@almadar/std 17.0.3 → 17.1.0

package/behaviors/lolo/auth/atoms/std-dev-personas.lolo

@@ -42,9 +42,17 @@ orbital DevPersonasOrbital {
       INIT -> ready when (!= @config.autoSignIn "")
         (os/getenv "FIREBASE_AUTH_EMULATOR_HOST" { key: "auto" emit: { success: AUTO_HOST failure: AUTO_FAILED } })
       AUTO_HOST -> ready when (= (default @payload.value "") @config.authEmulatorHost)
-        (emit TOKEN_MINT { key: @config.autoSignIn, purpose: "sign-in" })
+        (fetch DevPersona { limit: @config.maxRows emit: { success: AUTO_ROWS failure: AUTO_ROWS_FAILED } })
       AUTO_HOST -> ready when (!= (default @payload.value "") @config.authEmulatorHost)
       AUTO_FAILED -> ready
+      AUTO_ROWS -> ready
+        (emit AUTO_RESOLVED { id: (let ((byId (array/find @payload.data (fn r (= (default @r.id "") @config.autoSignIn)))) (byRole (array/find @payload.data (fn r (= (default @r.role "") @config.autoSignIn))))) (default (object/get (default @byId (default @byRole {})) "id") "")) })
+      AUTO_RESOLVED -> ready when (!= @payload.id "")
+        (emit TOKEN_MINT { key: @payload.id, purpose: "sign-in" })
+      AUTO_RESOLVED -> ready when (= @payload.id "")
+        (emit PERSONA_SIGN_IN_REFUSED { error: (str/concat "persona sign-in refused: no identity row has the id or the role " @config.autoSignIn), kind: "no-persona" })
+      AUTO_ROWS_FAILED -> ready
+        (emit PERSONA_SIGN_IN_REFUSED { error: (str/concat "persona sign-in refused: the identity rows could not be read to resolve " @config.autoSignIn ": " (default @payload.error "")), kind: "no-persona" })
       TOKEN_MINT -> ready
         (emit TOKEN_MINTED { key: @payload.key, purpose: @payload.purpose, token: (str/concat (str/replace-pattern (str/replace-pattern (str/replace-pattern (base64/encode (json/stringify { alg: "none", typ: "JWT" })) "\\+" "-") "/" "_") "=+$" "") "." (str/replace-pattern (str/replace-pattern (str/replace-pattern (base64/encode (json/stringify { aud: (if (!= @config.emulatorAudience "") @config.emulatorAudience @config.projectId), iat: (time/diff @now @config.epoch "s"), exp: (+ (time/diff @now @config.epoch "s") 3600), iss: (if (!= @config.emulatorIssuer "") @config.emulatorIssuer (str/concat "https://securetoken.google.com/" @config.projectId)), sub: @payload.key, uid: @payload.key })) "\\+" "-") "/" "_") "=+$" "") ".") })
       ANSWER_TOKEN_MINT -> ready
@@ -221,6 +229,23 @@ orbital DevPersonasOrbital {
       }
         @description "Internal: the environment could not be read at a session's start; the session stays as it is."
         @tier "internal"
+      AUTO_ROWS -> internal {
+        data : [DevPersona]!
+        totalCount : number!
+      }
+        @description "Internal: the identity rows read to resolve autoSignIn at a session's start."
+        @tier "internal"
+      AUTO_ROWS_FAILED -> internal {
+        error : string
+        code : string
+      }
+        @description "Internal: the identity rows could not be read to resolve autoSignIn."
+        @tier "internal"
+      AUTO_RESOLVED -> internal {
+        id : string!
+      }
+        @description "Internal: the id of the identity row autoSignIn resolved to (an id match, else the first row of that role), or empty when none matched."
+        @tier "internal"
       ACT_AS_HOST -> internal {
         value : string
         key : string
@@ -311,7 +336,7 @@ orbital DevPersonasOrbital {
         @tier "infra"
       autoSignIn : string = ""
         @label "Auto sign-in persona"
-        @description "A persona id; empty signs nobody in. A new session of an app running against the Auth emulator (FIREBASE_AUTH_EMULATOR_HOST equal to authEmulatorHost) signs in as this persona at its start: the persona's unsigned emulator token goes through jws/verify (allowUnsigned, the emulator issuer knob) and identity/sign-in, the same path as the persona picker. Never signs in anywhere else."
+        @description "The ALMADAR_PERSONA spec of the persona to sign in as: an identity row id, else the first row whose role is this value; empty signs nobody in. A new session of an app running against the Auth emulator (FIREBASE_AUTH_EMULATOR_HOST equal to authEmulatorHost) reads the identity rows at its start, resolves the spec and signs in as that row: its unsigned emulator token goes through jws/verify (allowUnsigned, the emulator issuer knob) and identity/sign-in, the same path as the persona picker. A spec no row matches answers PERSONA_SIGN_IN_REFUSED naming it and leaves the session signed out. Never signs in anywhere else."
         @synonyms "default persona, dev user, emulator user"
         @tier "policy"
       emulatorIssuer : string = ""

package/behaviors/lolo/cli/atoms/std-orb-goldens.lolo

@@ -2,7 +2,7 @@ app std-orb-goldens [
   version: "1.0.0",
   inbound: ["cli-goldens"],
   fs: { cwd: "**": [read], "/**": [read] },
-  description: "std-orb-goldens — the `orb goldens <file.goldens.json>` command, the parity-golden replay as a std program. The file names an atom (a path under the std lolo root, resolved three levels above the file: spec/<topic>/<file>), a default trait and cases; each case is a list of steps { trait, from, event, payload, expect { fired, state, emits [{ event, payload }], neverEmits [event] } }. It reads the file and the atom (os/read-file, program/read) and plays each case's steps in ONE program/step call, a fresh kernel per case. An expected emit matches the emit at the same position by event name and by every payload key it names (a nested value compares whole). One line per case, `pass` or `fail`, the unmet expectations indented under a fail, then `N passed, M failed`; status 200 (exit 0) when none failed, else 500 (exit 1); usage status 400 (exit 2); a failed read, parse or step answers 500 with its error. An expect may carry emitCounts ({ EVENT: n }, the event is emitted exactly n times in the step; 0 means never) and exactEmits, the step's complete ordered emit list: it must have as many emits as the step produced and each, in position, must match by event name and the payload keys it names, so an early incomplete emit is not masked by a later full one. A case is checked against the schema before it is played: an unknown case, step or expect key (note and golden are doc-only case strings, never asserted) each fail the case with a message. An expect.entity names fields of the step's row after its effects (program/step's result.entityAfter); each named key must be present and equal whole (a nested value compares whole), and a step answer with no row fails each named key. A case entity seeds the first step and a step entity seeds that step, through program/step's per-request entity; now is forwarded likewise, and a case config sets the knobs of the default trait on each of its steps. When a case fails, the failure also names each trait that fired in a step's cascade (other than the step's own trait) which no earlier step of the case plays and the case's `defaults` (a list of trait names that run on their entity defaults on purpose) does not list; a passing case is never annotated. A case credentials map (credential name to value) is test-only: the replay holds those credentials for each step of the case, answering the kernel's credential asks, and they are never journaled or printed; a name the map does not give is not held."
+  description: "std-orb-goldens — the `orb goldens <file.goldens.json>` command, the parity-golden replay as a std program. The file names an atom (a path under the std lolo root, resolved three levels above the file: spec/<topic>/<file>), a default trait and cases; each case is a list of steps { trait, from, event, payload, expect { fired, state, emits [{ event, payload }], neverEmits [event] } }. It reads the file and the atom (os/read-file, program/read) and plays each case's steps in ONE program/step call, a fresh kernel per case. An expected emit matches the emit at the same position by event name and by every payload key it names (a nested value compares whole). One line per case, `pass` or `fail`, the unmet expectations indented under a fail, then `N passed, M failed`; status 200 (exit 0) when none failed, else 500 (exit 1); usage status 400 (exit 2); a failed read, parse or step answers 500 with its error. An expect may carry emitCounts ({ EVENT: n }, the event is emitted exactly n times in the step; 0 means never) and exactEmits, the step's complete ordered emit list: it must have as many emits as the step produced and each, in position, must match by event name and the payload keys it names, so an early incomplete emit is not masked by a later full one. A case is checked against the schema before it is played: an unknown case, step or expect key (note and golden are doc-only case strings, never asserted) each fail the case with a message. An expect.entity names fields of the step's row after its effects (program/step's result.entityAfter); each named key must be present and equal whole (a nested value compares whole), and a step answer with no row fails each named key. A case entity seeds the first step and a step entity seeds that step, through program/step's per-request entity; now is forwarded likewise, and a case config sets the knobs of the default trait on each of its steps. When a case fails, the failure also names each trait that fired in a step's cascade (other than the step's own trait) which no earlier step of the case plays and the case's `defaults` (a list of trait names that run on their entity defaults on purpose) does not list; a passing case is never annotated. A step answers list ({ operator, ok } or { operator, error: { kind, message } }) is the host's plain answers to that step's os asks, forwarded to program/step, so the kernel unwraps, mints and routes them as it does live: a sealed handle is minted, never fed. A case credentials map (credential name to value) is test-only: the replay holds those credentials for each step of the case, answering the kernel's credential asks, and they are never journaled or printed; a name the map does not give is not held."
 ]
 uses Spec from "almadar-std/orb-goldens"
 type OrbCommandArgs = { argv : [string]!, cwd : string! }
@@ -12,7 +12,9 @@ type GoldenEmit = { event : string!, payload : GoldenPayload, optionsAt : number
 type GoldenEmitted = { type : string!, payload : GoldenPayload }
 type GoldenExpect = { fired : boolean, state : string, emits : [GoldenEmit], neverEmits : [string], exactEmits : [GoldenEmit], emitCounts : Map string number, effects : [GoldenPayload], rendered : [GoldenPayload], entity : GoldenPayload }
 type GoldenIdentity = Map string GoldenValue?
-type GoldenStep = { keep : string, keepField : string, now : number | string, identity : GoldenPayload?, entity : GoldenPayload, trait : string, orbital : string, from : string, event : string!, payload : GoldenPayload, options : GoldenPayload, expect : GoldenExpect }
+type GoldenAnswerError = { kind : string!, message : string! }
+type GoldenAnswer = { operator : string!, ok : GoldenValue?, error : GoldenAnswerError }
+type GoldenStep = { answers : [GoldenAnswer], keep : string, keepField : string, now : number | string, identity : GoldenPayload?, entity : GoldenPayload, trait : string, orbital : string, from : string, event : string!, payload : GoldenPayload, options : GoldenPayload, expect : GoldenExpect }
 type GoldenCase = { note : string, golden : string, skip : string, entity : GoldenPayload, config : GoldenPayload, credentials : Map string string, defaults : [string], now : number | string, id : string!, steps : [GoldenStep]! }
 type GoldenFile = { atom : string!, trait : string!, orbital : string, cases : [GoldenCase]! }
 type GoldenFull = { orbitals : [orbital] }
@@ -131,7 +133,7 @@ orbital GoldensOrbital {
           (array/map (array/filter (object/keys @cc) (fn k (not (array/includes ["skip", "entity", "config", "credentials", "defaults", "now", "id", "steps", "note", "golden"] @k)))) (fn k (str/concat "unknown case key: " @k)))
           (array/flatten (array/reduce (object/get @cc "steps") [] (fn acc s
             (array/append @acc (array/concat
-              (array/map (array/filter (object/keys @s) (fn k (not (array/includes ["keep", "keepField", "now", "identity", "entity", "trait", "orbital", "from", "event", "payload", "options", "expect"] @k)))) (fn k (str/concat "step " (array/len @acc) ": unknown step key: " @k)))
+              (array/map (array/filter (object/keys @s) (fn k (not (array/includes ["answers", "keep", "keepField", "now", "identity", "entity", "trait", "orbital", "from", "event", "payload", "options", "expect"] @k)))) (fn k (str/concat "step " (array/len @acc) ": unknown step key: " @k)))
               (array/map (array/filter (object/keys (object/get @s "expect" {})) (fn k (not (array/includes ["fired", "state", "emits", "neverEmits", "exactEmits", "emitCounts", "effects", "rendered", "entity"] @k)))) (fn k (str/concat "step " (array/len @acc) ": unknown expect key: " @k)))
               (if (object/has @s "options")
                 (let ((op (as (object/get @s "options") GoldenPayload)))
@@ -168,6 +170,7 @@ orbital GoldensOrbital {
                 (if (or (= @seed null) (= (array/len (object/keys @seed)) 0)) {} { entity: @seed }))
               (if (object/has @s "now") { now: (object/get @s "now") } (if (object/has @cc "now") { now: (object/get @cc "now") } {}))
               (if (object/has @s "identity") { identity: (object/get @s "identity") } {})
+              (if (object/has @s "answers") { answers: (object/get @s "answers") } {})
               (if (and (object/has @cc "config") (= (object/get @s "trait" (object/get @gf "trait")) (object/get @gf "trait"))) { config: (object/get @cc "config") } {})
               (if (object/has @cc "credentials") { credentials: (object/get @cc "credentials") } {}))))))
           { key: "steps" emit: { success: GOLDENS_STEPPED, failure: GOLDENS_CASE_FAILED } render: (array/some (object/get @entity.curCase "steps") (fn s (= (object/get (default (as (object/get @s "options" {}) GoldenPayload) {}) "render") true))) renderProps: (array/some (object/get @entity.curCase "steps") (fn s (= (object/get (default (as (object/get @s "options" {}) GoldenPayload) {}) "renderProps") true))) live: (array/some (object/get @entity.curCase "steps") (fn s (= (object/get (default (as (object/get @s "options" {}) GoldenPayload) {}) "live") true))) })

package/behaviors/lolo/cli/atoms/std-orb-lint-mem-handles.lolo

@@ -4,7 +4,7 @@ app std-orb-lint-mem-handles [
   env: ["PATH"],
   exec: [exe],
   fs: { cwd: "**": [read], "/**": [read], "~/.orb/node_modules/**": [read] },
-  description: "std-orb-lint-mem-handles — the `orb lint mem-handles <file>` command, the typestate check of EXEC-METAL-3 over a trait's transition graph. It lowers the file with program/read and, for every inline trait that calls a mem/ operator, walks the graph (transition = edge from each `from` state to its `to` state, guards ignored, so every written path counts) carrying the set of handle facts true on some path into each state until nothing changes. HANDLE SOURCE: a handle is named only by the exact argument `@entity.<field>` (or, inside one transition, `@payload.<field>`); an argument that is anything else (a let binding, a computed value, an array element) is skipped, no finding. A handle enters a field only where a transition sets `@entity.<f>` from `@payload.arena`, `@payload.block` or `@payload.borrow` (the documented success payloads of mem/arena-new, mem/alloc and mem/borrow); any other `set @entity.<f>` rebinds f and forgets what was known of it. Order inside one effect or guard is its pre-order, mem calls before the sets nested in the same top-level effect. ORB_MEM_USE_AFTER_FREE: a mem/ call taking the handle (alloc, borrow, write, read, read-uint, length) on a path after mem/free, mem/arena-drop or mem/release of the same source. ORB_MEM_DOUBLE_FREE: a second mem/free, mem/arena-drop or mem/release of the same source on a path; dropping an arena also kills every block field the trait allocated from that arena field (the link is a mem/alloc whose success route sets that field from `@payload.block`), so a later free of such a block is a double free. ORB_MEM_ALIAS: a mem/borrow with the literal mode \"exclusive\" of a block source while a borrow of that source is live, or any borrow while an exclusive one is live; a borrow is live from the transition that sets its field from `@payload.borrow` (the borrow effect's success route; the field must be set by exactly one borrow call's route, else it is untracked) until mem/release of that field, and two borrow calls of one source inside one transition conflict at once. ORB_MEM_LEAK: a mem/arena-new whose arena is stored in an entity field (success route sets it from `@payload.arena`) and reaches a RESTING state of the trait without mem/arena-drop of that field on some path; RESTING means the trait's initial state or a state with no transition to a different state. A `stack` arena (literal kind) dies with its dispatch and is never a leak. Not tracked: handles outside the file's inline traits (composed `uses` traits are their own file's), handles passed through a payload, a let or an emit, and arenas overwritten without a drop. Clean answers `lint mem-handles: clean` (status 200, exit 0); findings are status 500, exit 1. Anything but one file argument is the usage (status 400, exit 2); an unreadable or unlowerable file is status 500."
+  description: "std-orb-lint-mem-handles — the `orb lint mem-handles <file>` command, the typestate check of EXEC-METAL-3 and EXEC-GPU-5. The vocabulary is the `families` config (mem/ and gpu/ by default); the prose below describes the mem family, and the gpu family reuses the use-after-end, double-end and resting-state leak rules with its own ops (ORB_GPU_USE_AFTER_RELEASE, ORB_GPU_LEAK). The alias rule is mem-only. Over a trait's transition graph. It lowers the file with program/read and, for every inline trait that calls a mem/ operator, walks the graph (transition = edge from each `from` state to its `to` state, guards ignored, so every written path counts) carrying the set of handle facts true on some path into each state until nothing changes. HANDLE SOURCE: a handle is named only by the exact argument `@entity.<field>` (or, inside one transition, `@payload.<field>`); an argument that is anything else (a let binding, a computed value, an array element) is skipped, no finding. A handle enters a field only where a transition sets `@entity.<f>` from `@payload.arena`, `@payload.block` or `@payload.borrow` (the documented success payloads of mem/arena-new, mem/alloc and mem/borrow); any other `set @entity.<f>` rebinds f and forgets what was known of it. Order inside one effect or guard is its pre-order, mem calls before the sets nested in the same top-level effect. ORB_MEM_USE_AFTER_FREE: a mem/ call taking the handle (alloc, borrow, write, read, read-uint, length) on a path after mem/free, mem/arena-drop or mem/release of the same source. ORB_MEM_DOUBLE_FREE: a second mem/free, mem/arena-drop or mem/release of the same source on a path; dropping an arena also kills every block field the trait allocated from that arena field (the link is a mem/alloc whose success route sets that field from `@payload.block`), so a later free of such a block is a double free. ORB_MEM_ALIAS: a mem/borrow with the literal mode \"exclusive\" of a block source while a borrow of that source is live, or any borrow while an exclusive one is live; a borrow is live from the transition that sets its field from `@payload.borrow` (the borrow effect's success route; the field must be set by exactly one borrow call's route, else it is untracked) until mem/release of that field, and two borrow calls of one source inside one transition conflict at once. ORB_MEM_LEAK: a mem/arena-new whose arena is stored in an entity field (success route sets it from `@payload.arena`) and reaches a RESTING state of the trait without mem/arena-drop of that field on some path; RESTING means the trait's initial state or a state with no transition to a different state. A `stack` arena (literal kind) dies with its dispatch and is never a leak. Not tracked: handles outside the file's inline traits (composed `uses` traits are their own file's), handles passed through a payload, a let or an emit, and arenas overwritten without a drop. Clean answers `lint mem-handles: clean` (status 200, exit 0); findings are status 500, exit 1. Anything but one file argument is the usage (status 400, exit 2); an unreadable or unlowerable file is status 500."
 ]
 uses Spec from "almadar-std/lint-mem-handles"
 type OrbCommandArgs = { argv : [string]!, cwd : string! }
@@ -12,7 +12,8 @@ type MhValue = string | number | boolean | [MhValue?] | Map string MhValue?
 type MhCall = [MhValue?]
 type MhEmit = { success : string! }
 type MhOpts = { emit : MhEmit! }
-type MhOp = { k : string!, j : number!, at : string!, h : string!, src : string!, key : string!, lit : string!, ev : string!, f : string!, v : string! }
+type MhOp = { k : string!, j : number!, at : string!, h : string!, src : string!, key : string!, lit : string!, ev : string!, f : string!, v : string!, cmd : string! }
+type MhBody = Map string MhValue?
 type MhT = { j : number!, ev : string!, to : string!, from : [string]!, ops : [MhOp]! }
 type MhLink = { f : string!, h : string!, tgt : string! }
 type MhAcc = { s : [string]!, f : [OrbFinding]! }
@@ -29,7 +30,8 @@ type OrbFinding = { code : string!, path : string!, message : string!, suggestio
 type GtCallHit = { path : string, node : GtVal?, at : number }
 type GtVal = string | number | boolean | [GtVal?] | Map string GtVal?
 type LintCodeDecl = { code : string!, category : string!, description : string! }
-type LintMemHandlesCodes = { useAfterFree : LintCodeDecl, doubleFree : LintCodeDecl, alias : LintCodeDecl, leak : LintCodeDecl , lintIndexMissing : LintCodeDecl }
+type LintMemHandlesCodes = { useAfterFree : LintCodeDecl, doubleFree : LintCodeDecl, alias : LintCodeDecl, leak : LintCodeDecl, gpuUseAfterRelease : LintCodeDecl, gpuLeak : LintCodeDecl, lintIndexMissing : LintCodeDecl }
+type LintHandleFamily = { name : string!, prefix : string!, handleFields : [string]!, ends : [string]!, endedText : string!, mintText : string!, useAfterKey : string!, doubleKey : string!, leakOp : string!, leakField : string!, leakEnd : string!, leakExempt : [string]!, leakNoun : string!, leakVerb : string!, leakKey : string!, allocOp : string!, allocField : string!, borrowOp : string!, borrowField : string!, releaseOp : string!, cmdOp : string!, cmdPos : number!, cmdKeys : [string]!, cmdListKeys : [string]! }
 
 orbital OrbLintMemHandlesOrbital {
   uses Input from "std/behaviors/std-orb-lint-input"
@@ -55,7 +57,9 @@ orbital OrbLintMemHandlesOrbital {
       LINT_INPUT -> ready
         (set @entity.scope @payload.scope)
         (set @entity.findings (if (and @entity.sitesCallsHeard (= @entity.sitesCallsScope @payload.scope))
-(let ((orbitals (object/get @payload.program "orbitals" [])) (memHits : [GtCallHit] (array/flatten (array/map (array/filter (object/keys @entity.sCalls) (fn h (str/startsWith @h "mem/"))) (fn h (object/get @entity.sCalls @h []))))))
+(let ((orbitals (object/get @payload.program "orbitals" [])))
+          (array/flatten (array/map @config.families (fn fam (let ((pfx : string (object/get @fam "prefix")) (handleFields : [string] (object/get @fam "handleFields")) (ends : [string] (object/get @fam "ends")) (leakOp : string (object/get @fam "leakOp")) (leakField : string (object/get @fam "leakField")) (leakEnd : string (object/get @fam "leakEnd")) (leakExempt : [string] (object/get @fam "leakExempt")) (allocOp : string (object/get @fam "allocOp")) (allocField : string (object/get @fam "allocField")) (borrowOp : string (object/get @fam "borrowOp")) (borrowField : string (object/get @fam "borrowField")) (releaseOp : string (object/get @fam "releaseOp")) (cmdOp : string (object/get @fam "cmdOp")) (cmdPos : number (object/get @fam "cmdPos")) (cmdKeys : [string] (object/get @fam "cmdKeys")) (cmdListKeys : [string] (object/get @fam "cmdListKeys")))
+          (let ((endsText : string (str/concat (str/join (array/map (array/filter @ends (fn e (!= @e (default (array/last @ends) "")))) (fn e (str/concat "`" @e "`"))) ", ") " or `" (default (array/last @ends) "") "`")) (memHits : [GtCallHit] (array/flatten (array/map (array/filter (object/keys @entity.sCalls) (fn h (str/startsWith @h @pfx))) (fn h (object/get @entity.sCalls @h []))))))
           (array/flatten (array/map (array/range 0 (array/len @orbitals)) (fn oi
             (let ((orb (default (array/nth @orbitals @oi) {})))
               (array/flatten (array/map (array/range 0 (array/len (object/get @orb "traits" []))) (fn ti
@@ -78,27 +82,40 @@ orbital OrbLintMemHandlesOrbital {
                                     ops: (array/flatten (array/map @items (fn e
                                       (let ((nd (array/filter (array/map (json/nodes [@e]) (fn n (default (as @n MhCall) []))) (fn c (and (> (array/len @c) 0) (!= (as (array/first @c) string) null))))))
                                         (array/concat
-                                          (array/map (array/filter @nd (fn c (str/startsWith (default (as (array/first @c) string) "") "mem/"))) (fn c
+                                          (array/flatten (array/map (array/filter @nd (fn c (str/startsWith (default (as (array/first @c) string) "") @pfx))) (fn c
                                             (let ((hd : string (default (as (array/first @c) string) "")) (a0 : string (default (as (array/nth @c 1) string) "")) (a1 : string (default (as (array/nth @c 2) string) "")) (opt (as (array/last @c) MhOpts)))
-                                              { k: "mem", j: @j, at: @at, h: @hd, src: @a0, f: "", v: "",
-                                                key: (if (str/startsWith @a0 (str/concat @sig "entity.")) (str/slice @a0 8) (if (str/startsWith @a0 (str/concat @sig "payload.")) (str/concat "payload." (str/slice @a0 9)) "")),
-                                                lit: (if (= @hd "mem/arena-new") @a0 @a1),
-                                                ev: (if (= @opt null) "" (object/get (object/get @opt "emit") "success" "")) })))
+                                              (array/concat
+                                                [{ k: "call", j: @j, at: @at, h: @hd, src: @a0, f: "", v: "", cmd: "",
+                                                  key: (if (str/startsWith @a0 (str/concat @sig "entity.")) (str/slice @a0 8) (if (str/startsWith @a0 (str/concat @sig "payload.")) (str/concat "payload." (str/slice @a0 9)) "")),
+                                                  lit: (if (= @hd @leakOp) @a0 @a1),
+                                                  ev: (if (= @opt null) "" (object/get (object/get @opt "emit") "success" "")) }]
+                                                (if (or (= @cmdOp "") (!= @hd @cmdOp))
+                                                  []
+                                                  (array/flatten (array/map (default (as (array/nth @c (+ @cmdPos 1)) MhCall) []) (fn ent
+                                                    (let ((entm : MhBody (default (as @ent MhBody) {})))
+                                                      (array/flatten (array/map (object/keys @entm) (fn cn
+                                                        (let ((body : MhBody (default (as (object/get @entm @cn null) MhBody) {})))
+                                                          (array/flatten (array/map (array/concat @cmdKeys @cmdListKeys) (fn kk
+                                                            (let ((raw (object/get @body @kk null)))
+                                                              (array/map (array/filter (if (array/includes @cmdListKeys @kk) (default (as @raw MhCall) []) [@raw]) (fn r (str/startsWith (default (as @r string) "") (str/concat @sig "entity.")))) (fn r
+                                                                { k: "call", j: @j, at: @at, h: @hd, src: (default (as @r string) ""), f: "", v: "", lit: "", ev: "",
+                                                                  cmd: (str/concat @cn "." @kk),
+                                                                  key: (str/slice (default (as @r string) "") 8) }))))))))))))))))))))
                                           (array/map (array/filter @nd (fn c (and (= (default (as (array/first @c) string) "") "set") (> (array/len @c) 2) (str/startsWith (default (as (array/nth @c 1) string) "") (str/concat @sig "entity."))))) (fn c
-                                            { k: "set", j: @j, at: @at, h: "", src: "", key: "", lit: "", ev: "",
+                                            { k: "set", j: @j, at: @at, h: "", src: "", key: "", lit: "", ev: "", cmd: "",
                                               f: (str/slice (default (as (array/nth @c 1) string) "") 8),
                                               v: (default (as (array/nth @c 2) string) "") }))))))) }))))))
                         (if (not (array/some @perT (fn p (> (array/len (object/get @p "ops")) 0))))
                           []
-                          (let ((rows : [MhLink] (array/flatten (array/map (array/flatten (array/map @perT (fn p (array/filter (object/get @p "ops") (fn o (and (= (object/get @o "k") "mem") (!= (object/get @o "ev") "") (array/includes ["mem/alloc" "mem/borrow" "mem/arena-new"] (object/get @o "h")))))))) (fn o
-                                  (let ((want : string (if (= (object/get @o "h") "mem/alloc") (str/concat @sig "payload.block") (if (= (object/get @o "h") "mem/borrow") (str/concat @sig "payload.borrow") (str/concat @sig "payload.arena"))))
-                                        (tgt : string (if (= (object/get @o "h") "mem/borrow") (str/concat (object/get @o "key") "|" (object/get @o "lit")) (if (= (object/get @o "h") "mem/alloc") (object/get @o "key") (object/get @o "lit")))))
+                          (let ((rows : [MhLink] (array/flatten (array/map (array/flatten (array/map @perT (fn p (array/filter (object/get @p "ops") (fn o (and (= (object/get @o "k") "call") (!= (object/get @o "ev") "") (array/includes [@allocOp @borrowOp @leakOp] (object/get @o "h")) (array/includes @handleFields (if (= (object/get @o "h") @allocOp) @allocField (if (= (object/get @o "h") @borrowOp) @borrowField @leakField))))))))) (fn o
+                                  (let ((want : string (str/concat @sig "payload." (if (= (object/get @o "h") @allocOp) @allocField (if (= (object/get @o "h") @borrowOp) @borrowField @leakField))))
+                                        (tgt : string (if (= (object/get @o "h") @borrowOp) (str/concat (object/get @o "key") "|" (object/get @o "lit")) (if (= (object/get @o "h") @allocOp) (object/get @o "key") (object/get @o "lit")))))
                                     (array/flatten (array/map @perT (fn p
                                       (if (!= (object/get @p "ev") (object/get @o "ev"))
                                         []
                                         (array/map (array/filter (object/get @p "ops") (fn s (and (= (object/get @s "k") "set") (= (object/get @s "v") @want)))) (fn s
                                           { f: (object/get @s "f"), h: (object/get @o "h"), tgt: @tgt }))))))))))))
-                            (let ((links : [MhLink] (array/filter @rows (fn r (and (not (array/some @rows (fn r2 (and (= (object/get @r2 "f") (object/get @r "f")) (= (object/get @r2 "h") (object/get @r "h")) (!= (object/get @r2 "tgt") (object/get @r "tgt")))))) (or (= (object/get @r "h") "mem/arena-new") (and (!= (object/get @r "tgt") "") (not (str/startsWith (object/get @r "tgt") "|")))))))))
+                            (let ((links : [MhLink] (array/filter @rows (fn r (and (not (array/some @rows (fn r2 (and (= (object/get @r2 "f") (object/get @r "f")) (= (object/get @r2 "h") (object/get @r "h")) (!= (object/get @r2 "tgt") (object/get @r "tgt")))))) (or (= (object/get @r "h") @leakOp) (and (!= (object/get @r "tgt") "") (not (str/startsWith (object/get @r "tgt") "|")))))))))
                               (let ((rinit : MhRound { facts: {}, fnd: [] }))
                                (let ((done : MhRound (array/reduce (array/range 0 (+ (array/len @stNames) 1)) @rinit (fn racc r
                                       (let ((tinit : MhRound { facts: (object/get @racc "facts"), fnd: [] }))
@@ -108,43 +125,43 @@ orbital OrbLintMemHandlesOrbital {
                                                 (to : string (object/get @p "to"))
                                                 (ainit : MhAcc { s: [], f: [] }))
                                             (let ((res : MhAcc (array/reduce (object/get @p "ops") (let ((a0 : MhAcc { s: @inF, f: [] })) @a0) (fn acc o
-                                                    (let ((S : [string] (object/get @acc "s")) (F : [OrbFinding] (object/get @acc "f")) (k : string (object/get @o "key")) (h : string (object/get @o "h")) (lit : string (object/get @o "lit")))
+                                                    (let ((S : [string] (object/get @acc "s")) (F : [OrbFinding] (object/get @acc "f")) (k : string (object/get @o "key")) (h : string (object/get @o "h")) (lit : string (object/get @o "lit")) (cmd : string (object/get @o "cmd")))
                                                       (if (= (object/get @o "k") "set")
                                                         (let ((f : string (object/get @o "f")) (v : string (object/get @o "v")))
-                                                          (let ((bl (array/find @links (fn l (and (= (object/get @l "f") @f) (= (object/get @l "h") "mem/borrow")))))
-                                                                (made (array/find @links (fn l (and (= (object/get @l "f") @f) (= (object/get @l "h") "mem/arena-new") (!= (object/get @l "tgt") "stack"))))))
+                                                          (let ((bl (array/find @links (fn l (and (= (object/get @l "f") @f) (= (object/get @l "h") @borrowOp)))))
+                                                                (made (array/find @links (fn l (and (= (object/get @l "f") @f) (= (object/get @l "h") @leakOp) (not (array/includes @leakExempt (object/get @l "tgt"))))))))
                                                             { s: (array/concat
-                                                                   (array/filter @S (fn x (not (or (= @x (str/concat "F:" @f)) (and (or (str/startsWith @x "BX:") (str/startsWith @x "BS:")) (str/endsWith @x (str/concat ":" @f))) (and (= @v (str/concat @sig "payload.arena")) (str/startsWith @x (str/concat "A:" @f ":"))) (and (= @v (str/concat @sig "payload.block")) (or (str/startsWith @x (str/concat "BX:" @f ":")) (str/startsWith @x (str/concat "BS:" @f ":"))))))))
-                                                                   (if (and (= @v (str/concat @sig "payload.arena")) (!= @made null)) [(str/concat "A:" @f ":" (object/get @o "j"))] [])
-                                                                   (if (and (= @v (str/concat @sig "payload.borrow")) (!= @bl null) (array/includes ["exclusive" "shared"] (default (array/nth (str/split (object/get @bl "tgt") "|") 1) "")))
+                                                                   (array/filter @S (fn x (not (or (= @x (str/concat "F:" @f)) (and (or (str/startsWith @x "BX:") (str/startsWith @x "BS:")) (str/endsWith @x (str/concat ":" @f))) (and (= @v (str/concat @sig "payload." @leakField)) (str/startsWith @x (str/concat "A:" @f ":"))) (and (= @v (str/concat @sig "payload." @allocField)) (or (str/startsWith @x (str/concat "BX:" @f ":")) (str/startsWith @x (str/concat "BS:" @f ":"))))))))
+                                                                   (if (and (= @v (str/concat @sig "payload." @leakField)) (!= @made null)) [(str/concat "A:" @f ":" (object/get @o "j"))] [])
+                                                                   (if (and (= @v (str/concat @sig "payload." @borrowField)) (!= @bl null) (array/includes ["exclusive" "shared"] (default (array/nth (str/split (object/get @bl "tgt") "|") 1) "")))
                                                                      [(str/concat (if (= (array/nth (str/split (object/get @bl "tgt") "|") 1) "exclusive") "BX" "BS") ":" (default (array/first (str/split (object/get @bl "tgt") "|")) "") ":" @f)]
                                                                      [])),
                                                               f: @F }))
                                                         (if (= @k "")
                                                           @acc
                                                           (let ((src : string (object/get @o "src")) (at : string (object/get @o "at"))
-                                                                (isEnd : boolean (array/includes ["mem/free" "mem/arena-drop" "mem/release"] @h))
+                                                                (isEnd : boolean (array/includes @ends @h))
                                                                 (freed : boolean (array/includes @S (str/concat "F:" @k)))
-                                                                (modeOk : boolean (and (= @h "mem/borrow") (array/includes ["exclusive" "shared"] @lit))))
+                                                                (modeOk : boolean (and (!= @borrowOp "") (= @h @borrowOp) (array/includes ["exclusive" "shared"] @lit))))
                                                             (let ((conflict : boolean (and @modeOk (array/some @S (fn x (or (str/startsWith @x (str/concat "BX:" @k ":")) (str/startsWith @x (str/concat "pBX:" @k ":")) (and (= @lit "exclusive") (or (str/startsWith @x (str/concat "BS:" @k ":")) (str/startsWith @x (str/concat "pBS:" @k ":"))))))))))
-                                                              { s: (if (= @h "mem/free")
+                                                              { s: (if (and @isEnd (!= @h @leakEnd) (!= @h @releaseOp))
                                                                      (array/concat @S [(str/concat "F:" @k)])
-                                                                     (if (= @h "mem/arena-drop")
-                                                                       (let ((blocks : [string] (array/map (array/filter @links (fn l (and (= (object/get @l "h") "mem/alloc") (= (object/get @l "tgt") @k)))) (fn l (object/get @l "f"))))) (array/concat (array/filter @S (fn x (not (or (str/startsWith @x (str/concat "A:" @k ":")) (array/some @blocks (fn b (or (str/startsWith @x (str/concat "BX:" @b ":")) (str/startsWith @x (str/concat "BS:" @b ":"))))))))) [(str/concat "F:" @k)] (array/map @blocks (fn b (str/concat "F:" @b)))))
-                                                                       (if (= @h "mem/release")
+                                                                     (if (= @h @leakEnd)
+                                                                       (let ((blocks : [string] (array/map (array/filter @links (fn l (and (= (object/get @l "h") @allocOp) (= (object/get @l "tgt") @k)))) (fn l (object/get @l "f"))))) (array/concat (array/filter @S (fn x (not (or (str/startsWith @x (str/concat "A:" @k ":")) (array/some @blocks (fn b (or (str/startsWith @x (str/concat "BX:" @b ":")) (str/startsWith @x (str/concat "BS:" @b ":"))))))))) [(str/concat "F:" @k)] (array/map @blocks (fn b (str/concat "F:" @b)))))
+                                                                       (if (= @h @releaseOp)
                                                                          (array/concat (array/filter @S (fn x (not (and (or (str/startsWith @x "BX:") (str/startsWith @x "BS:")) (str/endsWith @x (str/concat ":" @k)))))) [(str/concat "F:" @k)])
                                                                          (if @modeOk
                                                                            (array/concat @S [(str/concat (if (= @lit "exclusive") "pBX:" "pBS:") @k ":")])
                                                                            @S)))),
                                                                 f: (array/concat @F
                                                                      (if (and @freed (not @isEnd))
-                                                                       [{ code: @config.codes.useAfterFree.code, path: @at, message: (str/concat "`(" @h " " @src " ...)` uses a handle that `mem/free`, `mem/arena-drop` or `mem/release` already ended on some path to this transition"), suggestion: "Stop using the handle after it is freed, dropped or released, or rebind the field from a fresh allocation first", severity: "error" }]
+                                                                       [{ code: (default (object/get (default (object/get @config.codes (object/get @fam "useAfterKey")) {}) "code") ""), path: @at, message: (if (= @cmd "") (str/concat "`(" @h " " @src " ...)` uses a handle that " @endsText " already ended on some path to this transition") (str/concat "`(" @h " ...)` command `" @cmd "` names `" @src "`, a handle that " @endsText " already ended on some path to this transition")), suggestion: (str/concat "Stop using the handle after it is " (object/get @fam "endedText") ", or rebind the field from a fresh " (object/get @fam "mintText") " first"), severity: "error" }]
                                                                        [])
                                                                      (if (and @freed @isEnd)
-                                                                       [{ code: @config.codes.doubleFree.code, path: @at, message: (str/concat "`(" @h " " @src ")` ends a handle that `mem/free`, `mem/arena-drop` or `mem/release` already ended on some path to this transition"), suggestion: "End each handle once on every path, or set the field to a new handle between the two", severity: "error" }]
+                                                                       [{ code: (default (object/get (default (object/get @config.codes (object/get @fam "doubleKey")) {}) "code") ""), path: @at, message: (str/concat "`(" @h " " @src ")` ends a handle that " @endsText " already ended on some path to this transition"), suggestion: "End each handle once on every path, or set the field to a new handle between the two", severity: "error" }]
                                                                        [])
                                                                      (if @conflict
-                                                                       [{ code: @config.codes.alias.code, path: @at, message: (str/concat "`(mem/borrow " @src " \"" @lit "\")` borrows a block that another borrow of it (an exclusive one, or any when this one is exclusive) still holds on some path to this transition"), suggestion: "`mem/release` the earlier borrow before borrowing again", severity: "error" }]
+                                                                       [{ code: @config.codes.alias.code, path: @at, message: (str/concat "`(" @h " " @src " \"" @lit "\")` borrows a block that another borrow of it (an exclusive one, or any when this one is exclusive) still holds on some path to this transition"), suggestion: (str/concat "`" @releaseOp "` the earlier borrow before borrowing again"), severity: "error" }]
                                                                        [])) })))))))))
                                               { facts: (object/set @inM @to (array/unique (array/concat (object/get @inM @to []) (array/filter (object/get @res "s") (fn x (not (or (str/startsWith @x "pB") (str/startsWith @x (str/concat "F:payload."))))))))),
                                                 fnd: (array/concat (object/get @acc2 "fnd") (object/get @res "f")) }))))))))))
@@ -153,11 +170,11 @@ orbital OrbLintMemHandlesOrbital {
                                   (array/concat (object/get @done "fnd")
                                     (array/map (array/unique (array/flatten (array/map @resting (fn r (array/filter (object/get @inFinal @r []) (fn x (str/startsWith @x "A:"))))))) (fn fact
                                       (let ((parts : [string] (str/split @fact ":")))
-                                        { code: @config.codes.leak.code,
+                                        { code: (default (object/get (default (object/get @config.codes (object/get @fam "leakKey")) {}) "code") ""),
                                           path: (str/concat @prefix ".transitions[" (default (array/nth @parts 2) "") "]"),
-                                          message: (str/concat "The arena stored in '" @sig "entity." (default (array/nth @parts 1) "") "' can reach the resting state(s) '" (str/join (array/filter @resting (fn r (array/includes (object/get @inFinal @r []) @fact))) "', '") "' without `mem/arena-drop`"),
-                                          suggestion: "Drop the arena on every path to a resting state, including the failure routes",
-                                          severity: "error" }))))))))))))))))))))))
+                                          message: (str/concat "The " (object/get @fam "leakNoun") " stored in '" @sig "entity." (default (array/nth @parts 1) "") "' can reach the resting state(s) '" (str/join (array/filter @resting (fn r (array/includes (object/get @inFinal @r []) @fact))) "', '") "' without `" @leakEnd "`"),
+                                          suggestion: (str/concat (object/get @fam "leakVerb") " the " (object/get @fam "leakNoun") " on every path to a resting state, including the failure routes"),
+                                          severity: "error" })))))))))))))))))))))))))))
 [{ code: @config.codes.lintIndexMissing.code, path: "", message: "the lint input arrived without LINT_SITES, so this rule cannot check the program", suggestion: "std-orb-lint-input sends LINT_SITES before LINT_INPUT; this rule did not hear it", severity: "error" }]))
         (set @entity.sitesCallsHeard false)
         (emit LINT_FINISH { })
@@ -183,9 +200,12 @@ orbital OrbLintMemHandlesOrbital {
       OrbLintInput.LINT_SITES -> SITES_HEARD
     }
     config {
-      codes : LintMemHandlesCodes = { lintIndexMissing: { code: "ORB_LINT_INDEX_MISSING", category: "lint", description: "The lint input arrived without a shared program fact the rule reads (the structural index, sites, units, embeds or entities), so the rule cannot check the program" }, useAfterFree: { code: "ORB_MEM_USE_AFTER_FREE", category: "mem", description: "A mem/ call takes a handle after it was freed, dropped or released on some path" }, doubleFree: { code: "ORB_MEM_DOUBLE_FREE", category: "mem", description: "A handle is freed, dropped or released a second time on some path" }, alias: { code: "ORB_MEM_ALIAS", category: "mem", description: "An exclusive borrow of a block while another borrow of it is live, or a borrow while an exclusive one is live" }, leak: { code: "ORB_MEM_LEAK", category: "mem", description: "An arena reaches a resting state on some path without being dropped" } }
+      codes : LintMemHandlesCodes = { lintIndexMissing: { code: "ORB_LINT_INDEX_MISSING", category: "lint", description: "The lint input arrived without a shared program fact the rule reads (the structural index, sites, units, embeds or entities), so the rule cannot check the program" }, useAfterFree: { code: "ORB_MEM_USE_AFTER_FREE", category: "mem", description: "A mem/ call takes a handle after it was freed, dropped or released on some path" }, doubleFree: { code: "ORB_MEM_DOUBLE_FREE", category: "mem", description: "A handle is freed, dropped or released a second time on some path" }, alias: { code: "ORB_MEM_ALIAS", category: "mem", description: "An exclusive borrow of a block while another borrow of it is live, or a borrow while an exclusive one is live" }, leak: { code: "ORB_MEM_LEAK", category: "mem", description: "An arena reaches a resting state on some path without being dropped" }, gpuUseAfterRelease: { code: "ORB_GPU_USE_AFTER_RELEASE", category: "gpu", description: "A gpu/ call takes a handle after it was released or its device closed on some path, or a handle is released a second time" }, gpuLeak: { code: "ORB_GPU_LEAK", category: "gpu", description: "A device reaches a resting state on some path without being closed" } }
         @label "Emitted codes"
         @description "The finding codes this rule emits, with their category and meaning; the registry is generated from this declaration."
+      families : [LintHandleFamily] = [{ name: "mem", prefix: "mem/", handleFields: ["arena", "block", "borrow"], ends: ["mem/free", "mem/arena-drop", "mem/release"], endedText: "freed, dropped or released", mintText: "allocation", useAfterKey: "useAfterFree", doubleKey: "doubleFree", leakOp: "mem/arena-new", leakField: "arena", leakEnd: "mem/arena-drop", leakExempt: ["stack"], leakNoun: "arena", leakVerb: "Drop", leakKey: "leak", allocOp: "mem/alloc", allocField: "block", borrowOp: "mem/borrow", borrowField: "borrow", releaseOp: "mem/release", cmdOp: "", cmdPos: 0, cmdKeys: [], cmdListKeys: [] }, { name: "gpu", prefix: "gpu/", handleFields: ["device", "buffer", "texture", "sampler", "querySet", "shader", "pipeline", "bindGroup"], ends: ["gpu/release", "gpu/device-close"], endedText: "released or closed", mintText: "creation", useAfterKey: "gpuUseAfterRelease", doubleKey: "gpuUseAfterRelease", leakOp: "gpu/device-open", leakField: "device", leakEnd: "gpu/device-close", leakExempt: [], leakNoun: "device", leakVerb: "Close", leakKey: "gpuLeak", allocOp: "", allocField: "", borrowOp: "", borrowField: "", releaseOp: "", cmdOp: "gpu/submit", cmdPos: 1, cmdKeys: ["buffer", "texture", "from", "to", "pipeline", "target", "querySet"], cmdListKeys: ["bindGroups"] }]
+        @label "Handle families"
+        @description "The handle vocabulary the rule walks, one record per family: the op prefix; the payload fields whose success route mints a handle (handleFields); the ends (an end ends a handle, a later use is a finding, a second end is the double-end finding named by doubleKey); the resting-state leak rule (leakOp mints a handle into payload leakField, leakEnd ends it, leakExempt lists the literal first arguments of leakOp that never leak, a minted handle that reaches a resting state of the trait without leakEnd is the leakKey finding). allocOp, borrowOp and releaseOp are the mem alias machinery (a block allocated from the leak handle, exclusive or shared borrows of it, the release that ends a borrow): the alias rule exists only for a family that declares borrowOp, so gpu leaves them empty. An empty op or field turns that rule off for the family. cmdOp names the op whose argument at position cmdPos (0 is the first) is a list of command records (gpu/submit, position 1; empty for none): each literal `@entity.<f>` under a cmdKeys key of a record's body, or in the list under a cmdListKeys key, counts as a use of that handle, like a first argument."
     }
 
   }

package/behaviors/lolo/cli/atoms/std-orb-lint-os-grants.lolo

@@ -2,7 +2,7 @@ app std-orb-lint-os-grants [
   version: "1.0.0",
   inbound: ["cli-lint-os-grants"],
   fs: { cwd: "**": [read], "/**": [read] },
-  description: "std-orb-lint-os-grants — the `orb lint os-grants <file>` command, the static os-grant check. It asks the kernel (`program/os-grants`, twice: the program as written, then the finished program) for the typed findings of the file's resolved program and words them: ORB_OS_GRANT_MISSING (an `os/` call the grants of its orbital do not cover), ORB_OS_GRANT_UNUSED (a warning: a granted entry no call uses), ORB_OS_GRANT_ENTRY_INVALID (an entry that can match nothing) and ORB_OS_TARGET_NOT_STATIC (a computed target, so its grant cannot be checked), at the site the kernel names. The finished-program pass answers as the rule os-grants-final, which belongs to `orb validate --final` only. Clean answers `lint os-grants: clean` (status 200, exit 0); findings are status 500, exit 1. Anything but one file argument is the usage (status 400, exit 2); a file the compiler cannot resolve is skipped here: validate reports that failure itself."
+  description: "std-orb-lint-os-grants — the `orb lint os-grants <file>` command, the static os-grant check. It asks the kernel (`program/os-grants`, twice: the program as written, then the finished program) for the typed findings of the file's resolved program and words them: ORB_OS_GRANT_MISSING (an `os/` call the grants of its orbital do not cover), ORB_OS_GRANT_UNUSED (a warning: a granted entry no call uses), ORB_OS_GRANT_ENTRY_INVALID (an entry that can match nothing) ORB_OS_TARGET_NOT_STATIC (a computed target, so its grant cannot be checked) ORB_GPU_SHADER_INVALID (a literal gpu/shader-create WGSL source naga refuses) and ORB_GPU_BINDING_MISMATCH (a gpu/bind-group-create whose literal entries do not fit the bindings its pipeline uses, the pipeline traced through the trait to its WGSL; the finished-program pass only), at the site the kernel names. The finished-program pass answers as the rule os-grants-final, which belongs to `orb validate --final` only. Clean answers `lint os-grants: clean` (status 200, exit 0); findings are status 500, exit 1. Anything but one file argument is the usage (status 400, exit 2); a file the compiler cannot resolve is skipped here: validate reports that failure itself."
 ]
 uses Spec from "almadar-std/lint-os-grants"
 type OrbCommandArgs = { argv : [string]!, cwd : string! }
@@ -16,7 +16,7 @@ type RcRefRow = { kind : string!, path : string!, callSite : GrNode!, declaratio
 type RcKept = { orbital : number!, traits : [string]! }
 
 type LintCodeDecl = { code : string!, category : string!, description : string! }
-type LintOsGrantsCodes = { missing : LintCodeDecl, unused : LintCodeDecl, entryInvalid : LintCodeDecl, targetNotStatic : LintCodeDecl }
+type LintOsGrantsCodes = { missing : LintCodeDecl, unused : LintCodeDecl, entryInvalid : LintCodeDecl, targetNotStatic : LintCodeDecl, shaderInvalid : LintCodeDecl, bindingMismatch : LintCodeDecl }
 
 orbital OrbLintOsGrantsOrbital {
   uses CsInput from "std/behaviors/std-orb-lint-call-site-input"
@@ -76,7 +76,7 @@ orbital OrbLintOsGrantsOrbital {
     state mapping {
       INIT -> mapping
       LINT_MAP -> mapping
-        (set @entity.mapped (array/map @entity.tagged (fn x (let ((f (object/get @x "f")) (via (object/get (object/get @x "f") "via" "")) (code (object/get (object/get @x "f") "code")) (orbital (object/get (object/get @x "f") "orbital" "")) (call (object/get (object/get @x "f") "call" "")) (entry (object/get (object/get @x "f") "entry" "")) (arg (object/get (object/get @x "f") "argument" 0))) { final: (object/get @x "final"), finding: { code: (if (= @code "missing") @config.codes.missing.code (if (= @code "unused") @config.codes.unused.code (if (= @code "entry-invalid") @config.codes.entryInvalid.code @config.codes.targetNotStatic.code))), path: (object/get @f "site"), severity: (if (= @code "unused") "warning" "error"), message: (if (= @code "missing") (str/concat "`" @call "` " (if (= @via "config") "can be given " "needs ") @entry (if (= @via "config") " by its config, but orbital " " but orbital ") @orbital " does not grant it") (if (= @code "unused") (str/concat "`" @entry "` is granted to " (if (= @orbital "") "the program" (str/concat "orbital " @orbital)) " but no `os/` call there uses it") (if (= @code "entry-invalid") @entry (if (= @via "config-unresolvable") (str/concat "`" @call "` argument " @arg " is read from config in a way the finished program cannot resolve, so its grant cannot be checked") (if (= @via "computed-path") (str/concat "`" @call "` argument " @arg " is a computed path the grant cannot cover: only a file path may be a `str/concat`") (str/concat "`" @call "` argument " @arg " is computed — an `os/` target must be a literal so the grant can be checked at build time")))))), suggestion: (if (= @code "missing") (str/concat "Add `" (object/get @f "grant" "") (if (object/get @f "app" false) "` to the orbital's bracket (`orbital Name [ … ]`) or the app's" "` to the orbital's bracket")) (if (= @code "unused") "Remove the entry: an unused grant is authority the program does not need" (if (= @code "entry-invalid") "" (if (= @via "config-unresolvable") "Read the target with `@config.<knob>`, `array/nth` and `object/get`, or write it as a literal; a `str/concat` directory prefix must be string knobs and literals ending in `/`" (if (= @via "computed-path") "Write the target as a literal" "Write the path, command, host, port or name as a literal; a file path may instead be a `str/concat` that starts with a literal or `@config.<knob>` directory ending in `/`, covered by an fs grant ending in `/**`, or an anchored path `{ anchor: \"cwd\" path: … }` (anchors `exe-dir`, `cwd`, `{ env: \"NAME\" }`) covered by an anchored grant such as `fs: { cwd: \"docs/**\": [read] }`; a host or port may be `{ anchor: { env: \"PORT\" } }` covered by `net: { env HOST, env PORT: [listen] }`"))))) } }))))
+        (set @entity.mapped (array/map @entity.tagged (fn x (let ((f (object/get @x "f")) (via (object/get (object/get @x "f") "via" "")) (code (object/get (object/get @x "f") "code")) (orbital (object/get (object/get @x "f") "orbital" "")) (call (object/get (object/get @x "f") "call" "")) (entry (object/get (object/get @x "f") "entry" "")) (arg (object/get (object/get @x "f") "argument" 0))) { final: (object/get @x "final"), finding: { code: (if (= @code "missing") @config.codes.missing.code (if (= @code "unused") @config.codes.unused.code (if (= @code "entry-invalid") @config.codes.entryInvalid.code (if (= @code "shader-invalid") @config.codes.shaderInvalid.code (if (= @code "binding-mismatch") @config.codes.bindingMismatch.code @config.codes.targetNotStatic.code))))), path: (object/get @f "site"), severity: (if (= @code "unused") "warning" "error"), message: (if (= @code "missing") (str/concat "`" @call "` " (if (= @via "config") "can be given " "needs ") @entry (if (= @via "config") " by its config, but orbital " " but orbital ") @orbital " does not grant it") (if (= @code "unused") (str/concat "`" @entry "` is granted to " (if (= @orbital "") "the program" (str/concat "orbital " @orbital)) " but no `os/` call there uses it") (if (or (= @code "entry-invalid") (= @code "shader-invalid")) @entry (if (= @code "binding-mismatch") (str/concat "`gpu/bind-group-create` entries do not fit the pipeline they are made for: " @entry) (if (= @via "config-unresolvable") (str/concat "`" @call "` argument " @arg " is read from config in a way the finished program cannot resolve, so its grant cannot be checked") (if (= @via "computed-path") (str/concat "`" @call "` argument " @arg " is a computed path the grant cannot cover: only a file path may be a `str/concat`") (str/concat "`" @call "` argument " @arg " is computed — an `os/` target must be a literal so the grant can be checked at build time"))))))), suggestion: (if (= @code "missing") (str/concat "Add `" (object/get @f "grant" "") (if (object/get @f "app" false) "` to the orbital's bracket (`orbital Name [ … ]`) or the app's" "` to the orbital's bracket")) (if (= @code "unused") "Remove the entry: an unused grant is authority the program does not need" (if (or (= @code "entry-invalid") (= @code "shader-invalid")) "" (if (= @code "binding-mismatch") "Give one entry per binding the pipeline's entry points use in that group, each the resource the WGSL declares (buffer, texture or sampler)" (if (= @via "config-unresolvable") "Read the target with `@config.<knob>`, `array/nth` and `object/get`, or write it as a literal; a `str/concat` directory prefix must be string knobs and literals ending in `/`" (if (= @via "computed-path") "Write the target as a literal" "Write the path, command, host, port or name as a literal; a file path may instead be a `str/concat` that starts with a literal or `@config.<knob>` directory ending in `/`, covered by an fs grant ending in `/**`, or an anchored path `{ anchor: \"cwd\" path: … }` (anchors `exe-dir`, `cwd`, `{ env: \"NAME\" }`) covered by an anchored grant such as `fs: { cwd: \"docs/**\": [read] }`; a host or port may be `{ anchor: { env: \"PORT\" } }` covered by `net: { env HOST, env PORT: [listen] }`")))))) } }))))
         (emit LINT_SPLIT { })
       LINT_SPLIT -> ready
         (set @entity.findings (array/map (array/filter @entity.mapped (fn m (not (object/get @m "final")))) (fn m (object/get @m "finding"))))
@@ -117,7 +117,7 @@ orbital OrbLintOsGrantsOrbital {
         @description "Internal: answer with the verdicts."
     }
     config {
-      codes : LintOsGrantsCodes = { missing: { code: "ORB_OS_GRANT_MISSING", category: "os", description: "An os/ call that the grants of its orbital (app level plus its own) do not cover" }, unused: { code: "ORB_OS_GRANT_UNUSED", category: "os", description: "A granted entry that no os/ call of the orbital (or of the program, at app level) uses; a warning" }, entryInvalid: { code: "ORB_OS_GRANT_ENTRY_INVALID", category: "os", description: "A declared grant entry that can match nothing" }, targetNotStatic: { code: "ORB_OS_TARGET_NOT_STATIC", category: "os", description: "An os/ call target that is computed, so its grant cannot be checked at build time" } }
+      codes : LintOsGrantsCodes = { missing: { code: "ORB_OS_GRANT_MISSING", category: "os", description: "An os/ call that the grants of its orbital (app level plus its own) do not cover" }, unused: { code: "ORB_OS_GRANT_UNUSED", category: "os", description: "A granted entry that no os/ call of the orbital (or of the program, at app level) uses; a warning" }, entryInvalid: { code: "ORB_OS_GRANT_ENTRY_INVALID", category: "os", description: "A declared grant entry that can match nothing" }, targetNotStatic: { code: "ORB_OS_TARGET_NOT_STATIC", category: "os", description: "An os/ call target that is computed, so its grant cannot be checked at build time" }, shaderInvalid: { code: "ORB_GPU_SHADER_INVALID", category: "os", description: "A literal gpu/shader-create WGSL source that naga refuses to parse or validate" }, bindingMismatch: { code: "ORB_GPU_BINDING_MISMATCH", category: "os", description: "A gpu/bind-group-create whose literal entries do not fit the bindings its traced pipeline's entry points use in its WGSL" } }
         @label "Emitted codes"
         @description "The finding codes this rule emits, with their category and meaning; the registry is generated from this declaration."
     }

package/behaviors/lolo/cli/atoms/std-orb-mcp.lolo

@@ -243,56 +243,54 @@ orbital OrbMcpOrbital {
         (emit MCP_ANSWERED { status: 500, body: (str/concat "orb mcp: " (default @payload.error "")) })
       MCP_EOF -> starting
         (emit MCP_ANSWERED { status: 200, body: "" })
-      MCP_PUMP -> serving
-        (emit MCP_INPUT_NEXT {})
       MCP_LINE_IN -> serving when (= (str/trim @payload.line) "")
-        (emit MCP_PUMP { })
+        (emit MCP_INPUT_NEXT {})
       MCP_LINE_IN -> serving when (and (!= (str/trim @payload.line) "") (not (json/valid @payload.line)))
         (set @entity.reply (json/stringify (let ((reply : McpParseError { jsonrpc: "2.0" id: null error: { code: -32700 message: "parse error: invalid JSON" } })) @reply)))
         (emit MCP_LINE_OUT { line: @entity.reply })
-        (emit MCP_PUMP { })
+        (emit MCP_INPUT_NEXT {})
       MCP_LINE_IN -> serving when (and (json/valid @payload.line) (= (json/parse @payload.line McpMessage) null))
         (set @entity.reply (json/stringify (let ((reply : McpParseError { jsonrpc: "2.0" id: null error: { code: -32600 message: "Invalid Request" } })) @reply)))
         (emit MCP_LINE_OUT { line: @entity.reply })
-        (emit MCP_PUMP { })
+        (emit MCP_INPUT_NEXT {})
       MCP_LINE_IN -> serving when (and (json/valid @payload.line) (!= (json/parse @payload.line McpMessage) null) (not (object/has (json/parse @payload.line McpMessage) "id")) (= (object/get (json/parse @payload.line McpMessage) "method") null))
         (set @entity.reply (json/stringify (let ((reply : McpParseError { jsonrpc: "2.0" id: null error: { code: -32600 message: "Invalid Request" } })) @reply)))
         (emit MCP_LINE_OUT { line: @entity.reply })
-        (emit MCP_PUMP { })
+        (emit MCP_INPUT_NEXT {})
       MCP_LINE_IN -> serving when (and (json/valid @payload.line) (!= (json/parse @payload.line McpMessage) null) (not (object/has (json/parse @payload.line McpMessage) "id")) (!= (object/get (json/parse @payload.line McpMessage) "method") null))
-        (emit MCP_PUMP { })
+        (emit MCP_INPUT_NEXT {})
       MCP_LINE_IN -> serving when (and (json/valid @payload.line) (!= (json/parse @payload.line McpMessage) null) (object/has (json/parse @payload.line McpMessage) "id") (= (object/get (json/parse @payload.line McpMessage) "method") "initialize"))
         (set @entity.reply (json/stringify { jsonrpc: "2.0" id: (object/get (json/parse @payload.line McpMessage) "id") result: { protocolVersion: (if (array/includes ["2025-06-18", "2025-03-26", "2024-11-05"] (object/get (default (object/get (json/parse @payload.line McpMessage) "params") {}) "protocolVersion")) (object/get (default (object/get (json/parse @payload.line McpMessage) "params") {}) "protocolVersion") "2025-06-18") capabilities: { tools: (json/parse "{}" McpJson) prompts: (json/parse "{}" McpJson) } serverInfo: { name: "orb" version: @entity.version } instructions: @entity.instructions } }))
         (emit MCP_LINE_OUT { line: @entity.reply })
-        (emit MCP_PUMP { })
+        (emit MCP_INPUT_NEXT {})
       MCP_LINE_IN -> serving when (and (json/valid @payload.line) (!= (json/parse @payload.line McpMessage) null) (object/has (json/parse @payload.line McpMessage) "id") (= (object/get (json/parse @payload.line McpMessage) "method") "ping"))
         (set @entity.reply (json/stringify { jsonrpc: "2.0" id: (object/get (json/parse @payload.line McpMessage) "id") result: (json/parse "{}" McpJson) }))
         (emit MCP_LINE_OUT { line: @entity.reply })
-        (emit MCP_PUMP { })
+        (emit MCP_INPUT_NEXT {})
       MCP_LINE_IN -> serving when (and (json/valid @payload.line) (!= (json/parse @payload.line McpMessage) null) (object/has (json/parse @payload.line McpMessage) "id") (= (object/get (json/parse @payload.line McpMessage) "method") "tools/list"))
         (set @entity.reply (json/stringify { jsonrpc: "2.0" id: (object/get (json/parse @payload.line McpMessage) "id") result: { tools: @entity.tools } }))
         (emit MCP_LINE_OUT { line: @entity.reply })
-        (emit MCP_PUMP { })
+        (emit MCP_INPUT_NEXT {})
       MCP_LINE_IN -> serving when (and (json/valid @payload.line) (!= (json/parse @payload.line McpMessage) null) (object/has (json/parse @payload.line McpMessage) "id") (= (object/get (json/parse @payload.line McpMessage) "method") "prompts/list"))
         (set @entity.reply (json/stringify { jsonrpc: "2.0" id: (object/get (json/parse @payload.line McpMessage) "id") result: { prompts: [{ name: "build" description: "Build an app in Orb, from finding behaviors to a program that validates 0/0" arguments: [{ name: "app" description: "What to build" required: false }] }] } }))
         (emit MCP_LINE_OUT { line: @entity.reply })
-        (emit MCP_PUMP { })
+        (emit MCP_INPUT_NEXT {})
       MCP_LINE_IN -> serving when (and (json/valid @payload.line) (!= (json/parse @payload.line McpMessage) null) (object/has (json/parse @payload.line McpMessage) "id") (= (object/get (json/parse @payload.line McpMessage) "method") "prompts/get") (!= (object/get (default (object/get (json/parse @payload.line McpMessage) "params") {}) "name") "build"))
         (set @entity.reply (json/stringify { jsonrpc: "2.0" id: (object/get (json/parse @payload.line McpMessage) "id") error: { code: -32602 message: (str/concat "unknown prompt " (json/stringify (object/get (default (object/get (json/parse @payload.line McpMessage) "params") {}) "name"))) } }))
         (emit MCP_LINE_OUT { line: @entity.reply })
-        (emit MCP_PUMP { })
+        (emit MCP_INPUT_NEXT {})
       MCP_LINE_IN -> serving when (and (json/valid @payload.line) (!= (json/parse @payload.line McpMessage) null) (object/has (json/parse @payload.line McpMessage) "id") (= (object/get (json/parse @payload.line McpMessage) "method") "prompts/get") (= (object/get (default (object/get (json/parse @payload.line McpMessage) "params") {}) "name") "build"))
         (set @entity.reply (json/stringify { jsonrpc: "2.0" id: (object/get (json/parse @payload.line McpMessage) "id") result: { description: "Build an app in Orb" messages: [{ role: "user" content: { type: "text" text: (str/concat "Build " (default (object/get (default (object/get (default (object/get (json/parse @payload.line McpMessage) "params") {}) "arguments") {}) "app") "the app the user asked for") " in Orb.\n\n" @entity.instructions) } }] } }))
         (emit MCP_LINE_OUT { line: @entity.reply })
-        (emit MCP_PUMP { })
+        (emit MCP_INPUT_NEXT {})
       MCP_LINE_IN -> serving when (and (json/valid @payload.line) (!= (json/parse @payload.line McpMessage) null) (object/has (json/parse @payload.line McpMessage) "id") (not (array/includes ["initialize", "ping", "tools/list", "tools/call", "prompts/list", "prompts/get"] (object/get (json/parse @payload.line McpMessage) "method"))))
         (set @entity.reply (json/stringify { jsonrpc: "2.0" id: (object/get (json/parse @payload.line McpMessage) "id") error: { code: -32601 message: (str/concat "method not found: " (default (object/get (json/parse @payload.line McpMessage) "method") "")) } }))
         (emit MCP_LINE_OUT { line: @entity.reply })
-        (emit MCP_PUMP { })
+        (emit MCP_INPUT_NEXT {})
       MCP_LINE_IN -> serving when (and (json/valid @payload.line) (!= (json/parse @payload.line McpMessage) null) (object/has (json/parse @payload.line McpMessage) "id") (= (object/get (json/parse @payload.line McpMessage) "method") "tools/call") (not (array/includes ["validate", "complete", "format", "operators", "patterns", "behaviors", "describe_behavior", "read_behavior", "play", "test", "reference", "evaluate"] (object/get (default (object/get (json/parse @payload.line McpMessage) "params") {}) "name"))) (not (array/includes @entity.hookNames (object/get (default (object/get (json/parse @payload.line McpMessage) "params") {}) "name"))))
         (set @entity.reply (json/stringify { jsonrpc: "2.0" id: (object/get (json/parse @payload.line McpMessage) "id") result: { content: [{ type: "text" text: (str/concat "orb has no tool `" (default (object/get (default (object/get (json/parse @payload.line McpMessage) "params") {}) "name") "") "`") }] isError: true } }))
         (emit MCP_LINE_OUT { line: @entity.reply })
-        (emit MCP_PUMP { })
+        (emit MCP_INPUT_NEXT {})
       MCP_LINE_IN -> working when (and (json/valid @payload.line) (!= (json/parse @payload.line McpMessage) null) (object/has (json/parse @payload.line McpMessage) "id") (= (object/get (json/parse @payload.line McpMessage) "method") "tools/call") (or (array/includes ["validate", "format", "behaviors", "describe_behavior", "read_behavior", "play", "operators", "patterns", "evaluate", "complete", "reference", "test"] (object/get (default (object/get (json/parse @payload.line McpMessage) "params") {}) "name")) (array/includes @entity.hookNames (object/get (default (object/get (json/parse @payload.line McpMessage) "params") {}) "name"))))
         (set @entity.rid (object/get (json/parse @payload.line McpMessage) "id"))
         (set @entity.tool (default (object/get (default (object/get (json/parse @payload.line McpMessage) "params") {}) "name") ""))
@@ -419,11 +417,11 @@ orbital OrbMcpOrbital {
       MCP_TOOL_DONE -> serving
         (set @entity.reply (json/stringify { jsonrpc: "2.0" id: @entity.rid result: { content: [{ type: "text" text: (json/stringify @payload.result) }] structuredContent: @payload.result isError: false } }))
         (emit MCP_LINE_OUT { line: @entity.reply })
-        (emit MCP_PUMP { })
+        (emit MCP_INPUT_NEXT {})
       MCP_TOOL_FAILED -> serving
         (set @entity.reply (json/stringify { jsonrpc: "2.0" id: @entity.rid result: { content: [{ type: "text" text: @payload.error }] isError: true } }))
         (emit MCP_LINE_OUT { line: @entity.reply })
-        (emit MCP_PUMP { })
+        (emit MCP_INPUT_NEXT {})
     }
 
     emits {
@@ -442,9 +440,6 @@ orbital OrbMcpOrbital {
         @description "Start the composed standard input line transport."
       MCP_INPUT_NEXT {}
         @description "Acknowledge the processed request and permit the next line."
-      MCP_PUMP { }
-        @description "Internal: acknowledge the processed request."
-        @tier "internal"
       MCP_LISTEN { }
         @description "Internal: start reading stdin."
         @tier "internal"
@@ -639,7 +634,7 @@ orbital OrbMcpOrbital {
         words : [string]!
       }
         @description "std-args's ARGS_PARSED."
-      MCP_LINE_IN { line : string! }
+      MCP_LINE_IN { line : string! seq : number! }
         @description "One framed input line from the transport."
       MCP_EOF {}
         @description "The transport reached EOF after all requests were acknowledged."