kind."
+  description: "std-orb-packages — the `orb list|add|update|remove [--global]` client of the npm registry (spec/cli/orb-packages.lolo; golden: orbital-cli packages.rs), bun-free. Packages live in <dir>/node_modules (dir = the working directory, or ~/.orb with --global) and the lockfile <dir>/<lockfile> holds { packages: [{ name, version, url, integrity }] }. Every command first reads the lockfile (absent = empty) and scans node_modules (scoped names included; the entry kind symlink is the workspace link), reading each package.json: a package is an orb package when it declares orbLanguage, orb, orbVocabulary or orbProgram.kind shell|desktop, and its kinds are those. list prints one row per orb package sorted by name (package 34, version 12, kinds 26, `ok`, ` (linked)`, ` [<prefix>/]`) or --json rows. remove refuses a behavior package whose prefix a .lolo or .orb file under the working directory still imports, deletes the package (a link is unlinked, never its target) and drops its lock entry. add parses name@exact-version (a range is refused ORB_PACKAGE_RANGE; a workspace-linked package is refused ORB_PACKAGE_LINKED) or a direct tarball URL (refused: it carries no integrity), and resolves name@version through GET <registry>/<name>/<version> (the npm version manifest: dist.tarball and dist.integrity). update reads the npm packument GET <registry>/<name> of every non-linked orb package and of every missing baseline package (an upgrade from nothing), and moves each to the newest stable, non-deprecated version above the installed one whose language is compatible: the running orb answers `orb --version` as `orb X.Y.Z (language R)` (any other form is refused) and keeps R; @almadar/core resolves first, and its candidate is compatible when its orbLanguage.version satisfies R; every other package is compatible when its language range (orb.language, orbLanguage.language, orbVocabulary.language or orbProgram.language, the first present) is satisfied by the target core language, the orbLanguage.version of the core version this update installs, else of the installed core; a version with no language is skipped ORB_PACKAGE_NO_LANGUAGE (compatibility is declared by the version itself, so one that declares nothing is never assumed compatible). The release version of orb is never compared with a package range. The tarball is downloaded from the registry knob (RegistryHttp) or the sourceOrigin knob (SourceHttp, one client per origin; any other host is refused ORB_PACKAGE_SOURCE), and its sha512 digest must equal the registry dist.integrity (sha512- plus base64, hash/sha): a different digest is refused `integrity-mismatch`, an unhashable one `integrity-unavailable`, and nothing is written or recorded. A verified tarball is gunzipped (maxUnpackedBytes) and read as a ustar archive (maxEntries) by the kernel; a codec refusal is ORB_PACKAGE_ARCHIVE (<code>), an entry outside package/ ORB_PACKAGE_LAYOUT. The files are written into node_modules/.orb-staging/<name>@<version> (mode 755 for executables, else 644), the old node_modules/<name> is renamed to node_modules/.orb-staging/<name>@<version>.old, the staging directory is renamed into place and only then is the backup removed (a failed rename into place renames the backup back and refuses the package ORB_PACKAGE_INSTALL, saying the previous version was restored; a failed restore names where the backup is kept; a leftover backup from an earlier crashed swap is never overwritten, it refuses the package); only then is the package's lock entry replaced and the lockfile written last. Every version may carry a top-level orbRelease block { severity security|critical|normal, advisory (one line), fixes (a semver range of the earlier versions it fixes) } in its registry manifest; no block is normal, and any other severity word is read as normal. update names, after the list rows, one `<severity> update: <name> <from> → <to>: <advisory>` line for each applied version whose own severity is security or critical. `orb update --urgent` (update only; with any other command it is refused with the usage line) installs only urgent updates: a package is urgent when some stable, non-deprecated version newer than the installed one is security or critical, declares a fixes range, the installed version satisfies that range (std-semver) and the version passes the language check above; the newest such version is installed through the same integrity check, staging swap and lockfile write, a baseline package that is not installed is never urgent, and stdout carries only the applied `<severity> update:` lines. An urgent version that fails the language check (ORB_PACKAGE_INCOMPATIBLE or ORB_PACKAGE_NO_LANGUAGE), whose fixes range std-semver refuses (ORB_PACKAGE_RELEASE), or that fails its download, integrity or install, is not applied: the installed version stays, the call answers 500, and stderr names the refusals and each confirmed-urgent advisory (a failed install leaves the old package in place, never half-installed). `orb update --global` also keeps this host's orb binary package (the orbPlatforms knob, matched on os/uname sysname and machine: @almadar/orb-darwin-arm64, -darwin-x64, -linux-x64, -linux-arm64, -windows-x64) installed like a baseline package, in the registry knob, with its own compatibility rule: it has no language range, so its newest stable, non-deprecated version is taken whose package.json declares orbReads, a range the target core language satisfies (a version without orbReads is skipped ORB_PACKAGE_NO_LANGUAGE; its orb and orbProgram blocks are not read); a package that declares orbReads is listed with kind `orb`; --urgent never installs it from nothing. A host that matches no entry, or whose os/uname fails (the Windows host does not implement it), prints one ORB_PACKAGE_PLATFORM line on stderr and no orb package is considered. A package whose package.json declares orbProgram also installs each of its optionalDependencies at its exact version whose registry manifest os and cpu include this host's (the os and cpu of the orbPlatforms entry os/uname matched, the npm platform rule; every add and update asks os/uname); a host os/uname cannot place installs none of them. Every file the package.json bin map names is written executable. Not yet ported: the kind-loads-for-this-orb problem column, the behaviors count, the update-check record and the engines subcommands; add does not remove a package that declares no orb kind."
 ]
 uses Spec from "almadar-std/orb-packages"
 uses Http from "std/behaviors/std-http-client"
@@ -17,18 +17,18 @@ type PackageKind = "language" | "behaviors" | "language pack" | "shell" | "deskt
 type PackageRow = { package : string!, kinds : [PackageKind]!, version : string!, path : string!, link : boolean!, prefix : string?, behaviors : number?, problem : string? }
 type LockEntry = { name : string!, version : string!, url : string!, integrity : string! }
 type BaselineEntry = { name : string!, registry : string! }
-type OrbPlatform = { sysname : string!, machine : string!, package : string! }
+type OrbPlatform = { sysname : string!, machine : string!, package : string!, os : string!, cpu : string! }
 type LockFile = { packages : [LockEntry]! }
-type PackageTarget = { name : string!, version : string!, url : string!, integrity : string!, severity : string?, advisory : string?, installedVersion : string? }
+type PackageTarget = { name : string!, version : string!, url : string!, integrity : string!, severity : string?, advisory : string?, installedVersion : string?, platform : boolean? }
 type Marker = { x : string? }
 type LanguageBlock = { version : string? }
 type OrbPackagesBlock = { prefix : string? }
 type ProgramBlock = { kind : string?, name : string? }
-type OrbPackagesManifest = { name : string?, version : string?, orbLanguage : LanguageBlock?, orb : OrbPackagesBlock?, orbVocabulary : Marker?, orbProgram : ProgramBlock?, orbReads : string? }
+type OrbPackagesManifest = { name : string?, version : string?, orbLanguage : LanguageBlock?, orb : OrbPackagesBlock?, orbVocabulary : Marker?, orbProgram : ProgramBlock?, orbReads : string?, optionalDependencies : Map string string?, bin : Map string string? }
 type NpmDist = { tarball : string!, integrity : string? }
 type NpmLanguage = { language : string?, version : string? }
 type NpmRelease = { severity : string?, advisory : string?, fixes : string? }
-type NpmManifest = { version : string!, deprecated : string?, dist : NpmDist?, orb : NpmLanguage?, orbLanguage : NpmLanguage?, orbVocabulary : NpmLanguage?, orbProgram : NpmLanguage?, orbRelease : NpmRelease?, orbReads : string? }
+type NpmManifest = { version : string!, deprecated : string?, dist : NpmDist?, orb : NpmLanguage?, orbLanguage : NpmLanguage?, orbVocabulary : NpmLanguage?, orbProgram : NpmLanguage?, orbRelease : NpmRelease?, orbReads : string?, os : [string]?, cpu : [string]? }
 type Packument = { name : string!, versions : Map string NpmManifest! }
 type Candidate = { version : string!, key : number!, language : string!, provides : string!, url : string!, integrity : string!, severity : string?, advisory : string?, fixes : string? }
 type Subject = { package : string!, version : string!, missing : boolean! }
@@ -107,6 +107,8 @@ orbital OrbPackagesOrbital {
     orbPackage : string = ""
     unamed : boolean = false
     platformNote : string = ""
+    hostOs : string = ""
+    hostCpu : string = ""
     placeError : string = ""
   }
 
@@ -176,6 +178,8 @@ orbital OrbPackagesOrbital {
         (set @entity.orbPackage "")
         (set @entity.unamed false)
         (set @entity.platformNote "")
+        (set @entity.hostOs "")
+        (set @entity.hostCpu "")
         (set @entity.lock [])
         (set @entity.pkgs [])
         (set @entity.rows [])
@@ -281,14 +285,14 @@ orbital OrbPackagesOrbital {
         (emit PKG_RM_NEXT { })
       PKG_DISPATCH -> ready when (and (not @entity.installed) (= @entity.cmd "add") (= (array/len @entity.args) 0))
         (emit PACKAGES_ANSWERED { status: 400, body: "", stderr: "usage: orb add <package, an at sign and an exact version | tarball url> [--global]" })
-      PKG_DISPATCH -> resolving when (and (not @entity.installed) (= @entity.cmd "add") (> (array/len @entity.args) 0))
+      PKG_DISPATCH -> resolving when (and (not @entity.installed) (= @entity.cmd "add") (> (array/len @entity.args) 0) @entity.unamed)
         (set @entity.targets [])
         (set @entity.cursor 0)
         (emit PKG_PLAN_ADD { })
-      PKG_DISPATCH -> resolving when (and (not @entity.installed) (= @entity.cmd "update") (and @entity.global (not @entity.urgent) (not @entity.unamed)))
+      PKG_DISPATCH -> resolving when (and (not @entity.installed) (or (= @entity.cmd "update") (and (= @entity.cmd "add") (> (array/len @entity.args) 0))) (not @entity.unamed))
         (set @entity.targets [])
         (os/uname { key: "uname" emit: { success: PKG_UNAME, failure: PKG_UNAME_FAILED } })
-      PKG_DISPATCH -> resolving when (and (not @entity.installed) (= @entity.cmd "update") (not (and @entity.global (not @entity.urgent) (not @entity.unamed))))
+      PKG_DISPATCH -> resolving when (and (not @entity.installed) (= @entity.cmd "update") @entity.unamed)
         (set @entity.targets [])
         (set @entity.subjects (let ((all (array/concat (array/map (array/filter @entity.rows (fn r (not (object/get @r "link")))) (fn r { package: (object/get @r "package"), version: (object/get @r "version"), missing: false })) (if @entity.urgent [] (array/map (array/filter (array/concat @config.baseline (if (!= @entity.orbPackage "") [{ name: @entity.orbPackage, registry: @config.registry }] [])) (fn b (and (= (array/len (array/filter @entity.rows (fn r (= (object/get @r "package") (object/get @b "name"))))) 0) (= (object/get @b "registry") @config.registry)))) (fn b { package: (object/get @b "name"), version: "0.0.0", missing: true })))))) (array/concat (array/filter @all (fn s (= (object/get @s "package") @config.corePackage))) (array/filter @all (fn s (!= (object/get @s "package") @config.corePackage))))))
         (set @entity.refused (if @entity.urgent [] (array/map (array/filter (array/concat @config.baseline (if (!= @entity.orbPackage "") [{ name: @entity.orbPackage, registry: @config.registry }] [])) (fn b (and (= (array/len (array/filter @entity.rows (fn r (= (object/get @r "package") (object/get @b "name"))))) 0) (!= (object/get @b "registry") @config.registry)))) (fn b (str/concat (object/get @b "name") ": ORB_PACKAGE_SOURCE (baseline registry " (object/get @b "registry") " is not the registry knob)")))))
@@ -486,13 +490,15 @@ orbital OrbPackagesOrbital {
       INIT -> resolving
       PKG_UNAME -> dispatching
         (set @entity.unamed true)
-        (set @entity.orbPackage (object/get (default (array/find @config.orbPlatforms (fn x (and (= (object/get @x "sysname") @payload.sysname) (= (object/get @x "machine") @payload.machine)))) { sysname: "", machine: "", package: "" }) "package"))
-        (set @entity.platformNote (if (= (object/get (default (array/find @config.orbPlatforms (fn x (and (= (object/get @x "sysname") @payload.sysname) (= (object/get @x "machine") @payload.machine)))) { sysname: "", machine: "", package: "" }) "package") "") (str/concat "orb: ORB_PACKAGE_PLATFORM (" @payload.sysname " " @payload.machine " has no orb platform package in the orbPlatforms knob; the orb binary was not considered)") ""))
+        (set @entity.hostOs (object/get (default (array/find @config.orbPlatforms (fn x (and (= (object/get @x "sysname") @payload.sysname) (= (object/get @x "machine") @payload.machine)))) { sysname: "", machine: "", package: "", os: "", cpu: "" }) "os"))
+        (set @entity.hostCpu (object/get (default (array/find @config.orbPlatforms (fn x (and (= (object/get @x "sysname") @payload.sysname) (= (object/get @x "machine") @payload.machine)))) { sysname: "", machine: "", package: "", os: "", cpu: "" }) "cpu"))
+        (set @entity.orbPackage (if (and @entity.global (= @entity.cmd "update") (not @entity.urgent)) (object/get (default (array/find @config.orbPlatforms (fn x (and (= (object/get @x "sysname") @payload.sysname) (= (object/get @x "machine") @payload.machine)))) { sysname: "", machine: "", package: "", os: "", cpu: "" }) "package") ""))
+        (set @entity.platformNote (if (or (not (and @entity.global (= @entity.cmd "update") (not @entity.urgent))) (!= (object/get (default (array/find @config.orbPlatforms (fn x (and (= (object/get @x "sysname") @payload.sysname) (= (object/get @x "machine") @payload.machine)))) { sysname: "", machine: "", package: "", os: "", cpu: "" }) "package") "")) "" (str/concat "orb: ORB_PACKAGE_PLATFORM (" @payload.sysname " " @payload.machine " has no orb platform package in the orbPlatforms knob; the orb binary was not considered)")))
         (emit PKG_DISPATCH { })
       PKG_UNAME_FAILED -> dispatching
         (set @entity.unamed true)
         (set @entity.orbPackage "")
-        (set @entity.platformNote (str/concat "orb: ORB_PACKAGE_PLATFORM (the platform could not be determined: " (default @payload.error "") "; the orb binary was not considered)"))
+        (set @entity.platformNote (if (and @entity.global (= @entity.cmd "update") (not @entity.urgent)) (str/concat "orb: ORB_PACKAGE_PLATFORM (the platform could not be determined: " (default @payload.error "") "; the orb binary was not considered)") ""))
         (emit PKG_DISPATCH { })
       PKG_BACKUP_NEXT -> resolving when (and @entity.hadOld @entity.global)
         (os/rmdir (str/concat "~/.orb/node_modules/" (str/concat @entity.stage ".old")) true { key: "backupclear" emit: { success: PKG_BACKUP_GONE, failure: PKG_BACKUP_GONE } })
@@ -609,8 +615,11 @@ orbital OrbPackagesOrbital {
         (emit PKG_DOWNLOAD { url: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "url") })
       PKG_TARGET_NEXT -> resolving when (and (< @entity.cursor (array/len @entity.targets)) (= (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "url") ""))
         (emit PK_GET { key: "resolve", method: "GET", target: (str/concat "/" (str/join (str/split (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name") "/") "%2f") "/" (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "version")), headers: [{ name: "accept", value: "application/json" }], body: (bytes/from-string ""), stream: "none" })
-      PKG_RESOLVED -> downloading when (and (!= @entity.mf null) (!= (object/get @entity.mf "dist") null))
-        (set @entity.targets (array/map (array/range 0 (array/len @entity.targets)) (fn i (if (= @i @entity.cursor) { name: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name"), version: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "version"), url: (default (object/get (default (object/get @entity.mf "dist") { tarball: "" }) "tarball") ""), integrity: (default (object/get (default (object/get @entity.mf "dist") { tarball: "" }) "integrity") "") } (default (array/nth @entity.targets @i) { name: "", version: "", url: "", integrity: "" })))))
+      PKG_RESOLVED -> resolving when (and (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "platform") false) (!= @entity.mf null) (not (and (array/includes (default (object/get @entity.mf "os") []) @entity.hostOs) (array/includes (default (object/get @entity.mf "cpu") []) @entity.hostCpu))))
+        (set @entity.cursor (+ @entity.cursor 1))
+        (emit PKG_TARGET_NEXT { })
+      PKG_RESOLVED -> downloading when (and (!= @entity.mf null) (!= (object/get @entity.mf "dist") null) (not (and (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "platform") false) (not (and (array/includes (default (object/get @entity.mf "os") []) @entity.hostOs) (array/includes (default (object/get @entity.mf "cpu") []) @entity.hostCpu))))))
+        (set @entity.targets (array/map (array/range 0 (array/len @entity.targets)) (fn i (if (= @i @entity.cursor) { name: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name"), version: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "version"), url: (default (object/get (default (object/get @entity.mf "dist") { tarball: "" }) "tarball") ""), integrity: (default (object/get (default (object/get @entity.mf "dist") { tarball: "" }) "integrity") ""), platform: (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "platform") false) } (default (array/nth @entity.targets @i) { name: "", version: "", url: "", integrity: "" })))))
         (emit PKG_DOWNLOAD { url: (default (object/get (default (object/get @entity.mf "dist") { tarball: "" }) "tarball") "") })
       PKG_RESOLVED -> resolving when (or (= @entity.mf null) (= (object/get @entity.mf "dist") null))
         (set @entity.refused (array/append @entity.refused (str/concat (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name") " version " (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "version") ": ORB_PACKAGE_NOT_FOUND (registry answered " @payload.status ")")))
@@ -684,7 +693,7 @@ orbital OrbPackagesOrbital {
         (set @entity.cursor (+ @entity.cursor 1))
         (emit PKG_TARGET_NEXT { })
       PKG_UNTARRED -> installing when (and (!= @entity.tar null) (default (object/get @entity.tar "ok") false))
-        (set @entity.files (default (object/get @entity.tar "entries") []))
+        (set @entity.files (let ((es (default (object/get @entity.tar "entries") []))) (let ((pj (array/find @es (fn e (= (object/get @e "path") "package/package.json"))))) (let ((bins (if (= @pj null) [] (let ((m (json/parse (default (bytes/to-string (object/get @pj "data")) "") OrbPackagesManifest))) (if (= @m null) [] (array/map (object/entries (default (object/get @m "bin") {})) (fn b (str/concat "package/" (str/replace-pattern (default (array/nth @b 1) "") "^\\./" ""))))))))) (array/map @es (fn e { path: (object/get @e "path"), data: (object/get @e "data"), executable: (or (object/get @e "executable") (array/includes @bins (object/get @e "path"))) }))))))
         (set @entity.tar null)
         (emit PKG_LAYOUT { })
       PKG_LAYOUT -> resolving when (or (= (array/len @entity.files) 0) (> (array/len (array/filter @entity.files (fn e (not (str/startsWith (object/get @e "path") "package/"))))) 0))
@@ -761,7 +770,8 @@ orbital OrbPackagesOrbital {
         (set @entity.lock (array/append (array/filter @entity.lock (fn l (!= (object/get @l "name") (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name")))) { name: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name"), version: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "version"), url: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "url"), integrity: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "integrity") }))
         (set @entity.lockDirty true)
         (set @entity.applied (if (array/includes ["security", "critical"] (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "severity") "normal")) (array/append @entity.applied (str/concat (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "severity") "") " update: " (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name") " " (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "installedVersion") "") " → " (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "version") ": " (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "advisory") ""))) @entity.applied))
-        (set @entity.done (array/append @entity.done (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name")))
+        (set @entity.done (if (default (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "platform") false) @entity.done (array/append @entity.done (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name"))))
+        (set @entity.targets (let ((pj (array/find @entity.files (fn e (= (object/get @e "path") "package/package.json"))))) (let ((m (if (= @pj null) null (json/parse (default (bytes/to-string (object/get @pj "data")) "") OrbPackagesManifest)))) (if (or (= @m null) (= (object/get @m "orbProgram") null) (= @entity.hostOs "")) @entity.targets (array/concat @entity.targets (array/map (object/entries (default (object/get @m "optionalDependencies") {})) (fn d { name: (array/nth @d 0), version: (array/nth @d 1), url: "", integrity: "", platform: true })))))))
         (set @entity.files [])
         (set @entity.tarball (bytes/from-string ""))
         (emit PACKAGE_INSTALLED { name: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "name"), version: (object/get (default (array/nth @entity.targets @entity.cursor) { name: "", version: "", url: "", integrity: "" }) "version"), kinds: [] })
@@ -1076,7 +1086,7 @@ orbital OrbPackagesOrbital {
       baseline : [BaselineEntry] = [{ name: (quote "@almadar/core"), registry: "https://registry.npmjs.org" }, { name: (quote "@almadar/std"), registry: "https://registry.npmjs.org" }, { name: (quote "@almadar/lolo-ar"), registry: "https://registry.npmjs.org" }, { name: (quote "@almadar/lolo-sl"), registry: "https://registry.npmjs.org" }, { name: (quote "@almadar/orb-shell-typescript"), registry: "https://registry.npmjs.org" }]
         @label "Baseline"
         @description "The packages `orb update` installs when missing, each resolved like an upgrade from nothing: the newest stable, non-deprecated version whose language is compatible (core: its orbLanguage.version is in the range this orb reads; any other package: its language range accepts the core language this update installs, else the installed one), read from its registry."
-      orbPlatforms : [OrbPlatform] = [{ sysname: "Darwin", machine: "arm64", package: (quote "@almadar/orb-darwin-arm64") }, { sysname: "Darwin", machine: "x86_64", package: (quote "@almadar/orb-darwin-x64") }, { sysname: "Linux", machine: "x86_64", package: (quote "@almadar/orb-linux-x64") }, { sysname: "Linux", machine: "aarch64", package: (quote "@almadar/orb-linux-arm64") }, { sysname: "Linux", machine: "arm64", package: (quote "@almadar/orb-linux-arm64") }, { sysname: "Windows_NT", machine: "AMD64", package: (quote "@almadar/orb-windows-x64") }]
+      orbPlatforms : [OrbPlatform] = [{ sysname: "Darwin", machine: "arm64", package: (quote "@almadar/orb-darwin-arm64"), os: "darwin", cpu: "arm64" }, { sysname: "Darwin", machine: "x86_64", package: (quote "@almadar/orb-darwin-x64"), os: "darwin", cpu: "x64" }, { sysname: "Linux", machine: "x86_64", package: (quote "@almadar/orb-linux-x64"), os: "linux", cpu: "x64" }, { sysname: "Linux", machine: "aarch64", package: (quote "@almadar/orb-linux-arm64"), os: "linux", cpu: "arm64" }, { sysname: "Linux", machine: "arm64", package: (quote "@almadar/orb-linux-arm64"), os: "linux", cpu: "arm64" }, { sysname: "Windows_NT", machine: "AMD64", package: (quote "@almadar/orb-windows-x64"), os: "win32", cpu: "x64" }]
         @label "Orb platform packages"
         @description "The orb binary's own package per platform, keyed by the sysname and machine os/uname answers. `orb update --global` (not --urgent) asks os/uname and resolves the entry that matches this host like a baseline package, in the registry knob, but on its own compatibility rule: an orb platform package has no language range, so a version is compatible when its package.json declares orbReads, a range of core languages, and the target core language satisfies it (a version with no orbReads is skipped ORB_PACKAGE_NO_LANGUAGE). A host that matches no entry, or whose os/uname fails, gets one loud ORB_PACKAGE_PLATFORM line on stderr and no orb package is considered."
       maxUnpackedBytes : number = 536870912

package/behaviors/lolo/cli/atoms/std-orb-supervise.lolo

@@ -1,7 +1,7 @@
 app std-orb-supervise [
   version: "1.0.0",
   inbound: ["cli-supervise"],
-  exec: ["orb"],
+  exec: [exe],
   env: ["PATH", "HOME"],
   stdio: [out, err],
   fs: { cwd: "**": [read] },

package/behaviors/lolo/cli/atoms/std-orb-update-notice.lolo

@@ -2,7 +2,7 @@ app std-orb-update-notice [
   version: "1.0.0",
   inbound: ["cli-notice"],
   env: ["ORB_NO_UPDATE_CHECK", "CI", "PATH", "HOME"],
-  exec: ["orb"],
+  exec: [exe, "orb"],
   fs: { "~/.orb/**": [read, write, create], "~/.orb": [create], cwd: "orb.lock.json": [read] },
   net: { "registry.npmjs.org:443": [tcp], "*.npmjs.org:443": [tcp] },
   description: "std-orb-update-notice — the daily updates-available notice and the urgent auto-update (spec/cli/orb-update-notice.lolo; golden: orbital-cli update_notice.rs). The call's first argv word `record` (after orb update) stamps ~/.orb/.update-check.json as checked now with nothing available and no urgent rows and prints nothing. Any other call is quiet when ORB_NO_UPDATE_CHECK or CI is set, and silent when stderr is not a terminal; a quiet call on a terminal only reports, loudly on stderr, each failed urgent row the cache holds, and never scans or updates. Otherwise it reads the cache { checkedAt (seconds), available [[name, installed, newest, store]] (a three-word row is the global store), urgent [[store, status, text]] (status applied or failed) }: a cache under a day old with no failed urgent row answers its list, an older, absent or garbled one rescans, and a cache with a failed urgent row acts at once on those stores without waiting for the day. The scan covers the global store (each @almadar/ dependency of ~/.orb/package.json with its range and its installed version in ~/.orb/node_modules/<name>/package.json) and the working directory's orb-installed packages (each name and version pinned in ./orb.lock.json, any version above the pinned one counts): it asks std-npm-lookup for the versions, walks the stable ones (no prerelease) from the newest down until std-semver says one satisfies the range, and keeps the package when that version compares above the installed one; a package that is not installed, whose lookup is refused, whose range std-semver refuses, or that no stable version satisfies is skipped. The registry's per-version orbRelease block (severity, advisory, fixes) is read by the update itself, not here: after the scan the notice runs `orb update --urgent` (project store, when the lockfile pins packages) and `orb update --urgent --global` through std-cli with ORB_NO_UPDATE_CHECK set so the child never recurses, and records what each printed. Every stdout line of the child is an applied urgent update (recorded status applied and printed as `orb: applied urgent <line> (<store> store)`); a non-zero exit, or a child that could not run, records status failed with the child's stderr and prints `orb: URGENT UPDATE FAILED for the <store> packages: <why>` and that the vulnerable version is still installed, on stderr, so the installed version is kept and nothing is hidden. Normal updates keep the one stderr line `orb: updates available (<name> <from> → <to>, …); run `orb update --global`` (a project package says `in this project` and `orb update`). The cache is written (a failed write is ignored) with the urgent rows, and the answer carries the stderr lines or nothing."

package/behaviors/lolo/cli/atoms/std-orb-validate.lolo

@@ -2,7 +2,7 @@ app std-orb-validate [
   version: "1.0.0",
   inbound: ["cli-validate"],
   env: ["PATH"],
-  exec: ["orb"],
+  exec: [exe],
   fs: { cwd: "**": [read], "/**": [read], "~/.orb/node_modules/**": [read] },
   description: "std-orb-validate — the `orb validate <file> [--json] [--deny-warnings] [--final] [--patterns <path>] [--services <path>]` command (spec/cli/orb-validate.lolo; port of orbital-cli commands/validate.rs validate_schema). The core checks are the host op `(program/validate null { report: true path final denyWarnings patterns services })`, which answers exactly the report `orb validate --json` printed: { success, valid, errors?, warnings?, stats? }. The path is the working directory joined to the file when relative. --json prints that report as 2-space pretty JSON (status 200, as Rust exited 0 for an invalid program). The text form prints `Validating schema: <file>` on stdout, then on errors `Schema validation errors:` and one `  ❌ [CODE] path: message @ line:col 💡 suggestion` line per error on stderr followed by `Error: Schema validation failed with N error(s)` (status 500); on warnings alone `Schema validation warnings:` and `  ⚠️  …` lines on stdout, and under --deny-warnings `Error: Schema validation failed: N warning(s) under --deny-warnings` on stderr (status 500). A file the host could not read (FILE_READ_ERROR) prints `Error: <reason>` on stderr (status 500). Under --final the host is never asked for the retired `final` check: the final-only rules of the composed std-orb-lint-engine (expectation-final, not-found, control-unhandled; their findings arrive in LINT_COLLECTED.final over the same lint input) join the policy findings in the same host call; without --final they are dropped. Policy lints (the std-orb-lint-engine orbital, composed here; it answers LINT_COLLECTED) merge into the report: an error-severity lint finding joins errors, a warning joins warnings. Usage error: status 400 (exit 2). Known differences from the Rust bytes: a finding the host reports without a line prints no ` @ line:col`; lint findings carry no source position."
 ]

package/behaviors/lolo/dev/atoms/std-launchpad-updates.lolo

@@ -1,6 +1,6 @@
 app std-launchpad-updates [
   version: "1.0.0",
-  exec: ["orb"],
+  exec: [exe, "orb"],
   env: ["PATH", "HOME"],
   sys: [self-signal],
   description: "std-launchpad-updates — the launchpad's view of the update record orb's update notice keeps in ~/.orb/.update-check.json ({ checkedAt, available [[name, installed, newest, store]], urgent [[store, applied|failed, text]] }) and the button that runs the update. UPDATES_LOAD reads the record: the record is read through std-orb-update-record, its one owner: a file that does not exist is no update (UPDATES_LOADED with nothing), a file that is not a record in that shape (another writer's, garbled) answers UPDATES_UNCHECKED, any other read failure answers UPDATES_FAILED { error }, and a good record answers UPDATES_LOADED { available, urgent } (urgent is empty when the record has none). The banner draws UPDATES_UNCHECKED as an info alert titled No update check yet, saying the record is not readable and the next due update check writes it again, never as a failed update. UPDATES_RUN { store } runs `orb update --global` for the global store and `orb update` for any other store through std-cli (the orb on PATH) and, when the run ends, answers UPDATES_RAN { store } on exit 0 or UPDATES_RUN_FAILED { store, error } (the child's stderr, or its exit code, or why orb could not start), then reads the record again either way; The banner (UpdatesBanner) reads the record at INIT and on UPDATES_REFRESH and draws, as core patterns, an info alert with an Update button per store that has available updates, a success alert per applied urgent row (advisory text and the restart text), an error alert per failed urgent row (the vulnerable version is still installed) with a Retry button, a success alert after a finished run that says the launchpad restarts if a service manager runs it, each applied alert with a Restart button (UPDATES_RESTART_PRESSED, listened as UPDATES_RESTART, the store reads os/pid and sends os/kill TERM to its own pid, so the process exits and its service manager starts it again on the new orb), and an error alert for a failed run or a failed read; no record draws nothing. A run asked while another is in flight answers UPDATES_RUN_FAILED at once.",

package/behaviors/lolo/dev/atoms/std-orb-stats.lolo

@@ -1,6 +1,6 @@
 app std-orb-stats [
   version: "1.0.0",
-  exec: ["orb", "ps"],
+  exec: [exe, "orb", "ps"],
   env: ["PATH", "HOME"],
   description: "std-orb-stats — what the orb running this program reports about itself. ORB_STATS_ASK reads the kernel's counters with program/inputs { stats: true } (registeredSchemas, registeredTraits, activeInstances, cachedEntities) and answers ORB_KERNEL_READ { registeredSchemas, registeredTraits, activeInstances, cachedEntities }; every ask also reads the uptime of the orb process: os/pid gives the host process id and `ps -o etime= -p <pid>` runs through std-cli (the ps on PATH), its [[dd-]hh:]mm:ss answer is parsed to milliseconds and answered as ORB_UPTIME_READ { uptimeMs }, so the figure is the process's, not the session's or the first ask's; the first ask also runs `orb --version` through std-cli (the orb on PATH) and answers ORB_VERSION_READ { version } with the output trimmed; the version is read once per mount, and every later ask answers ORB_VERSION_READ again with it, so a client that joined later still gets it. A kernel read that the host refuses, a version run that exits non-zero or cannot start, a pid the host cannot give, a ps run that exits non-zero or cannot start, or an elapsed time that is not that format, answers ORB_STATS_FAILED { stat, code, error } (stat kernel, version or process-uptime) and the other stats are still answered. Subject-agnostic: it knows nothing of who asks.",
   egress: []

package/behaviors/lolo/dev/organisms/std-launchpad.lolo

@@ -3,7 +3,7 @@ app std-launchpad [
   theme: "linear-clean-light",
   locales: [en, ar, sl],
   themes: ["linear-clean-dark", "almadar-light", "almadar-dark", "minimalist-light", "minimalist-dark", "notion-editorial-light", "swiss-light", "bloomberg-dense-dark", "terminal-dark", "game-sci-fi-dark"],
-  exec: ["orb", "ps", "aws", "bq", "gcloud", "gh", "ssh", "kill"],
+  exec: [exe, "orb", "ps", "aws", "bq", "gcloud", "gh", "ssh", "kill"],
   kernel: { "guest": [spawn] },
   env: ["PATH", "HOME", "FIREBASE_AUTH_EMULATOR_HOST", "ALMADAR_PERSONA_OWNS", "ALMADAR_VECTORS_DIR", "EMBEDDING_PROVIDER", "EMBEDDING_API_KEY", "OPENAI_API_KEY", "OPEN_ROUTER_API_KEY", "EMBEDDING_MODEL", "LMSTUDIO_EMBEDDING_MODEL"],
   sys: [memory, cpu, self-signal],

package/behaviors/lolo/spec/cli/orb-packages.lolo

@@ -1,6 +1,6 @@
 app orb-packages-spec [
   version: "1.0.0",
-  description: "Design contract for `orb add|update|remove|list [--global]` and `orb engines add|update|remove|list`, the client of the npm registry. Golden = orbital-cli packages.rs and engines_cmd.rs today; the change is that a package is installed at one exact version from its npm tarball and the lockfile {name, version, url, integrity} replaces bun (ranges are refused with ORB_PACKAGE_RANGE). Tarballs are valid sources only under the registry knob (default https://registry.npmjs.org; the origin the composed std-http-client trait is configured with, its host a net grant) or the sourceOrigin knob; any other host is refused ORB_PACKAGE_SOURCE. A name resolves through the registry knob: GET /<name> (the packument, slash encoded %2f) for update, GET /<name>/<version> for add. Integrity is dist.integrity, `sha512-` plus the base64 sha512 of the downloaded gzip tarball; a mismatch installs nothing. The tarball is gunzipped and read as ustar by the kernel (a codec refusal is ORB_PACKAGE_ARCHIVE (<code>)), every entry must sit under package/ (ORB_PACKAGE_LAYOUT), the files are written into node_modules/.orb-staging/<name>@<version>, the old package is removed, the staging directory is renamed into place and only then is the lock entry recorded and the lockfile written. A package kind is read from its package.json: orbLanguage = language, orb = behaviors, orbVocabulary = language pack, orbProgram.kind shell|desktop = shell|desktop; no kind is refused ORB_PACKAGE_NOT_ORB with `<name>: not an orb package (its package.json declares none of orbLanguage, orb, orbVocabulary, orbProgram)`. add: installs, then checks each named or newly appeared package; a clean one prints `added <name>@<version> (<kinds joined by , >)`; one that declares no kind or does not load is refused and, if this call added it, removed again; any refusal fails with `not added:` and one indented `<name>: <problem>` line per refusal; an install that yields no package fails `installed nothing for <specs>`. update: resolves every non-linked orb package and every missing baseline package (the `baseline` knob: {name, registry} entries; core, std, the language packs, the typescript shell) like an upgrade from nothing, moving each to the highest non-deprecated stable version by semver order that is language-compatible (core: its orbLanguage.version satisfies the range this orb reads; every other package: its language range, orb, orbLanguage, orbVocabulary or orbProgram .language, the first present in the packument, is satisfied by the target core language, the orbLanguage.version of the core version this update installs, else of the installed core; core resolves first); a missing baseline package with no compatible version fails the update (the range this orb reads is the R of the `orb X.Y.Z (language R)` answer of `orb --version`, any other answer refuses the update; checks use std-semver; a version whose manifest records no language is treated as incompatible, never guessed, and named on stderr as `<name>@<version>: ORB_PACKAGE_NO_LANGUAGE (...)`, an unsatisfied one as `ORB_PACKAGE_INCOMPATIBLE`, only for versions newer than the installed one), written exact into the lockfile (a workspace-linked package is never updated), prints the list rows and, after them, one `<severity> update: <name> <from> → <to>: <advisory>` line for every applied version whose registry manifest carries orbRelease severity security or critical, removes again what this call added and does not load, records the update check, and fails `these packages do not load for this orb:` with one indented `<name>: <problem>` line each. update --global also keeps this host's orb binary package installed (the orbPlatforms knob maps the os/uname sysname and machine to @almadar/orb-darwin-arm64, -darwin-x64, -linux-x64, -linux-arm64 or -windows-x64), resolved like a baseline package in the registry knob but on its own compatibility rule: an orb platform package has no language range, so its newest stable, non-deprecated version is taken whose package.json declares orbReads, a range of core languages the target core language satisfies (no orbReads: skipped ORB_PACKAGE_NO_LANGUAGE; its orb and orbProgram blocks are not read); a package declaring orbReads is listed with kind `orb`; a host with no matching entry or whose os/uname fails gets one ORB_PACKAGE_PLATFORM line on stderr and no orb package is considered (the Windows host does not implement os/uname today). update --urgent (update only; any other command is refused with the usage line): every version may carry a top-level orbRelease { severity security|critical|normal, advisory (one line), fixes (a semver range of earlier versions it fixes) } in its registry manifest (none, or an unknown severity word, is normal); a package is urgent when a stable, non-deprecated version newer than the installed one is security or critical, declares fixes, the installed version satisfies fixes (std-semver) and the version passes the language check above; only urgent packages are updated, to the newest such version, through the same integrity check, staging swap and lockfile write; a baseline package that is not installed is never urgent; stdout is only the applied `<severity> update:` lines; an urgent version that fails the language check (ORB_PACKAGE_INCOMPATIBLE or ORB_PACKAGE_NO_LANGUAGE), whose fixes range std-semver refuses (ORB_PACKAGE_RELEASE), or whose download, integrity or install fails is not applied: the installed version stays, the call answers 500 and stderr names each refusal and each confirmed-urgent advisory, the vulnerable version is never replaced by a half-written one. remove: a workspace-linked package is refused ORB_PACKAGE_LINKED and its link is never deleted; a behavior package whose prefix a .lolo or .orb file still imports (skipping node_modules, .git, dist, target) is refused `refusing to remove '<name>': N file(s) still import '<prefix>/':` plus the files, one per line; otherwise prints `removed <name>` per name. list: one row per installed orb package, sorted by name, columns package (34), version (12), kinds joined by `, ` (26), then `ok` or the problem, ` (linked)` for a workspace link, and ` [<prefix>/, N behaviors]` for a behavior package; --json prints the rows { package, kinds, version, path, link, prefix?, behaviors?, problem } as pretty JSON; with no rows the table is empty and stderr says `orb: nothing is installed in <dir> (no @almadar/core or @almadar/std); run `orb update --global` to set the language up`. Without --global the project directory is used, falling back to the user store when there is no project. Engines: `engines add|update` install the pinned runtime-verify/compiled engine packages at the exact pinned version (`installed <package>@<version> (entry <bin> → <path>)`; a wrong version fails `<package>: expected version <v>, got <w>`, a missing bin entry `<package>: installed package has no `<bin>` bin entry`, a package not found after install `<package>: install reported success but the package was not found`), update prints `updated <package>: <old> → <new>` or `<package>@<old> already up to date` or `installed <package>@<version>`, remove prints `removed <package>`, list prints rows engine (16), package (32), version (12), link (6), path, or `not installed — <hint>`, --json the rows { engine, package, version, entry, path, installed, link }."
+  description: "Design contract for `orb add|update|remove|list [--global]` and `orb engines add|update|remove|list`, the client of the npm registry. Golden = orbital-cli packages.rs and engines_cmd.rs today; the change is that a package is installed at one exact version from its npm tarball and the lockfile {name, version, url, integrity} replaces bun (ranges are refused with ORB_PACKAGE_RANGE). Tarballs are valid sources only under the registry knob (default https://registry.npmjs.org; the origin the composed std-http-client trait is configured with, its host a net grant) or the sourceOrigin knob; any other host is refused ORB_PACKAGE_SOURCE. A name resolves through the registry knob: GET /<name> (the packument, slash encoded %2f) for update, GET /<name>/<version> for add. Integrity is dist.integrity, `sha512-` plus the base64 sha512 of the downloaded gzip tarball; a mismatch installs nothing. The tarball is gunzipped and read as ustar by the kernel (a codec refusal is ORB_PACKAGE_ARCHIVE (<code>)), every entry must sit under package/ (ORB_PACKAGE_LAYOUT), the files are written into node_modules/.orb-staging/<name>@<version>, the old package is removed, the staging directory is renamed into place and only then is the lock entry recorded and the lockfile written. A package kind is read from its package.json: orbLanguage = language, orb = behaviors, orbVocabulary = language pack, orbProgram.kind shell|desktop = shell|desktop; no kind is refused ORB_PACKAGE_NOT_ORB with `<name>: not an orb package (its package.json declares none of orbLanguage, orb, orbVocabulary, orbProgram)`. add: installs, then checks each named or newly appeared package; a clean one prints `added <name>@<version> (<kinds joined by , >)`; one that declares no kind or does not load is refused and, if this call added it, removed again; any refusal fails with `not added:` and one indented `<name>: <problem>` line per refusal; an install that yields no package fails `installed nothing for <specs>`. update: resolves every non-linked orb package and every missing baseline package (the `baseline` knob: {name, registry} entries; core, std, the language packs, the typescript shell) like an upgrade from nothing, moving each to the highest non-deprecated stable version by semver order that is language-compatible (core: its orbLanguage.version satisfies the range this orb reads; every other package: its language range, orb, orbLanguage, orbVocabulary or orbProgram .language, the first present in the packument, is satisfied by the target core language, the orbLanguage.version of the core version this update installs, else of the installed core; core resolves first); a missing baseline package with no compatible version fails the update (the range this orb reads is the R of the `orb X.Y.Z (language R)` answer of `orb --version`, any other answer refuses the update; checks use std-semver; a version whose manifest records no language is treated as incompatible, never guessed, and named on stderr as `<name>@<version>: ORB_PACKAGE_NO_LANGUAGE (...)`, an unsatisfied one as `ORB_PACKAGE_INCOMPATIBLE`, only for versions newer than the installed one), written exact into the lockfile (a workspace-linked package is never updated), prints the list rows and, after them, one `<severity> update: <name> <from> → <to>: <advisory>` line for every applied version whose registry manifest carries orbRelease severity security or critical, removes again what this call added and does not load, records the update check, and fails `these packages do not load for this orb:` with one indented `<name>: <problem>` line each. update --global also keeps this host's orb binary package installed (the orbPlatforms knob maps the os/uname sysname and machine to @almadar/orb-darwin-arm64, -darwin-x64, -linux-x64, -linux-arm64 or -windows-x64), resolved like a baseline package in the registry knob but on its own compatibility rule: an orb platform package has no language range, so its newest stable, non-deprecated version is taken whose package.json declares orbReads, a range of core languages the target core language satisfies (no orbReads: skipped ORB_PACKAGE_NO_LANGUAGE; its orb and orbProgram blocks are not read); a package declaring orbReads is listed with kind `orb`; a host with no matching entry or whose os/uname fails gets one ORB_PACKAGE_PLATFORM line on stderr and no orb package is considered (the Windows host does not implement os/uname today). A package whose package.json declares orbProgram also installs each of its optionalDependencies at its exact version whose registry manifest os and cpu include this host's (the os and cpu of the orbPlatforms entry os/uname matched, the npm platform rule; every add and update asks os/uname); a host os/uname cannot place installs none of them. Every file the package.json bin map names is written executable. update --urgent (update only; any other command is refused with the usage line): every version may carry a top-level orbRelease { severity security|critical|normal, advisory (one line), fixes (a semver range of earlier versions it fixes) } in its registry manifest (none, or an unknown severity word, is normal); a package is urgent when a stable, non-deprecated version newer than the installed one is security or critical, declares fixes, the installed version satisfies fixes (std-semver) and the version passes the language check above; only urgent packages are updated, to the newest such version, through the same integrity check, staging swap and lockfile write; a baseline package that is not installed is never urgent; stdout is only the applied `<severity> update:` lines; an urgent version that fails the language check (ORB_PACKAGE_INCOMPATIBLE or ORB_PACKAGE_NO_LANGUAGE), whose fixes range std-semver refuses (ORB_PACKAGE_RELEASE), or whose download, integrity or install fails is not applied: the installed version stays, the call answers 500 and stderr names each refusal and each confirmed-urgent advisory, the vulnerable version is never replaced by a half-written one. remove: a workspace-linked package is refused ORB_PACKAGE_LINKED and its link is never deleted; a behavior package whose prefix a .lolo or .orb file still imports (skipping node_modules, .git, dist, target) is refused `refusing to remove '<name>': N file(s) still import '<prefix>/':` plus the files, one per line; otherwise prints `removed <name>` per name. list: one row per installed orb package, sorted by name, columns package (34), version (12), kinds joined by `, ` (26), then `ok` or the problem, ` (linked)` for a workspace link, and ` [<prefix>/, N behaviors]` for a behavior package; --json prints the rows { package, kinds, version, path, link, prefix?, behaviors?, problem } as pretty JSON; with no rows the table is empty and stderr says `orb: nothing is installed in <dir> (no @almadar/core or @almadar/std); run `orb update --global` to set the language up`. Without --global the project directory is used, falling back to the user store when there is no project. Engines: `engines add|update` install the pinned runtime-verify/compiled engine packages at the exact pinned version (`installed <package>@<version> (entry <bin> → <path>)`; a wrong version fails `<package>: expected version <v>, got <w>`, a missing bin entry `<package>: installed package has no `<bin>` bin entry`, a package not found after install `<package>: install reported success but the package was not found`), update prints `updated <package>: <old> → <new>` or `<package>@<old> already up to date` or `installed <package>@<version>`, remove prints `removed <package>`, list prints rows engine (16), package (32), version (12), link (6), path, or `not installed — <hint>`, --json the rows { engine, package, version, entry, path, installed, link }."
 ]
 
 type PackageKind = "language" | "behaviors" | "language pack" | "shell" | "desktop" | "orb"