@astrale-os/kernel-core 0.9.0-beta.65 → 0.9.0-beta.67

package/dist/auth/authority/admission/admission.d.ts

@@ -8,7 +8,6 @@ export declare const limits: {
     readonly classesPerRelation: 1024;
     readonly repeatMaximum: 16;
 };
-export declare const MAX_BOOLEAN_OPERANDS: 512;
 export declare function admitAuthorityExpr(input: portable.Value): AuthorityExpr;
 /** Internal constructor admission: the outer identity binder binds subject; no local escapes into it. */
 export declare function admitBinderBody(input: portable.Value): AuthorityExpr;

package/dist/auth/authority/admission/admission.js

@@ -1,7 +1,8 @@
-import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
 import { isNodeId } from '../../../graph/node/index.js';
-import { AuthValueError } from '../../error.js';
 import { ownsExpression } from '../ownership.optimization.js';
+import { classRef } from './references.js';
+import { localId, term } from './term.js';
+import { array, exact, invalid, record, required } from './wire.js';
 export const limits = Object.freeze({
     expressionDepth: 64,
     operandsPerExpression: 512,
@@ -10,7 +11,7 @@ export const limits = Object.freeze({
     classesPerRelation: 1024,
     repeatMaximum: 16,
 });
-export const MAX_BOOLEAN_OPERANDS = limits.operandsPerExpression;
+const MAX_BOOLEAN_OPERANDS = limits.operandsPerExpression;
 export function admitAuthorityExpr(input) {
     return admit(input, '/predicate', new Set(), false, 0);
 }
@@ -67,7 +68,7 @@ function admit(input, path, locals, subjectBound, depth) {
             return {
                 op: 'related',
                 source: term(value.source, `${path}/source`, locals, subjectBound),
-                via: array(value.via, `${path}/via`, 1, limits.classesPerRelation).map((entry, index) => edgeClassRef(entry, `${path}/via/${index}`)),
+                via: array(value.via, `${path}/via`, 1, limits.classesPerRelation).map((entry, index) => classRef(entry, `${path}/via/${index}`)),
                 target: term(value.target, `${path}/target`, locals, subjectBound),
                 ...(hasRepeat ? { repeat: repeat(value.repeat, `${path}/repeat`) } : {}),
             };
@@ -96,11 +97,11 @@ function admit(input, path, locals, subjectBound, depth) {
             return {
                 op: 'instance-of',
                 node: term(value.node, `${path}/node`, locals, subjectBound),
-                class: nodeClassRef(value.class, `${path}/class`),
+                class: classRef(value.class, `${path}/class`),
             };
         case 'edge-class':
             exact(value, ['class', 'op'], path);
-            return { op: 'edge-class', class: edgeClassRef(value.class, `${path}/class`) };
+            return { op: 'edge-class', class: classRef(value.class, `${path}/class`) };
         case 'class-authority':
             exact(value, ['class', 'evidence', 'identity', 'op', 'operation'], path);
             return {
@@ -114,55 +115,6 @@ function admit(input, path, locals, subjectBound, depth) {
             invalid(`${path}/op`, 'Unsupported authority operation');
     }
 }
-function term(input, path, locals, subjectBound) {
-    const value = record(input, path);
-    switch (value.kind) {
-        case 'input':
-            exact(value, ['input', 'kind'], path);
-            if (value.input !== 'object' && value.input !== 'source' && value.input !== 'target') {
-                invalid(`${path}/input`, 'Expected object, source, or target');
-            }
-            return { kind: 'input', input: value.input };
-        case 'node':
-            exact(value, ['id', 'kind'], path);
-            if (!isNodeId(value.id))
-                invalid(`${path}/id`, 'Expected a canonical NodeId');
-            return { kind: 'node', id: value.id };
-        case 'class':
-            exact(value, ['kind', 'ref'], path);
-            return { kind: 'class', ref: classRef(value.ref, `${path}/ref`) };
-        case 'domain':
-            exact(value, ['kind', 'origin'], path);
-            return { kind: 'domain', origin: domainOrigin(value.origin, `${path}/origin`) };
-        case 'ref': {
-            exact(value, ['kind', 'ref'], path);
-            const ref = absoluteRef(value.ref, `${path}/ref`);
-            if (ref.kind === 'core')
-                return { kind: 'ref', ref: coreRef(value.ref, `${path}/ref`) };
-            if (!['class', 'function', 'policy', 'view'].includes(ref.kind))
-                invalid(`${path}/ref/kind`, 'Expected a projected Schema member');
-            definitionName(ref.name, `${path}/ref/name`);
-            return { kind: 'ref', ref: ref };
-        }
-        case 'core':
-            exact(value, ['kind', 'ref'], path);
-            return { kind: 'core', ref: coreRef(value.ref, `${path}/ref`) };
-        case 'local': {
-            exact(value, ['id', 'kind'], path);
-            const id = localId(value.id, `${path}/id`);
-            if (!locals.has(id))
-                invalid(`${path}/id`, `Local ${id} is outside its lexical scope`);
-            return { kind: 'local', id };
-        }
-        case 'subject':
-            exact(value, ['kind'], path);
-            if (!subjectBound)
-                invalid(path, 'Binder subject is outside its lexical scope');
-            return { kind: 'subject' };
-        default:
-            invalid(`${path}/kind`, 'Unsupported authority term');
-    }
-}
 function localDeclaration(input, path) {
     const value = record(input, path);
     const id = localId(value.id, `${path}/id`);
@@ -172,7 +124,7 @@ function localDeclaration(input, path) {
     }
     if (value.kind === 'classes') {
         exact(value, ['classes', 'id', 'kind'], path);
-        const classes = array(value.classes, `${path}/classes`, 1, limits.classesPerLocal).map((entry, index) => nodeClassRef(entry, `${path}/classes/${index}`));
+        const classes = array(value.classes, `${path}/classes`, 1, limits.classesPerLocal).map((entry, index) => classRef(entry, `${path}/classes/${index}`));
         return {
             id,
             kind: 'classes',
@@ -193,61 +145,6 @@ function repeat(input, path) {
     }
     return { min, max };
 }
-function classRef(input, path) {
-    const value = absoluteRef(input, path);
-    if (value.kind !== 'class')
-        invalid(`${path}/kind`, 'Expected class');
-    definitionName(value.name, `${path}/name`);
-    return value;
-}
-function nodeClassRef(input, path) {
-    const value = absoluteRef(input, path);
-    if (value.kind !== 'class')
-        invalid(`${path}/kind`, 'Expected class');
-    definitionName(value.name, `${path}/name`);
-    return value;
-}
-function edgeClassRef(input, path) {
-    const value = absoluteRef(input, path);
-    if (value.kind !== 'class')
-        invalid(`${path}/kind`, 'Expected class');
-    definitionName(value.name, `${path}/name`);
-    return value;
-}
-function absoluteRef(input, path) {
-    const value = record(input, path);
-    exact(value, ['kind', 'name', 'origin'], path);
-    const origin = domainOrigin(value.origin, `${path}/origin`);
-    if (typeof value.kind !== 'string')
-        invalid(`${path}/kind`, 'Expected a reference kind');
-    if (typeof value.name !== 'string')
-        invalid(`${path}/name`, 'Expected a reference name');
-    return { origin, kind: value.kind, name: value.name };
-}
-function definitionName(input, path) {
-    if (!patterns.memberName.test(input))
-        invalid(path, 'Expected a Definition member name');
-}
-function coreRef(input, path) {
-    const value = absoluteRef(input, path);
-    if (value.kind !== 'core')
-        invalid(`${path}/kind`, 'Expected core');
-    if (!patterns.coreSlug.test(value.name))
-        invalid(`${path}/name`, 'Expected a Core slug');
-    return value;
-}
-function domainOrigin(input, path) {
-    if (typeof input !== 'string' || !patterns.origin.test(input)) {
-        invalid(path, 'Expected a canonical Domain origin');
-    }
-    return input;
-}
-function localId(input, path) {
-    if (!Number.isSafeInteger(input) || input < 0) {
-        invalid(path, 'Expected a non-negative safe integer');
-    }
-    return input;
-}
 function operation(input, path) {
     if (input !== 'create' &&
         input !== 'read' &&
@@ -263,33 +160,3 @@ function evidence(input, path) {
         invalid(path, 'Expected allowed or owner');
     return input;
 }
-function record(input, path) {
-    if (input === undefined || input === null || Array.isArray(input) || typeof input !== 'object') {
-        invalid(path, 'Expected an object');
-    }
-    return input;
-}
-function array(input, path, minimum, maximum) {
-    if (!Array.isArray(input) || input.length < minimum || input.length > maximum) {
-        invalid(path, `Expected ${minimum}-${maximum} entries`);
-    }
-    return input;
-}
-function required(input, path) {
-    if (input === undefined)
-        invalid(path, 'Expected a value');
-    return input;
-}
-function exact(value, expected, path) {
-    const actual = Object.keys(value).sort(compare);
-    const wanted = [...expected].sort(compare);
-    if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
-        invalid(path, `Expected exactly ${expected.join(', ')}`);
-    }
-}
-function compare(left, right) {
-    return left < right ? -1 : left > right ? 1 : 0;
-}
-function invalid(path, message) {
-    throw new AuthValueError('AUTHORITY_PREDICATE_INVALID', message, path);
-}

package/dist/auth/authority/admission/references.d.ts

@@ -0,0 +1,13 @@
+import type { Key } from '@astrale-os/kernel-dsl/v1';
+import type { ClassRef, CoreRef } from '@astrale-os/kernel-dsl/v1/addressing';
+import type * as portable from '@astrale-os/kernel-dsl/value';
+/** One `{ origin, kind, name }` reference with a canonical origin and an unchecked kind and name. */
+export declare function absoluteRef(input: portable.Value | undefined, path: string): {
+    readonly origin: Key.Origin;
+    readonly kind: string;
+    readonly name: string;
+};
+export declare function classRef(input: portable.Value | undefined, path: string): ClassRef;
+export declare function coreRef(input: portable.Value | undefined, path: string): CoreRef;
+export declare function definitionName(input: string, path: string): void;
+export declare function domainOrigin(input: portable.Value | undefined, path: string): Key.Origin;

package/dist/auth/authority/admission/references.js

@@ -0,0 +1,38 @@
+import { patterns } from '@astrale-os/kernel-dsl/v1/addressing';
+import { exact, invalid, record } from './wire.js';
+/** One `{ origin, kind, name }` reference with a canonical origin and an unchecked kind and name. */
+export function absoluteRef(input, path) {
+    const value = record(input, path);
+    exact(value, ['kind', 'name', 'origin'], path);
+    const origin = domainOrigin(value.origin, `${path}/origin`);
+    if (typeof value.kind !== 'string')
+        invalid(`${path}/kind`, 'Expected a reference kind');
+    if (typeof value.name !== 'string')
+        invalid(`${path}/name`, 'Expected a reference name');
+    return { origin, kind: value.kind, name: value.name };
+}
+export function classRef(input, path) {
+    const value = absoluteRef(input, path);
+    if (value.kind !== 'class')
+        invalid(`${path}/kind`, 'Expected class');
+    definitionName(value.name, `${path}/name`);
+    return value;
+}
+export function coreRef(input, path) {
+    const value = absoluteRef(input, path);
+    if (value.kind !== 'core')
+        invalid(`${path}/kind`, 'Expected core');
+    if (!patterns.coreSlug.test(value.name))
+        invalid(`${path}/name`, 'Expected a Core slug');
+    return value;
+}
+export function definitionName(input, path) {
+    if (!patterns.memberName.test(input))
+        invalid(path, 'Expected a Definition member name');
+}
+export function domainOrigin(input, path) {
+    if (typeof input !== 'string' || !patterns.origin.test(input)) {
+        invalid(path, 'Expected a canonical Domain origin');
+    }
+    return input;
+}

package/dist/auth/authority/admission/term.d.ts

@@ -0,0 +1,6 @@
+import type * as portable from '@astrale-os/kernel-dsl/value';
+import type { Term } from '../language/index.js';
+/** Admit one term; `locals` and `subjectBound` are the lexical scope it may reference. */
+export declare function term(input: portable.Value | undefined, path: string, locals: ReadonlySet<number>, subjectBound: boolean): Term;
+/** A local id or repeat bound: a non-negative safe integer. */
+export declare function localId(input: portable.Value | undefined, path: string): number;

package/dist/auth/authority/admission/term.js

@@ -0,0 +1,60 @@
+import { isNodeId } from '../../../graph/node/index.js';
+import { absoluteRef, classRef, coreRef, definitionName, domainOrigin } from './references.js';
+import { exact, invalid, record } from './wire.js';
+/** Admit one term; `locals` and `subjectBound` are the lexical scope it may reference. */
+export function term(input, path, locals, subjectBound) {
+    const value = record(input, path);
+    switch (value.kind) {
+        case 'input':
+            exact(value, ['input', 'kind'], path);
+            if (value.input !== 'object' && value.input !== 'source' && value.input !== 'target') {
+                invalid(`${path}/input`, 'Expected object, source, or target');
+            }
+            return { kind: 'input', input: value.input };
+        case 'node':
+            exact(value, ['id', 'kind'], path);
+            if (!isNodeId(value.id))
+                invalid(`${path}/id`, 'Expected a canonical NodeId');
+            return { kind: 'node', id: value.id };
+        case 'class':
+            exact(value, ['kind', 'ref'], path);
+            return { kind: 'class', ref: classRef(value.ref, `${path}/ref`) };
+        case 'domain':
+            exact(value, ['kind', 'origin'], path);
+            return { kind: 'domain', origin: domainOrigin(value.origin, `${path}/origin`) };
+        case 'ref': {
+            exact(value, ['kind', 'ref'], path);
+            const ref = absoluteRef(value.ref, `${path}/ref`);
+            if (ref.kind === 'core')
+                return { kind: 'ref', ref: coreRef(value.ref, `${path}/ref`) };
+            if (!['class', 'function', 'policy', 'view'].includes(ref.kind))
+                invalid(`${path}/ref/kind`, 'Expected a projected Schema member');
+            definitionName(ref.name, `${path}/ref/name`);
+            return { kind: 'ref', ref: ref };
+        }
+        case 'core':
+            exact(value, ['kind', 'ref'], path);
+            return { kind: 'core', ref: coreRef(value.ref, `${path}/ref`) };
+        case 'local': {
+            exact(value, ['id', 'kind'], path);
+            const id = localId(value.id, `${path}/id`);
+            if (!locals.has(id))
+                invalid(`${path}/id`, `Local ${id} is outside its lexical scope`);
+            return { kind: 'local', id };
+        }
+        case 'subject':
+            exact(value, ['kind'], path);
+            if (!subjectBound)
+                invalid(path, 'Binder subject is outside its lexical scope');
+            return { kind: 'subject' };
+        default:
+            invalid(`${path}/kind`, 'Unsupported authority term');
+    }
+}
+/** A local id or repeat bound: a non-negative safe integer. */
+export function localId(input, path) {
+    if (!Number.isSafeInteger(input) || input < 0) {
+        invalid(path, 'Expected a non-negative safe integer');
+    }
+    return input;
+}

package/dist/auth/authority/admission/wire.d.ts

@@ -0,0 +1,8 @@
+import type * as portable from '@astrale-os/kernel-dsl/value';
+/** Fail admission at one JSON-pointer path with the stable Authority predicate code. */
+export declare function invalid(path: string, message: string): never;
+export declare function record(input: portable.Value | undefined, path: string): portable.Object;
+export declare function array(input: portable.Value | undefined, path: string, minimum: number, maximum: number): readonly portable.Value[];
+export declare function required(input: portable.Value | undefined, path: string): portable.Value;
+/** Reject a record whose own keys differ from `expected`, in any order. */
+export declare function exact(value: portable.Object, expected: readonly string[], path: string): void;

package/dist/auth/authority/admission/wire.js

@@ -0,0 +1,33 @@
+import { AuthValueError } from '../../error.js';
+/** Fail admission at one JSON-pointer path with the stable Authority predicate code. */
+export function invalid(path, message) {
+    throw new AuthValueError('AUTHORITY_PREDICATE_INVALID', message, path);
+}
+export function record(input, path) {
+    if (input === undefined || input === null || Array.isArray(input) || typeof input !== 'object') {
+        invalid(path, 'Expected an object');
+    }
+    return input;
+}
+export function array(input, path, minimum, maximum) {
+    if (!Array.isArray(input) || input.length < minimum || input.length > maximum) {
+        invalid(path, `Expected ${minimum}-${maximum} entries`);
+    }
+    return input;
+}
+export function required(input, path) {
+    if (input === undefined)
+        invalid(path, 'Expected a value');
+    return input;
+}
+/** Reject a record whose own keys differ from `expected`, in any order. */
+export function exact(value, expected, path) {
+    const actual = Object.keys(value).sort(compare);
+    const wanted = [...expected].sort(compare);
+    if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
+        invalid(path, `Expected exactly ${expected.join(', ')}`);
+    }
+}
+function compare(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}

package/dist/auth/authority/semantics/interpret.d.ts

@@ -15,6 +15,12 @@ export interface AuthorityEvaluationOptions {
      * as a captured fact table. Undefined leaves the atom to its meaning over the snapshot.
      */
     readonly atom?: (atom: AuthorityAtom, subject: NodeId | undefined) => boolean | undefined;
+    /**
+     * Pure observation of the snapshot's evidence token. It changes (Object.is) at every
+     * acquisition and stays stable otherwise; observing it must not acquire evidence.
+     * Stable snapshots may omit it. Tokens must not be mutated or reused across acquisitions.
+     */
+    readonly evidenceEpoch?: () => unknown;
 }
 /** Decisions of one program over one snapshot. Memoized evidence never outlives the evaluator. */
 export interface AuthorityEvaluator {

package/dist/auth/authority/semantics/interpret.js

@@ -10,6 +10,9 @@ export function createAuthorityEvaluator(program, snapshot, vocabulary, options
     const references = new Map();
     const closures = new Map();
     const projections = new Map();
+    const walks = new Map();
+    const walkPlans = new WeakMap();
+    const existentialPlans = new WeakMap();
     const instanceOf = classKey(vocabulary.instanceOf);
     const reference = (path) => {
         const known = references.get(path.raw);
@@ -65,7 +68,8 @@ export function createAuthorityEvaluator(program, snapshot, vocabulary, options
         const key = classKey(ref);
         let nodes = projections.get(key);
         if (nodes === undefined) {
-            nodes = Object.freeze([...new Set(snapshot.resolve(Path.project(ref)))].filter((node) => snapshot.node(node)));
+            const candidates = snapshot.classProjection?.(ref) ?? snapshot.resolve(Path.project(ref));
+            nodes = Object.freeze([...new Set(candidates)].filter((node) => snapshot.node(node)));
             projections.set(key, nodes);
         }
         return nodes;
@@ -77,19 +81,52 @@ export function createAuthorityEvaluator(program, snapshot, vocabulary, options
      * Bounded walks: a Node reached at any depth within [min, max], revisits allowed. Each hop may
      * take any member of the Edge Class extent.
      */
-    const related = (source, extent, target, repeat) => {
+    const related = (expression, source, target) => {
+        const { repeat, via: extent } = expression;
         const min = repeat?.min ?? 1;
         const max = repeat?.max ?? 1;
+        // The empty walk is already a proof. Do not spend a read budget exploring longer walks.
         if (min === 0 && source === target)
             return true;
-        let frontier = new Set([source]);
+        let plan = walkPlans.get(expression);
+        if (plan === undefined) {
+            const key = JSON.stringify([min, max, extent.map(classKey)]);
+            plan = walks.get(key);
+            if (plan === undefined) {
+                plan = new Map();
+                walks.set(key, plan);
+            }
+            walkPlans.set(expression, plan);
+        }
+        const epoch = options.evidenceEpoch?.();
+        let walk = plan.get(source);
+        if (walk === undefined || !Object.is(walk.epoch, epoch)) {
+            walk = { epoch, layers: [new Set([source])] };
+            plan.delete(source);
+        }
+        let frontier = walk.layers[0];
         for (let depth = 1; depth <= max && frontier.size > 0; depth++) {
-            const next = new Set();
-            for (const node of frontier) {
-                for (const edge of extent)
-                    for (const reached of step(node, edge))
-                        next.add(reached);
+            let next = walk.layers[depth];
+            if (next === undefined) {
+                const before = options.evidenceEpoch?.();
+                const acquired = new Set();
+                for (const node of frontier) {
+                    for (const edge of extent)
+                        for (const reached of step(node, edge))
+                            acquired.add(reached);
+                }
+                next = acquired;
+                walk.layers.push(next);
+                // Every retained layer must belong to the same epoch. A provisional prefix remains
+                // usable for this search only, even if its later extensions acquire no further evidence.
+                if (Object.is(walk.epoch, before) && Object.is(before, options.evidenceEpoch?.())) {
+                    plan.set(source, walk);
+                }
+                else {
+                    plan.delete(source);
+                }
             }
+            // Like the frozen interpreter, acquire no layer beyond the first admissible witness.
             if (depth >= min && next.has(target))
                 return true;
             frontier = next;
@@ -127,7 +164,7 @@ export function createAuthorityEvaluator(program, snapshot, vocabulary, options
             case 'same-node':
                 return term(expression.left, frame) === term(expression.right, frame);
             case 'related':
-                return related(term(expression.source, frame), expression.via, term(expression.target, frame), expression.repeat);
+                return related(expression, term(expression.source, frame), term(expression.target, frame));
             case 'instance-of':
                 return sameClass(classOf(term(expression.node, frame)), expression.class);
             case 'edge-class': {
@@ -155,13 +192,111 @@ export function createAuthorityEvaluator(program, snapshot, vocabulary, options
     };
     const exists = (expression, frame) => {
         const candidates = expression.nodes.map((local) => local.kind === 'any' ? snapshot.nodes() : snapshot.nodes(local.classes));
-        const bind = (index, locals) => {
-            if (index === expression.nodes.length)
-                return holds(expression.where, { ...frame, locals });
+        // Acquire every extent in declaration order, even when the product has no tuple.
+        if (candidates.some((extent) => extent.length === 0))
+            return false;
+        let plan = existentialPlans.get(expression);
+        if (plan === undefined) {
+            const predicates = expression.where.op === 'all' ? expression.where.predicates : [expression.where];
+            const usedIndices = new Set();
+            // Each entry describes the whole prefix, including its earlier true predicates.
+            // gates[i] rejects values of local i; resets[i] invalidates their earlier context.
+            const gates = expression.nodes.map(() => []);
+            const resets = expression.nodes.map(() => []);
+            const dependency = predicates.map((predicate, item) => {
+                const used = localDependencies(predicate);
+                for (let index = 0; index < expression.nodes.length; index++) {
+                    if (used.has(expression.nodes[index].id))
+                        usedIndices.add(index);
+                }
+                const ordered = [...usedIndices].sort((left, right) => left - right);
+                const last = ordered.at(-1) ?? -1;
+                const earlier = ordered.at(-2) ?? -1;
+                if (last >= 0)
+                    gates[last].push(item);
+                // An exclusion of the last dependency is valid only while all earlier ones stay fixed.
+                for (let index = 0; index <= earlier; index++)
+                    resets[index].push(item);
+                return last;
+            });
+            plan = { predicates, dependency, gates, resets };
+            existentialPlans.set(expression, plan);
+        }
+        const { predicates, dependency, gates, resets } = plan;
+        const excluded = predicates.map(() => new Set());
+        const rejected = (index, node) => {
+            for (const item of gates[index])
+                if (excluded[item].has(node))
+                    return true;
+            return false;
+        };
+        const clear = (item) => {
+            if (excluded[item].size === 0)
+                return;
+            excluded[item].clear();
+        };
+        let prefix = 0;
+        let observedEpoch = options.evidenceEpoch?.();
+        const refresh = () => {
+            const current = options.evidenceEpoch?.();
+            if (Object.is(current, observedEpoch))
+                return false;
+            observedEpoch = current;
+            prefix = 0;
+            excluded.forEach((_, item) => clear(item));
+            return true;
+        };
+        // -2 means a witness. Every other result identifies the last bound variable that
+        // may change the evaluated prefix. Descendants cannot alter its reads or result.
+        const locals = new Map(frame.locals);
+        const complete = { ...frame, locals };
+        const bind = (index) => {
+            if (index === expression.nodes.length) {
+                for (let item = prefix; item < predicates.length; item++) {
+                    if (!holds(predicates[item], complete)) {
+                        if (refresh())
+                            return expression.nodes.length - 1;
+                        const target = dependency[item];
+                        if (target >= 0) {
+                            const value = locals.get(expression.nodes[target].id);
+                            if (!excluded[item].has(value)) {
+                                excluded[item].add(value);
+                            }
+                        }
+                        return dependency[item];
+                    }
+                    prefix = item + 1;
+                }
+                return -2;
+            }
             const id = expression.nodes[index].id;
-            return candidates[index].some((node) => bind(index + 1, new Map([...locals, [id, node]])));
+            const previous = locals.get(id);
+            try {
+                for (let ordinal = 0; ordinal < candidates[index].length; ordinal++) {
+                    refresh();
+                    const node = candidates[index][ordinal];
+                    if (rejected(index, node)) {
+                        continue;
+                    }
+                    for (const item of resets[index])
+                        clear(item);
+                    while (prefix > 0 && dependency[prefix - 1] >= index)
+                        prefix--;
+                    locals.set(id, node);
+                    const result = bind(index + 1);
+                    if (result === -2 || result < index)
+                        return result;
+                }
+                return index - 1;
+            }
+            finally {
+                if (previous === undefined)
+                    locals.delete(id);
+                else
+                    locals.set(id, previous);
+            }
         };
-        return bind(0, frame.locals);
+        return bind(0) === -2;
     };
     return Object.freeze({
         admit() {
@@ -184,6 +319,44 @@ export function createAuthorityEvaluator(program, snapshot, vocabulary, options
         },
     });
 }
+/** Locals whose assignment can affect the result of this expression. */
+function localDependencies(expression) {
+    const result = new Set();
+    const addTerm = (term) => {
+        if (term.kind === 'local')
+            result.add(term.id);
+    };
+    const visit = (value) => {
+        switch (value.op) {
+            case 'all':
+            case 'any':
+                value.predicates.forEach(visit);
+                return;
+            case 'not':
+                visit(value.predicate);
+                return;
+            case 'as':
+            case 'exists':
+                visit(value.where);
+                return;
+            case 'same-node':
+                addTerm(value.left);
+                addTerm(value.right);
+                return;
+            case 'related':
+                addTerm(value.source);
+                addTerm(value.target);
+                return;
+            case 'instance-of':
+                addTerm(value.node);
+                return;
+            case 'class-authority':
+                addTerm(value.identity);
+        }
+    };
+    visit(expression);
+    return result;
+}
 /** Every Identity a binder of the program names, sorted. */
 export function binderRoots(expressions) {
     const roots = new Set();

package/dist/auth/authority/semantics/snapshot.d.ts

@@ -21,6 +21,12 @@ export interface AuthoritySnapshot {
     orientation(edge: ClassRef): 'directed' | 'undirected';
     /** Every live Node the Path reaches; a fixed term requires exactly one. */
     resolve(path: Path): readonly NodeId[];
+    /**
+     * Pinned Registry candidates for derived `instance_of`, admitted through `node` before use.
+     * An absent hook falls back to `resolve(Path.project(ref))`; an empty result never does.
+     * Fixed terms always use `resolve` independently of this projection.
+     */
+    classProjection?(ref: ClassRef): readonly NodeId[];
     /** Every live Node, restricted to exact Classes when given. */
     nodes(classes?: readonly ClassRef[]): readonly NodeId[];
 }

package/dist/graph/graph/index.d.ts

@@ -4,7 +4,7 @@ export type { Delta, DeltaConflict, DeltaResult } from './delta/index.js';
 export type { MergeConflict, MergeResult } from './merge/index.js';
 export { GraphData, GraphDataDecodeError, GraphSpec, GraphSpecDecodeError } from './model/index.js';
 export type { AnonymousNodeSpec, GraphDataJson, GraphSpecEdge, GraphSpecEndpoint, GraphSpecJson, GraphSpecNode, } from './model/index.js';
-export { LocalBinding, isLocalBinding } from './model/index.js';
+export { LocalAlias, isLocalAlias } from './model/index.js';
 export type { GraphAdmissionContext, GraphClassInfo, GraphDiagnostic } from './admission/index.js';
 export { GraphAdmissionError } from './admission/index.js';
 export type { GraphEdges, GraphNodes } from './indexes/index.js';