@btravstack/core 0.12.0 → 0.14.0

package/README.md

@@ -68,8 +68,8 @@ const ticker: Runtime<typeof Greeter> = {
       // and stays out of it. A timer has nowhere to return one, so it observes
       // it instead; dropping it would hide the work's `Err` *and* a `Defect`.
       void host
-        .run({ kind: "tick", id: `${Date.now()}` }, (ctx, signal) =>
-          signal.aborted ? Ok("") : Ok(ctx.get(Greeter).greet("world")),
+        .run({ kind: "tick", id: `${Date.now()}` }, (unit, signal) =>
+          signal.aborted ? Ok("") : Ok(unit.ctx.get(Greeter).greet("world")),
         )
         .tapFailure((failure) => {
           process.stderr.write(`${JSON.stringify({ tick: failure.tag })}\n`);
@@ -145,8 +145,9 @@ them and none should own a private copy:
   bad value is a `ConfigInvalid` naming every fault at once, and exit `78`.
 - **Teardown on every path**, with failing finalisers in
   `ExitReport.teardownErrors`, never masking the exit reason.
-- **A per-unit scope no handler manages** — pass a module as
-  `StartOptions.unit` and the kernel forks it around every unit.
+- **A per-unit scope no handler manages** — the runtime calls
+  `unit.fork(module, seed)` from inside `host.run`'s work callback, and the
+  kernel closes the scope when the unit settles.
 - **An ambient record, not an ambient container** — `currentUnit()` reads
   `{ unitId, traceId, tenantId, signal }`; services never travel
   there. `signal` is the very `AbortSignal` the unit's work callback is handed,

package/dist/index.cjs

@@ -613,15 +613,43 @@ const start = (module, options = {}) => {
 			runtimeName = runtime.name;
 			healthChecks = ctx.get(HealthChecks);
 			const runtimeCtx = ctx;
-			const unit = options.unit;
 			const run = (meta, work) => registry.run(meta, (signal) => {
-				if (unit === void 0) return work(runtimeCtx, signal);
-				const fork = _btravstack_di.Module.forkScope;
-				return fork(ctx, unit, (forked) => (0, unthrown.fromSafePromise)((async () => await work(forked, signal))()).flatMap((result) => result), { onTeardownError: (port, cause) => emit({
-					type: "teardownError",
-					port,
-					cause
-				}) });
+				const settled = Promise.withResolvers();
+				let closing;
+				let hasSettled = false;
+				const fork = (module, seed) => {
+					if (hasSettled) return (0, unthrown.fromSafePromise)(Promise.reject(/* @__PURE__ */ new Error("a unit forks after it has already settled")));
+					if (closing !== void 0) return (0, unthrown.fromSafePromise)(Promise.reject(/* @__PURE__ */ new Error("a unit forks its scope once")));
+					const ready = Promise.withResolvers();
+					closing = _btravstack_di.Module.forkScope(ctx, module, (forked) => {
+						ready.resolve(forked);
+						return (0, unthrown.fromSafePromise)(settled.promise);
+					}, {
+						seed,
+						onTeardownError: (port, cause) => emit({
+							type: "teardownError",
+							port,
+							cause
+						})
+					}).recoverDefect((cause) => {
+						ready.reject(cause);
+						return (0, unthrown.Ok)();
+					}).get();
+					return (0, unthrown.fromSafePromise)(ready.promise);
+				};
+				const outcome = (async () => {
+					try {
+						return await work({
+							ctx: runtimeCtx,
+							fork
+						}, signal);
+					} finally {
+						hasSettled = true;
+						settled.resolve();
+						if (closing !== void 0) await closing;
+					}
+				})();
+				return (0, unthrown.fromSafePromise)(outcome).flatMap((result) => result);
 			});
 			const host = {
 				ctx: runtimeCtx,

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import { AsyncResult, Result } from "unthrown";
-import { AnyPort, Context, Module, PortClass, PortInstance, Scope, ServiceOf } from "@btravstack/di";
+import { AnyPort, Context, DependencyGate, Module, PortClass, PortInstance, Scope, SeedEntry, ServiceOf } from "@btravstack/di";
 import { Env, Environment } from "@btravstack/config";
 //#region src/instrumentation.d.ts
 /**
@@ -31,7 +31,7 @@ declare const Instrumentations_base: import("@btravstack/di").ManyPortClass<"Ins
  * without it registers nothing and pays nothing — the Spring Boot starter
  * shape, in one port.
  */
-declare class Instrumentations extends Instrumentations_base<InstrumentationLoader> {}
+export declare class Instrumentations extends Instrumentations_base<InstrumentationLoader> {}
 //#endregion
 //#region src/health.d.ts
 declare const HealthCheckFailed_base: import("unthrown").TaggedErrorConstructor<"HealthCheckFailed">;
@@ -40,7 +40,7 @@ declare const HealthCheckFailed_base: import("unthrown").TaggedErrorConstructor<
  * a health check that throws is a bug in the check; one that fails is the news
  * `/healthz` exists to carry.
  */
-declare class HealthCheckFailed extends HealthCheckFailed_base<{
+export declare class HealthCheckFailed extends HealthCheckFailed_base<{
   readonly reason: string;
 }> {}
 /** One contribution: what to call the component, and how to ask it. */
@@ -57,7 +57,7 @@ declare const HealthChecks_base: import("@btravstack/di").ManyPortClass<"HealthC
  * application never composed contributes nothing — no registration call to
  * forget, and no order to get wrong.
  */
-declare class HealthChecks extends HealthChecks_base<HealthCheck> {}
+export declare class HealthChecks extends HealthChecks_base<HealthCheck> {}
 type ComponentHealth = {
   readonly name: string;
   readonly status: "healthy" | "unhealthy";
@@ -81,7 +81,7 @@ type HealthReport = {
  * escaped, the first would reach the kernel's own `uncaughtException` handler
  * and the second would leave `/healthz` hanging with nothing written.
  */
-declare const runHealthChecks: (checks: readonly HealthCheck[]) => AsyncResult<HealthReport, never>;
+export declare const runHealthChecks: (checks: readonly HealthCheck[]) => AsyncResult<HealthReport, never>;
 //#endregion
 //#region src/observability.d.ts
 /**
@@ -91,7 +91,7 @@ declare const runHealthChecks: (checks: readonly HealthCheck[]) => AsyncResult<H
  */
 type Level = "trace" | "debug" | "info" | "warn" | "error" | "fatal";
 /** The levels in order, least severe first — what `isEnabled` compares through. */
-declare const LEVELS: readonly Level[];
+export declare const LEVELS: readonly Level[];
 /**
  * What a line, a span or a measurement carries besides itself: a flat record of
  * scalars.
@@ -137,9 +137,9 @@ declare const Logger_base: import("@btravstack/di").PortClass<"Logger">;
  * problem into an outage. Synchronous `void`, not an `AsyncResult` — thesis 6's
  * one deliberate exemption, since a lost line is not a modeled error.
  */
-declare class Logger extends Logger_base<LoggerService> {}
+export declare class Logger extends Logger_base<LoggerService> {}
 /** A span's outcome: unset until something says otherwise, then `ok` or `error`. */
-declare const SPAN_STATUS: {
+export declare const SPAN_STATUS: {
   readonly unset: 0;
   readonly ok: 1;
   readonly error: 2;
@@ -169,7 +169,7 @@ declare const Tracer_base: import("@btravstack/di").PortClass<"Tracer">;
  * because a port typed as a vendor's type points the dependency arrow outwards
  * and makes the whole family install that vendor.
  */
-declare class Tracer extends Tracer_base<TracerService> {}
+export declare class Tracer extends Tracer_base<TracerService> {}
 /** A monotonic count. */
 type Counter = {
   readonly add: (value: number, attributes?: Attributes) => void;
@@ -196,7 +196,7 @@ type MeterService = {
 };
 declare const Meter_base: import("@btravstack/di").PortClass<"Meter">;
 /** The application's meter, as a port. See {@link Tracer} for why it does not name a vendor. */
-declare class Meter extends Meter_base<MeterService> {}
+export declare class Meter extends Meter_base<MeterService> {}
 //#endregion
 //#region src/observation.d.ts
 /**
@@ -277,9 +277,9 @@ declare const Observers_base: import("@btravstack/di").ManyPortClass<"Observers"
  * NOTHING provides is an unmet dependency, at plan time and in `Needs` alike.
  * Several no-ops in one graph cost a call each and nothing else.
  */
-declare class Observers extends Observers_base<(operation: Operation) => Settle> {}
+export declare class Observers extends Observers_base<(operation: Operation) => Settle> {}
 /** The no-op member every reader of {@link Observers} contributes, so the set is never empty. */
-declare const noObserver: () => Settle;
+export declare const noObserver: () => Settle;
 /**
  * Run every observer around one operation, and hand back the one finisher that
  * settles them all.
@@ -291,14 +291,14 @@ declare const noObserver: () => Settle;
  * `tapFailure` on the same chain, or a retry, is exactly the shape that fires
  * twice and doubles a failure count.
  */
-declare const observe: (observers: readonly ((operation: Operation) => Settle)[], operation: Operation) => Settle;
+export declare const observe: (observers: readonly ((operation: Operation) => Settle)[], operation: Operation) => Settle;
 //#endregion
 //#region src/clock.d.ts
 type Clock = {
   readonly now: () => number;
   readonly sleep: (ms: number, signal?: AbortSignal) => AsyncResult<void, never>;
 };
-declare const systemClock: Clock;
+export declare const systemClock: Clock;
 //#endregion
 //#region src/units.d.ts
 /**
@@ -317,7 +317,7 @@ type UnitRecord = {
   readonly tenantId: string | undefined;
   readonly signal: AbortSignal;
 };
-declare const currentUnit: () => UnitRecord | undefined;
+export declare const currentUnit: () => UnitRecord | undefined;
 /**
  * What a runtime says about one piece of work as it submits it. `kind` is the
  * category (`"http"`, `"tick"`, `"job"`); `id` identifies **this** unit.
@@ -350,7 +350,7 @@ type UnitRegistry = {
 //#endregion
 //#region src/runtime.d.ts
 declare const RuntimeStartFailed_base: import("unthrown").TaggedErrorConstructor<"RuntimeStartFailed">;
-declare class RuntimeStartFailed extends RuntimeStartFailed_base<{
+export declare class RuntimeStartFailed extends RuntimeStartFailed_base<{
   readonly runtime: string;
   readonly cause: unknown;
 }> {
@@ -372,11 +372,28 @@ declare class RuntimeStartFailed extends RuntimeStartFailed_base<{
  * `UnitMeta.id` must be unique per unit unless a `traceId` is supplied — see
  * {@link UnitMeta}.
  *
- * With a `StartOptions.unit` module in play, `work` runs only once the fork is
- * built. A runtime that subscribes to an event from inside `work` must first
- * check whether it has already fired.
+ * A runtime forks the unit's scope itself, through `UnitHost.fork`, at the
+ * moment it holds the unit's input; the kernel closes that scope when the
+ * unit settles, after the response is flushed. Work that subscribes to an
+ * event after a `fork` must first check whether it already fired.
  */
-type RunUnit<Resolves extends AnyPort> = <T, E>(meta: UnitMeta, work: (ctx: Context<InstanceType<Resolves>>, signal: AbortSignal) => ReturnType<UnitWork<T, E>>) => AsyncResult<T, E>;
+type RunUnit<Resolves extends AnyPort> = <T, E>(meta: UnitMeta, work: (unit: UnitHost<Resolves>, signal: AbortSignal) => ReturnType<UnitWork<T, E>>) => AsyncResult<T, E>;
+/**
+ * What the kernel hands a unit's work: the application context, and the one
+ * way to open the unit's own scope.
+ *
+ * `fork` builds `module` over the application context plus `seed` and hands
+ * the forked context back. The scope is torn down when the unit closes —
+ * inside the registry's unit, so the unit is not counted closed until its
+ * finalisers have run, and inside the unit's ambient record, so a teardown
+ * log line carries the unit's ids. A construction failure rides the unit's
+ * defect path. A unit forks once; a second call is a defect, and so is a call
+ * made after the unit has settled — nothing awaits that scope's teardown.
+ */
+type UnitHost<Resolves extends AnyPort> = {
+  readonly ctx: Context<InstanceType<Resolves>>;
+  readonly fork: <UnitX, N, Seeded extends AnyPort = never>(module: Module<UnitX, never, N> & DependencyGate<Exclude<N, InstanceType<Resolves> | InstanceType<Seeded> | Scope>>, seed: readonly SeedEntry<Seeded>[]) => AsyncResult<Context<InstanceType<Resolves> | UnitX | InstanceType<Seeded>>, never>;
+};
 /**
  * What a runtime is handed at `start`: the application services **and** the
  * kernel's {@link RunUnit}. Handing it a bare `Context` would leave every
@@ -388,8 +405,8 @@ type RunUnit<Resolves extends AnyPort> = <T, E>(meta: UnitMeta, work: (ctx: Cont
  * {@link RunUnit}), and `UnitMeta.id` must be unique per unit unless a
  * `traceId` is supplied (see {@link UnitMeta}).
  *
- * `ctx` is the **application** context: a port a `StartOptions.unit` module
- * provides exists only while a unit is open, so a runtime naming it in
+ * `ctx` is the **application** context: a port a unit's `fork` module provides
+ * exists only in the `Context` `fork` hands back, so a runtime naming it in
  * `resolves` is rejected at `start`'s call site.
  */
 type RuntimeHost<Resolves extends AnyPort> = {
@@ -425,13 +442,17 @@ type Runtime<Resolves extends AnyPort = never, Info = never> = {
  * process boots exactly one, while each carries its own `Resolves`/`Info` in
  * the type.
  */
-declare const RuntimePort: PortClass<"Runtime">;
+export declare const RuntimePort: PortClass<"Runtime">;
 /** The instance type every runtime port shares — `Extract` this from a module's exports to find its runtime. */
 type RuntimeInstance = InstanceType<PortClass<"Runtime">>;
 /** The `Runtime<Resolves, Info>` a module exports, or `never` when it exports none. */
 type RuntimeOf<X> = ServiceOf<Extract<X, RuntimeInstance>>;
-type RuntimeResolvesOf<X> = RuntimeOf<X> extends Runtime<infer Resolves, unknown> ? Resolves : never;
-type RuntimeInfoOf<X> = RuntimeOf<X> extends Runtime<AnyPort, infer Info> ? Info : never;
+type RuntimeResolvesOf<X> = RuntimeOf<X> extends {
+  readonly resolves: readonly (infer Resolves extends AnyPort)[];
+} ? Resolves : never;
+type RuntimeInfoOf<X> = RuntimeOf<X> extends {
+  readonly start: (host: never) => AsyncResult<Serving<infer Info>, RuntimeStartFailed>;
+} ? Info : never;
 /**
  * The trace id inside a W3C `traceparent` header, and nothing else of it.
  *
@@ -459,7 +480,7 @@ type RuntimeInfoOf<X> = RuntimeOf<X> extends Runtime<AnyPort, infer Info> ? Info
  * const traceId = typeof parent === "string" ? traceIdOfTraceparent(parent) : undefined;
  * ```
  */
-declare const traceIdOfTraceparent: (header: string) => string | undefined;
+export declare const traceIdOfTraceparent: (header: string) => string | undefined;
 /**
  * `running`, but no later than the kernel's drain deadline — the primitive a
  * `Serving.drain` needs when the work it awaits settles on somebody else's
@@ -479,7 +500,7 @@ declare const traceIdOfTraceparent: (header: string) => string | undefined;
  * (`drain.ts` uses `clock.sleep` for exactly that, so a fake clock can control
  * it) — do not fold the two together.
  */
-declare const releasedBy: (signal: AbortSignal, running: AsyncResult<void, never>) => AsyncResult<void, never>;
+export declare const releasedBy: (signal: AbortSignal, running: AsyncResult<void, never>) => AsyncResult<void, never>;
 //#endregion
 //#region src/drain.d.ts
 type DrainReport = {
@@ -539,7 +560,7 @@ type KernelEvent = {
   readonly cause: unknown;
 };
 type EventSink = (event: KernelEvent) => void;
-declare const stderrSink: EventSink;
+export declare const stderrSink: EventSink;
 //#endregion
 //#region src/phase.d.ts
 type Phase = "building" | "starting" | "serving" | "draining" | "stopping" | "exited";
@@ -555,26 +576,13 @@ type ExitReport = {
   readonly teardownErrors: readonly TeardownError[];
   readonly uptimeMs: number;
 };
-type StartOptions<UnitX = never, UnitNeeds = never> = {
+type StartOptions = {
   /**
    * The environment the graph is configured from, provided to it as the `Env`
    * port and read for the kernel's own `PROBE_PORT`. Defaults to
    * `process.env`.
    */
   readonly env?: Environment;
-  /**
-   * A module forked around **every unit** — a unit being one bounded piece of
-   * work, whatever the transport calls it: an HTTP request, a Temporal
-   * activity, an AMQP delivery. Built as the unit opens, torn down as it
-   * closes — while the unit's ambient record is still open — reading anything
-   * the application context carries.
-   *
-   * A failing unit finaliser is reported as a `teardownError` event and never
-   * in `ExitReport.teardownErrors`. With this option the unit's work runs only
-   * once the fork is built, so a runtime that subscribes to an event from
-   * inside its work must be ready for it to have already fired.
-   */
-  readonly unit?: Module<UnitX, never, UnitNeeds>;
   readonly clock?: Clock;
   readonly signals?: boolean;
   /**
@@ -627,15 +635,18 @@ type RunningApp<E, Info = never> = {
 /**
  * The phantom marker `start`, `runMain` and `Boot` all intersect onto their
  * `module` parameter: `unknown` — and invisible — when nothing the module
- * needs is unprovided, it exports a runtime, its exports cover what that
- * runtime resolves and they cover the unit module's needs; a diagnostic
- * otherwise, printed at the call site as the parameter type the argument did
- * not match.
+ * needs is unprovided, it exports a runtime and its exports cover what that
+ * runtime resolves; a diagnostic otherwise, printed at the call site as the
+ * parameter type the argument did not match.
  *
  * `unknown` is the satisfied arm because intersecting it leaves the module
  * type untouched. A runtime's `resolves` is checked against the module's
- * exports only, never the unit module's: `RuntimeHost.ctx` is the application
- * context, so a unit-only port would resolve to nothing there.
+ * exports only: `RuntimeHost.ctx` is the application context, so a port only
+ * a `fork` provides would resolve to nothing there. A `fork`'s own needs are
+ * not this marker's business at all — a `fork` module is forked over the
+ * application context, so its needs are exactly what a starter's own `needs`
+ * channel already asks the composition root to supply, and di's ordinary
+ * `UNSATISFIED DEPENDENCIES` gate is what refuses a root that does not.
  *
  * **Unmet needs are checked FIRST, and answered in di's own words rather than
  * a sentence of the kernel's.** A root that forgot `provides: [router]` used
@@ -654,10 +665,10 @@ type RunningApp<E, Info = never> = {
  * name is reached.
  */
 type PortIdOf<P> = P extends PortInstance<infer Id, infer _Service> ? Id : P;
-type StartGate<X, UnitNeeds = never, N = never> = [Exclude<N, Scope | Env>] extends [never] ? [Extract<X, RuntimeInstance>] extends [never] ? "NO RUNTIME — the module exports no port declared over RuntimePort" : [InstanceType<RuntimeResolvesOf<X>>] extends [X] ? [Exclude<UnitNeeds, X | Scope | Env>] extends [never] ? unknown : "UNSATISFIED UNIT NEEDS — the unit module needs a port the module does not export" : "UNSATISFIED RUNTIME PORTS — the runtime resolves a port the module does not export" : {
+type StartGate<X, N = never> = [Exclude<N, Scope | Env>] extends [never] ? [Extract<X, RuntimeInstance>] extends [never] ? "NO RUNTIME — the module exports no port declared over RuntimePort" : [InstanceType<RuntimeResolvesOf<X>>] extends [X] ? unknown : "UNSATISFIED RUNTIME PORTS — the runtime resolves a port the module does not export" : {
   readonly "UNSATISFIED DEPENDENCIES — nothing provides": PortIdOf<Exclude<N, Scope | Env>>;
 };
-declare const start: <X, E, N, UnitX = never, UnitNeeds = never>(module: Module<X, E, N> & StartGate<X, UnitNeeds, N>, options?: StartOptions<UnitX, UnitNeeds>) => RunningApp<E, RuntimeInfoOf<X>>;
+export declare const start: <X, E, N>(module: Module<X, E, N> & StartGate<X, N>, options?: StartOptions) => RunningApp<E, RuntimeInfoOf<X>>;
 //#endregion
 //#region src/run-main.d.ts
 /**
@@ -692,6 +703,6 @@ declare const start: <X, E, N, UnitX = never, UnitNeeds = never>(module: Module<
  * await runMain(OrderApi);
  * ```
  */
-declare const runMain: <X, E, N, UnitX = never, UnitNeeds = never>(module: Module<X, E, N> & StartGate<X, UnitNeeds, N>, options?: StartOptions<UnitX, UnitNeeds>, exit?: (code: number) => void) => Promise<void>;
+export declare const runMain: <X, E, N>(module: Module<X, E, N> & StartGate<X, N>, options?: StartOptions, exit?: (code: number) => void) => Promise<void>;
 //#endregion
-export { type Attributes, type Clock, type ComponentHealth, type Counter, type DrainReport, type EventSink, type ExitReport, type HealthCheck, HealthCheckFailed, HealthChecks, type HealthReport, type Histogram, type InstrumentationLoader, Instrumentations, type KernelEvent, LEVELS, type Level, Logger, type LoggerService, Meter, type MeterService, Observers, type Operation, type Phase, type RunUnit, type RunningApp, type Runtime, type RuntimeHost, type RuntimeInfoOf, RuntimePort, RuntimeStartFailed, SPAN_STATUS, type Serving, type Settle, type Settled, type Span, type SpanStatusCode, type StartGate, type StartOptions, type TeardownError, Tracer, type TracerService, type UnitMeta, type UnitRecord, type UnitRegistry, type UnitWork, currentUnit, noObserver, observe, releasedBy, runHealthChecks, runMain, start, stderrSink, systemClock, traceIdOfTraceparent };
+export type { Attributes, Clock, ComponentHealth, Counter, DrainReport, EventSink, ExitReport, HealthCheck, HealthReport, Histogram, InstrumentationLoader, KernelEvent, Level, LoggerService, MeterService, Operation, Phase, RunUnit, RunningApp, Runtime, RuntimeHost, RuntimeInfoOf, Serving, Settle, Settled, Span, SpanStatusCode, StartGate, StartOptions, TeardownError, TracerService, UnitHost, UnitMeta, UnitRecord, UnitRegistry, UnitWork };

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { AnyPort, Context, Module, PortClass, PortInstance, Scope, ServiceOf } from "@btravstack/di";
+import { AnyPort, Context, DependencyGate, Module, PortClass, PortInstance, Scope, SeedEntry, ServiceOf } from "@btravstack/di";
 import { AsyncResult, Result } from "unthrown";
 import { Env, Environment } from "@btravstack/config";
 //#region src/instrumentation.d.ts
@@ -31,7 +31,7 @@ declare const Instrumentations_base: import("@btravstack/di").ManyPortClass<"Ins
  * without it registers nothing and pays nothing — the Spring Boot starter
  * shape, in one port.
  */
-declare class Instrumentations extends Instrumentations_base<InstrumentationLoader> {}
+export declare class Instrumentations extends Instrumentations_base<InstrumentationLoader> {}
 //#endregion
 //#region src/health.d.ts
 declare const HealthCheckFailed_base: import("unthrown").TaggedErrorConstructor<"HealthCheckFailed">;
@@ -40,7 +40,7 @@ declare const HealthCheckFailed_base: import("unthrown").TaggedErrorConstructor<
  * a health check that throws is a bug in the check; one that fails is the news
  * `/healthz` exists to carry.
  */
-declare class HealthCheckFailed extends HealthCheckFailed_base<{
+export declare class HealthCheckFailed extends HealthCheckFailed_base<{
   readonly reason: string;
 }> {}
 /** One contribution: what to call the component, and how to ask it. */
@@ -57,7 +57,7 @@ declare const HealthChecks_base: import("@btravstack/di").ManyPortClass<"HealthC
  * application never composed contributes nothing — no registration call to
  * forget, and no order to get wrong.
  */
-declare class HealthChecks extends HealthChecks_base<HealthCheck> {}
+export declare class HealthChecks extends HealthChecks_base<HealthCheck> {}
 type ComponentHealth = {
   readonly name: string;
   readonly status: "healthy" | "unhealthy";
@@ -81,7 +81,7 @@ type HealthReport = {
  * escaped, the first would reach the kernel's own `uncaughtException` handler
  * and the second would leave `/healthz` hanging with nothing written.
  */
-declare const runHealthChecks: (checks: readonly HealthCheck[]) => AsyncResult<HealthReport, never>;
+export declare const runHealthChecks: (checks: readonly HealthCheck[]) => AsyncResult<HealthReport, never>;
 //#endregion
 //#region src/observability.d.ts
 /**
@@ -91,7 +91,7 @@ declare const runHealthChecks: (checks: readonly HealthCheck[]) => AsyncResult<H
  */
 type Level = "trace" | "debug" | "info" | "warn" | "error" | "fatal";
 /** The levels in order, least severe first — what `isEnabled` compares through. */
-declare const LEVELS: readonly Level[];
+export declare const LEVELS: readonly Level[];
 /**
  * What a line, a span or a measurement carries besides itself: a flat record of
  * scalars.
@@ -137,9 +137,9 @@ declare const Logger_base: import("@btravstack/di").PortClass<"Logger">;
  * problem into an outage. Synchronous `void`, not an `AsyncResult` — thesis 6's
  * one deliberate exemption, since a lost line is not a modeled error.
  */
-declare class Logger extends Logger_base<LoggerService> {}
+export declare class Logger extends Logger_base<LoggerService> {}
 /** A span's outcome: unset until something says otherwise, then `ok` or `error`. */
-declare const SPAN_STATUS: {
+export declare const SPAN_STATUS: {
   readonly unset: 0;
   readonly ok: 1;
   readonly error: 2;
@@ -169,7 +169,7 @@ declare const Tracer_base: import("@btravstack/di").PortClass<"Tracer">;
  * because a port typed as a vendor's type points the dependency arrow outwards
  * and makes the whole family install that vendor.
  */
-declare class Tracer extends Tracer_base<TracerService> {}
+export declare class Tracer extends Tracer_base<TracerService> {}
 /** A monotonic count. */
 type Counter = {
   readonly add: (value: number, attributes?: Attributes) => void;
@@ -196,7 +196,7 @@ type MeterService = {
 };
 declare const Meter_base: import("@btravstack/di").PortClass<"Meter">;
 /** The application's meter, as a port. See {@link Tracer} for why it does not name a vendor. */
-declare class Meter extends Meter_base<MeterService> {}
+export declare class Meter extends Meter_base<MeterService> {}
 //#endregion
 //#region src/observation.d.ts
 /**
@@ -277,9 +277,9 @@ declare const Observers_base: import("@btravstack/di").ManyPortClass<"Observers"
  * NOTHING provides is an unmet dependency, at plan time and in `Needs` alike.
  * Several no-ops in one graph cost a call each and nothing else.
  */
-declare class Observers extends Observers_base<(operation: Operation) => Settle> {}
+export declare class Observers extends Observers_base<(operation: Operation) => Settle> {}
 /** The no-op member every reader of {@link Observers} contributes, so the set is never empty. */
-declare const noObserver: () => Settle;
+export declare const noObserver: () => Settle;
 /**
  * Run every observer around one operation, and hand back the one finisher that
  * settles them all.
@@ -291,14 +291,14 @@ declare const noObserver: () => Settle;
  * `tapFailure` on the same chain, or a retry, is exactly the shape that fires
  * twice and doubles a failure count.
  */
-declare const observe: (observers: readonly ((operation: Operation) => Settle)[], operation: Operation) => Settle;
+export declare const observe: (observers: readonly ((operation: Operation) => Settle)[], operation: Operation) => Settle;
 //#endregion
 //#region src/clock.d.ts
 type Clock = {
   readonly now: () => number;
   readonly sleep: (ms: number, signal?: AbortSignal) => AsyncResult<void, never>;
 };
-declare const systemClock: Clock;
+export declare const systemClock: Clock;
 //#endregion
 //#region src/units.d.ts
 /**
@@ -317,7 +317,7 @@ type UnitRecord = {
   readonly tenantId: string | undefined;
   readonly signal: AbortSignal;
 };
-declare const currentUnit: () => UnitRecord | undefined;
+export declare const currentUnit: () => UnitRecord | undefined;
 /**
  * What a runtime says about one piece of work as it submits it. `kind` is the
  * category (`"http"`, `"tick"`, `"job"`); `id` identifies **this** unit.
@@ -350,7 +350,7 @@ type UnitRegistry = {
 //#endregion
 //#region src/runtime.d.ts
 declare const RuntimeStartFailed_base: import("unthrown").TaggedErrorConstructor<"RuntimeStartFailed">;
-declare class RuntimeStartFailed extends RuntimeStartFailed_base<{
+export declare class RuntimeStartFailed extends RuntimeStartFailed_base<{
   readonly runtime: string;
   readonly cause: unknown;
 }> {
@@ -372,11 +372,28 @@ declare class RuntimeStartFailed extends RuntimeStartFailed_base<{
  * `UnitMeta.id` must be unique per unit unless a `traceId` is supplied — see
  * {@link UnitMeta}.
  *
- * With a `StartOptions.unit` module in play, `work` runs only once the fork is
- * built. A runtime that subscribes to an event from inside `work` must first
- * check whether it has already fired.
+ * A runtime forks the unit's scope itself, through `UnitHost.fork`, at the
+ * moment it holds the unit's input; the kernel closes that scope when the
+ * unit settles, after the response is flushed. Work that subscribes to an
+ * event after a `fork` must first check whether it already fired.
  */
-type RunUnit<Resolves extends AnyPort> = <T, E>(meta: UnitMeta, work: (ctx: Context<InstanceType<Resolves>>, signal: AbortSignal) => ReturnType<UnitWork<T, E>>) => AsyncResult<T, E>;
+type RunUnit<Resolves extends AnyPort> = <T, E>(meta: UnitMeta, work: (unit: UnitHost<Resolves>, signal: AbortSignal) => ReturnType<UnitWork<T, E>>) => AsyncResult<T, E>;
+/**
+ * What the kernel hands a unit's work: the application context, and the one
+ * way to open the unit's own scope.
+ *
+ * `fork` builds `module` over the application context plus `seed` and hands
+ * the forked context back. The scope is torn down when the unit closes —
+ * inside the registry's unit, so the unit is not counted closed until its
+ * finalisers have run, and inside the unit's ambient record, so a teardown
+ * log line carries the unit's ids. A construction failure rides the unit's
+ * defect path. A unit forks once; a second call is a defect, and so is a call
+ * made after the unit has settled — nothing awaits that scope's teardown.
+ */
+type UnitHost<Resolves extends AnyPort> = {
+  readonly ctx: Context<InstanceType<Resolves>>;
+  readonly fork: <UnitX, N, Seeded extends AnyPort = never>(module: Module<UnitX, never, N> & DependencyGate<Exclude<N, InstanceType<Resolves> | InstanceType<Seeded> | Scope>>, seed: readonly SeedEntry<Seeded>[]) => AsyncResult<Context<InstanceType<Resolves> | UnitX | InstanceType<Seeded>>, never>;
+};
 /**
  * What a runtime is handed at `start`: the application services **and** the
  * kernel's {@link RunUnit}. Handing it a bare `Context` would leave every
@@ -388,8 +405,8 @@ type RunUnit<Resolves extends AnyPort> = <T, E>(meta: UnitMeta, work: (ctx: Cont
  * {@link RunUnit}), and `UnitMeta.id` must be unique per unit unless a
  * `traceId` is supplied (see {@link UnitMeta}).
  *
- * `ctx` is the **application** context: a port a `StartOptions.unit` module
- * provides exists only while a unit is open, so a runtime naming it in
+ * `ctx` is the **application** context: a port a unit's `fork` module provides
+ * exists only in the `Context` `fork` hands back, so a runtime naming it in
  * `resolves` is rejected at `start`'s call site.
  */
 type RuntimeHost<Resolves extends AnyPort> = {
@@ -425,13 +442,17 @@ type Runtime<Resolves extends AnyPort = never, Info = never> = {
  * process boots exactly one, while each carries its own `Resolves`/`Info` in
  * the type.
  */
-declare const RuntimePort: PortClass<"Runtime">;
+export declare const RuntimePort: PortClass<"Runtime">;
 /** The instance type every runtime port shares — `Extract` this from a module's exports to find its runtime. */
 type RuntimeInstance = InstanceType<PortClass<"Runtime">>;
 /** The `Runtime<Resolves, Info>` a module exports, or `never` when it exports none. */
 type RuntimeOf<X> = ServiceOf<Extract<X, RuntimeInstance>>;
-type RuntimeResolvesOf<X> = RuntimeOf<X> extends Runtime<infer Resolves, unknown> ? Resolves : never;
-type RuntimeInfoOf<X> = RuntimeOf<X> extends Runtime<AnyPort, infer Info> ? Info : never;
+type RuntimeResolvesOf<X> = RuntimeOf<X> extends {
+  readonly resolves: readonly (infer Resolves extends AnyPort)[];
+} ? Resolves : never;
+type RuntimeInfoOf<X> = RuntimeOf<X> extends {
+  readonly start: (host: never) => AsyncResult<Serving<infer Info>, RuntimeStartFailed>;
+} ? Info : never;
 /**
  * The trace id inside a W3C `traceparent` header, and nothing else of it.
  *
@@ -459,7 +480,7 @@ type RuntimeInfoOf<X> = RuntimeOf<X> extends Runtime<AnyPort, infer Info> ? Info
  * const traceId = typeof parent === "string" ? traceIdOfTraceparent(parent) : undefined;
  * ```
  */
-declare const traceIdOfTraceparent: (header: string) => string | undefined;
+export declare const traceIdOfTraceparent: (header: string) => string | undefined;
 /**
  * `running`, but no later than the kernel's drain deadline — the primitive a
  * `Serving.drain` needs when the work it awaits settles on somebody else's
@@ -479,7 +500,7 @@ declare const traceIdOfTraceparent: (header: string) => string | undefined;
  * (`drain.ts` uses `clock.sleep` for exactly that, so a fake clock can control
  * it) — do not fold the two together.
  */
-declare const releasedBy: (signal: AbortSignal, running: AsyncResult<void, never>) => AsyncResult<void, never>;
+export declare const releasedBy: (signal: AbortSignal, running: AsyncResult<void, never>) => AsyncResult<void, never>;
 //#endregion
 //#region src/drain.d.ts
 type DrainReport = {
@@ -539,7 +560,7 @@ type KernelEvent = {
   readonly cause: unknown;
 };
 type EventSink = (event: KernelEvent) => void;
-declare const stderrSink: EventSink;
+export declare const stderrSink: EventSink;
 //#endregion
 //#region src/phase.d.ts
 type Phase = "building" | "starting" | "serving" | "draining" | "stopping" | "exited";
@@ -555,26 +576,13 @@ type ExitReport = {
   readonly teardownErrors: readonly TeardownError[];
   readonly uptimeMs: number;
 };
-type StartOptions<UnitX = never, UnitNeeds = never> = {
+type StartOptions = {
   /**
    * The environment the graph is configured from, provided to it as the `Env`
    * port and read for the kernel's own `PROBE_PORT`. Defaults to
    * `process.env`.
    */
   readonly env?: Environment;
-  /**
-   * A module forked around **every unit** — a unit being one bounded piece of
-   * work, whatever the transport calls it: an HTTP request, a Temporal
-   * activity, an AMQP delivery. Built as the unit opens, torn down as it
-   * closes — while the unit's ambient record is still open — reading anything
-   * the application context carries.
-   *
-   * A failing unit finaliser is reported as a `teardownError` event and never
-   * in `ExitReport.teardownErrors`. With this option the unit's work runs only
-   * once the fork is built, so a runtime that subscribes to an event from
-   * inside its work must be ready for it to have already fired.
-   */
-  readonly unit?: Module<UnitX, never, UnitNeeds>;
   readonly clock?: Clock;
   readonly signals?: boolean;
   /**
@@ -627,15 +635,18 @@ type RunningApp<E, Info = never> = {
 /**
  * The phantom marker `start`, `runMain` and `Boot` all intersect onto their
  * `module` parameter: `unknown` — and invisible — when nothing the module
- * needs is unprovided, it exports a runtime, its exports cover what that
- * runtime resolves and they cover the unit module's needs; a diagnostic
- * otherwise, printed at the call site as the parameter type the argument did
- * not match.
+ * needs is unprovided, it exports a runtime and its exports cover what that
+ * runtime resolves; a diagnostic otherwise, printed at the call site as the
+ * parameter type the argument did not match.
  *
  * `unknown` is the satisfied arm because intersecting it leaves the module
  * type untouched. A runtime's `resolves` is checked against the module's
- * exports only, never the unit module's: `RuntimeHost.ctx` is the application
- * context, so a unit-only port would resolve to nothing there.
+ * exports only: `RuntimeHost.ctx` is the application context, so a port only
+ * a `fork` provides would resolve to nothing there. A `fork`'s own needs are
+ * not this marker's business at all — a `fork` module is forked over the
+ * application context, so its needs are exactly what a starter's own `needs`
+ * channel already asks the composition root to supply, and di's ordinary
+ * `UNSATISFIED DEPENDENCIES` gate is what refuses a root that does not.
  *
  * **Unmet needs are checked FIRST, and answered in di's own words rather than
  * a sentence of the kernel's.** A root that forgot `provides: [router]` used
@@ -654,10 +665,10 @@ type RunningApp<E, Info = never> = {
  * name is reached.
  */
 type PortIdOf<P> = P extends PortInstance<infer Id, infer _Service> ? Id : P;
-type StartGate<X, UnitNeeds = never, N = never> = [Exclude<N, Scope | Env>] extends [never] ? [Extract<X, RuntimeInstance>] extends [never] ? "NO RUNTIME — the module exports no port declared over RuntimePort" : [InstanceType<RuntimeResolvesOf<X>>] extends [X] ? [Exclude<UnitNeeds, X | Scope | Env>] extends [never] ? unknown : "UNSATISFIED UNIT NEEDS — the unit module needs a port the module does not export" : "UNSATISFIED RUNTIME PORTS — the runtime resolves a port the module does not export" : {
+type StartGate<X, N = never> = [Exclude<N, Scope | Env>] extends [never] ? [Extract<X, RuntimeInstance>] extends [never] ? "NO RUNTIME — the module exports no port declared over RuntimePort" : [InstanceType<RuntimeResolvesOf<X>>] extends [X] ? unknown : "UNSATISFIED RUNTIME PORTS — the runtime resolves a port the module does not export" : {
   readonly "UNSATISFIED DEPENDENCIES — nothing provides": PortIdOf<Exclude<N, Scope | Env>>;
 };
-declare const start: <X, E, N, UnitX = never, UnitNeeds = never>(module: Module<X, E, N> & StartGate<X, UnitNeeds, N>, options?: StartOptions<UnitX, UnitNeeds>) => RunningApp<E, RuntimeInfoOf<X>>;
+export declare const start: <X, E, N>(module: Module<X, E, N> & StartGate<X, N>, options?: StartOptions) => RunningApp<E, RuntimeInfoOf<X>>;
 //#endregion
 //#region src/run-main.d.ts
 /**
@@ -692,6 +703,6 @@ declare const start: <X, E, N, UnitX = never, UnitNeeds = never>(module: Module<
  * await runMain(OrderApi);
  * ```
  */
-declare const runMain: <X, E, N, UnitX = never, UnitNeeds = never>(module: Module<X, E, N> & StartGate<X, UnitNeeds, N>, options?: StartOptions<UnitX, UnitNeeds>, exit?: (code: number) => void) => Promise<void>;
+export declare const runMain: <X, E, N>(module: Module<X, E, N> & StartGate<X, N>, options?: StartOptions, exit?: (code: number) => void) => Promise<void>;
 //#endregion
-export { type Attributes, type Clock, type ComponentHealth, type Counter, type DrainReport, type EventSink, type ExitReport, type HealthCheck, HealthCheckFailed, HealthChecks, type HealthReport, type Histogram, type InstrumentationLoader, Instrumentations, type KernelEvent, LEVELS, type Level, Logger, type LoggerService, Meter, type MeterService, Observers, type Operation, type Phase, type RunUnit, type RunningApp, type Runtime, type RuntimeHost, type RuntimeInfoOf, RuntimePort, RuntimeStartFailed, SPAN_STATUS, type Serving, type Settle, type Settled, type Span, type SpanStatusCode, type StartGate, type StartOptions, type TeardownError, Tracer, type TracerService, type UnitMeta, type UnitRecord, type UnitRegistry, type UnitWork, currentUnit, noObserver, observe, releasedBy, runHealthChecks, runMain, start, stderrSink, systemClock, traceIdOfTraceparent };
+export type { Attributes, Clock, ComponentHealth, Counter, DrainReport, EventSink, ExitReport, HealthCheck, HealthReport, Histogram, InstrumentationLoader, KernelEvent, Level, LoggerService, MeterService, Operation, Phase, RunUnit, RunningApp, Runtime, RuntimeHost, RuntimeInfoOf, Serving, Settle, Settled, Span, SpanStatusCode, StartGate, StartOptions, TeardownError, TracerService, UnitHost, UnitMeta, UnitRecord, UnitRegistry, UnitWork };

package/dist/index.mjs

@@ -612,15 +612,43 @@ const start = (module, options = {}) => {
 			runtimeName = runtime.name;
 			healthChecks = ctx.get(HealthChecks);
 			const runtimeCtx = ctx;
-			const unit = options.unit;
 			const run = (meta, work) => registry.run(meta, (signal) => {
-				if (unit === void 0) return work(runtimeCtx, signal);
-				const fork = Module.forkScope;
-				return fork(ctx, unit, (forked) => fromSafePromise((async () => await work(forked, signal))()).flatMap((result) => result), { onTeardownError: (port, cause) => emit({
-					type: "teardownError",
-					port,
-					cause
-				}) });
+				const settled = Promise.withResolvers();
+				let closing;
+				let hasSettled = false;
+				const fork = (module, seed) => {
+					if (hasSettled) return fromSafePromise(Promise.reject(/* @__PURE__ */ new Error("a unit forks after it has already settled")));
+					if (closing !== void 0) return fromSafePromise(Promise.reject(/* @__PURE__ */ new Error("a unit forks its scope once")));
+					const ready = Promise.withResolvers();
+					closing = Module.forkScope(ctx, module, (forked) => {
+						ready.resolve(forked);
+						return fromSafePromise(settled.promise);
+					}, {
+						seed,
+						onTeardownError: (port, cause) => emit({
+							type: "teardownError",
+							port,
+							cause
+						})
+					}).recoverDefect((cause) => {
+						ready.reject(cause);
+						return Ok();
+					}).get();
+					return fromSafePromise(ready.promise);
+				};
+				const outcome = (async () => {
+					try {
+						return await work({
+							ctx: runtimeCtx,
+							fork
+						}, signal);
+					} finally {
+						hasSettled = true;
+						settled.resolve();
+						if (closing !== void 0) await closing;
+					}
+				})();
+				return fromSafePromise(outcome).flatMap((result) => result);
 			});
 			const host = {
 				ctx: runtimeCtx,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@btravstack/core",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "description": "The application kernel: boot a di module into a running process, and stop it without losing work",
   "keywords": [
     "application",
@@ -45,21 +45,21 @@
     "./package.json": "./package.json"
   },
   "devDependencies": {
-    "@btravstack/tsconfig": "0.2.0",
-    "@types/node": "26.4.0",
-    "@unthrown/vitest": "5.7.0",
+    "@btravstack/tsconfig": "0.4.0",
+    "@types/node": "26.4.1",
+    "@unthrown/vitest": "5.8.0",
     "@vitest/coverage-v8": "4.1.11",
-    "tsdown": "0.22.14",
+    "tsdown": "0.23.0",
     "typescript": "7.0.2",
-    "unthrown": "5.7.0",
+    "unthrown": "5.8.0",
     "vitest": "4.1.11",
-    "@btravstack/config": "0.12.0",
-    "@btravstack/di": "0.12.0"
+    "@btravstack/config": "0.14.0",
+    "@btravstack/di": "0.14.0"
   },
   "peerDependencies": {
     "unthrown": "^5.0.0",
-    "@btravstack/config": "^0.12.0",
-    "@btravstack/di": "^0.12.0"
+    "@btravstack/config": "^0.14.0",
+    "@btravstack/di": "^0.14.0"
   },
   "engines": {
     "node": ">=22"