@camstack/system 1.2.313 → 1.2.314

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { $ as compositionSliceKey, K as buildCapabilityLookup, Ln as DeviceType, Q as composerCapability, Sn as toExpressionValue, Z as composedDeviceStableId, c as COMPOSER_ADDON_ID, et as compositionSourceKey, g as DeclaredDevices, i as BaseDevice, ir as EventCategory, jn as BaseAddon, kn as errMsg, t as ALL_CAPABILITY_DEFINITIONS, tn as planComposition, xt as evaluateCompositionField } from "../../dist-Cj7pJmXq.mjs";
-import { n as parseDeviceStateChanged, t as isRecord } from "../../device-state-changed-DoBbkyEI.mjs";
+import { $ as compositionFieldKey, Bn as BaseAddon, Fn as toExpressionValue, J as buildCapabilityLookup, Mn as compositionItemFieldPath, Nn as compositionSliceKey, On as COMPOSER_ADDON_ID, Pn as compositionSourceKey, Q as composerCapability, Rn as DeviceType, bt as evaluateCompositionField, c as COMPOSED_ITEM_FIXED_FIELDS, en as planComposition, g as DeclaredDevices, i as BaseDevice, jn as composedDeviceStableId, t as ALL_CAPABILITY_DEFINITIONS, ur as EventCategory, zn as errMsg } from "../../dist-cH4t1ZEm.mjs";
+import { n as parseDeviceStateChanged, t as isRecord$1 } from "../../device-state-changed-DoBbkyEI.mjs";
 import { z } from "zod";
 //#region src/builtins/composer/composed-device.ts
 /**
@@ -80,6 +80,217 @@ function isComposedDevice(device) {
 	return device instanceof ComposedDevice;
 }
 //#endregion
+//#region src/builtins/composer/claim-gate.ts
+function claimKey(k) {
+	return `${k.owner}@${k.deviceId}#${k.capName}`;
+}
+var RELEASE_CONFIRMATIONS = 2;
+function entryOf$1(key) {
+	return {
+		key,
+		misses: 0,
+		attempts: 0
+	};
+}
+var ClaimGate = class {
+	logger;
+	known = /* @__PURE__ */ new Map();
+	constructor(logger) {
+		this.logger = logger;
+	}
+	/**
+	* The claims the hub holds before this process applied anything. Called once
+	* at boot, before the first `filter`. A claim the gate already knows keeps its
+	* entry and its miss count.
+	*/
+	seed(claims) {
+		const fresh = claims.filter((c) => !this.known.has(claimKey(c)));
+		this.known = new Map([...this.known, ...fresh.map((c) => [claimKey(c), entryOf$1({
+			deviceId: c.deviceId,
+			capName: c.capName,
+			owner: c.owner
+		})])]);
+	}
+	/** Every claim known under one owner — what a block whose plan is held keeps (D659 placeholder rule). */
+	claimsOf(owner) {
+		return [...this.known.values()].filter((e) => e.key.owner === owner).map((e) => e.key);
+	}
+	/**
+	* Learn `wanted` and answer the claims to release NOW: those absent from
+	* `wanted` on two consecutive calls, plus those whose earlier release the hub
+	* has not confirmed yet. A claim wanted again starts from zero misses.
+	*/
+	filter(wanted) {
+		const present = new Map(wanted.map((k) => [claimKey(k), k]));
+		const next = /* @__PURE__ */ new Map();
+		const releases = [];
+		for (const [key, entry] of this.known) {
+			if (present.has(key)) {
+				next.set(key, {
+					...entry,
+					misses: 0,
+					attempts: 0
+				});
+				continue;
+			}
+			const misses = Math.min(entry.misses + 1, RELEASE_CONFIRMATIONS);
+			if (misses < RELEASE_CONFIRMATIONS) this.logger.warn("a claim vanished from one apply — it is kept until a second apply agrees", {
+				tags: this.tagsOf(entry.key),
+				meta: {
+					...this.metaOf(entry.key),
+					misses
+				}
+			});
+			else {
+				if (entry.misses < RELEASE_CONFIRMATIONS) this.logger.info("a claim is unwanted on two consecutive applies — it is released to the native provider", {
+					tags: this.tagsOf(entry.key),
+					meta: this.metaOf(entry.key)
+				});
+				releases.push(entry.key);
+			}
+			next.set(key, {
+				...entry,
+				misses
+			});
+		}
+		for (const [key, k] of present) if (!next.has(key)) next.set(key, entryOf$1(k));
+		this.known = next;
+		return releases;
+	}
+	/** The hub confirmed the release (or held nothing of ours): forgotten. */
+	released(key, how) {
+		const k = claimKey(key);
+		const attempts = this.known.get(k)?.attempts ?? 0;
+		this.known = new Map([...this.known].filter(([other]) => other !== k));
+		this.logger.info(attempts > 0 ? "claim release landed after failed attempts" : "claim release confirmed by the hub", {
+			tags: this.tagsOf(key),
+			meta: {
+				...this.metaOf(key),
+				outcome: how,
+				...attempts > 0 ? { attempts } : {}
+			}
+		});
+	}
+	/** The release did not land: kept, and returned by every later `filter` until it does. Never given up. */
+	releaseFailed(key, error) {
+		const k = claimKey(key);
+		const entry = this.known.get(k);
+		if (entry === void 0) return;
+		const attempts = entry.attempts + 1;
+		this.known = new Map([...this.known, [k, {
+			...entry,
+			attempts
+		}]]);
+		if (attempts > 1) return;
+		this.logger.warn("claim release did not land — retried on every apply until it does", {
+			tags: this.tagsOf(key),
+			meta: {
+				...this.metaOf(key),
+				error
+			}
+		});
+	}
+	tagsOf(key) {
+		return { deviceId: key.deviceId };
+	}
+	metaOf(key) {
+		return {
+			owner: key.owner,
+			cap: key.capName
+		};
+	}
+};
+//#endregion
+//#region src/builtins/composer/composed-device-set.ts
+/**
+* The composed devices the composer DECLARED (D659): one row per `new`-target
+* block, hung off the shared Blocks integration, adopted or built by
+* `DeclaredDevices.reconcile`. This is the only place a composed row is created,
+* kept or swept — a composition on an EXISTING device never enters it (D663).
+*
+* - `rows` is the set of stableIds whose row exists: seeded from the persisted
+*   rows at boot, then what every declare kept. Planning asks it to decide
+*   whether a block that stopped planning has a row to hold as a placeholder.
+* - A changed shape (type, role, cap set, placeholder or not) needs a NEW device
+*   object: decommission, and let the reconcile adopt it with the new class. A
+*   failure keeps the old device and is retried on the next apply.
+* - A failed reconcile changes nothing (D49): the devices already live stay.
+*/
+var ComposedDeviceSet = class {
+	deps;
+	devices = /* @__PURE__ */ new Map();
+	existingRows = /* @__PURE__ */ new Set();
+	declaredFingerprint = null;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	/** StableIds whose row exists. */
+	get rows() {
+		return this.existingRows;
+	}
+	seedRows(rows) {
+		this.existingRows = new Set(rows.map((r) => r.stableId));
+	}
+	get(stableId) {
+		return this.devices.get(stableId) ?? null;
+	}
+	idOf(stableId) {
+		return this.devices.get(stableId)?.id ?? null;
+	}
+	async rebuildShapes(planned, previousOf) {
+		const errors = /* @__PURE__ */ new Map();
+		for (const p of planned) {
+			const previous = previousOf(p.block.id);
+			const device = previous?.device ?? null;
+			if (previous === void 0 || device === null || p.shape === null) continue;
+			if (previous.shape === p.shape) continue;
+			try {
+				this.deps.logger.info("composition shape changed — rebuilding its device", {
+					tags: { deviceId: device.id },
+					meta: {
+						blockId: p.block.id,
+						from: previous.shape,
+						to: p.shape
+					}
+				});
+				if (p.spec !== null) await this.deps.devices.applyDerivedSpec(device.id, p.spec);
+				await this.deps.devices.decommission(device.id);
+				const stableId = composedDeviceStableId(p.block.id);
+				this.devices = new Map([...this.devices].filter(([s]) => s !== stableId));
+				this.declaredFingerprint = null;
+			} catch (err) {
+				const error = errMsg(err);
+				errors.set(p.block.id, error);
+				this.deps.logger.warn("rebuilding a composed device failed — the old one is kept", {
+					tags: { deviceId: device.id },
+					meta: {
+						blockId: p.block.id,
+						error
+					}
+				});
+			}
+		}
+		return errors;
+	}
+	async reconcile(integrationId, declarations, planned) {
+		const shapes = new Map(planned.flatMap((p) => p.declaration === null ? [] : [[p.declaration.stableId, p.shape]]));
+		const fingerprint = JSON.stringify(declarations.map((d) => [d.stableId, shapes.get(d.stableId) ?? null]).toSorted());
+		const allLive = declarations.every((d) => this.devices.has(d.stableId));
+		if (fingerprint === this.declaredFingerprint && allLive) return;
+		try {
+			const result = await this.deps.declare(integrationId, declarations);
+			this.devices = result.devices;
+			this.existingRows = new Set(declarations.map((d) => d.stableId).filter((s) => this.existingRows.has(s) || result.devices.has(s)));
+			this.declaredFingerprint = fingerprint;
+		} catch (err) {
+			this.deps.logger.warn("composer: the device declaration failed — keeping the devices already live", { meta: {
+				error: errMsg(err),
+				declarations: declarations.length
+			} });
+		}
+	}
+};
+//#endregion
 //#region src/builtins/composer/composition-declarations.ts
 /**
 * Which composed devices exist (D659): one declaration per composition block,
@@ -187,6 +398,373 @@ var WithdrawalGate = class {
 	}
 };
 //#endregion
+//#region src/builtins/composer/composer-plan.ts
+/**
+* What one apply PLANS for a block, before anything is declared, claimed or
+* run (D659, D663). Pure over its inputs: the composer hands in what it knows
+* (its rows, the previous plan, the tracker) and gets a `PlannedBlock` back.
+*
+* - A `new` target plans as in slice 1: a declaration, a shape, a placeholder
+*   when the composition stopped planning but its row exists.
+* - An `existing` target declares NOTHING (the row is not the composer's). It
+*   is resolved through the tracker's path, described with one bindings read
+*   per plan change, and planned against that description. A settled plan is
+*   kept until the OPERATOR acts (edit, restart): a bindings change alone never
+*   re-plans (Task 10 rule 2, D659). While the claims index is unseeded or the
+*   target is unresolved or undescribed, the block WAITS by name and claims
+*   nothing (D49). A target gone on two agreeing index reads is `gone`.
+* - An unreadable row names no target: whatever it holds is held (D49).
+*/
+/** The shape of a placeholder: no caps, so no plan to take a shape from. */
+var PLACEHOLDER_SHAPE = "placeholder";
+var NO_PLAN = {
+	fields: [],
+	problems: [],
+	declaration: null,
+	shape: null,
+	spec: null
+};
+/**
+* A row that exists but does not parse is held exactly like a composition
+* that stopped planning: its device (if it has a row) stays as an offline
+* placeholder, its claims (if any) are kept, and the block fails naming the
+* parse error. Absent, it would be withdrawn on the second apply that omitted
+* it (D49).
+*/
+function planUnreadable(block, rows) {
+	const stableId = composedDeviceStableId(block.id);
+	const hasRow = rows.has(stableId);
+	return {
+		...NO_PLAN,
+		block: {
+			id: block.id,
+			name: block.name,
+			enabled: false,
+			updatedAt: 0
+		},
+		problems: [`the stored block does not parse — ${block.error}`],
+		declaration: hasRow ? placeholderDeclaration(stableId) : null,
+		shape: hasRow ? PLACEHOLDER_SHAPE : null,
+		target: { kind: "unreadable" }
+	};
+}
+/** `target` is the block's own `new` target, narrowed by the caller: this path never sees an existing one (M-5). */
+function planNew(block, target, lookupCap, rows) {
+	const plan = planComposition(block.composition, lookupCap);
+	const planned = { kind: "new" };
+	if (plan.problems.length > 0) {
+		const stableId = composedDeviceStableId(block.id);
+		const hasRow = rows.has(stableId);
+		return {
+			...NO_PLAN,
+			block,
+			problems: plan.problems.map((p) => `${p.path}: ${p.message}`),
+			declaration: hasRow ? placeholderDeclaration(stableId) : null,
+			shape: hasRow ? PLACEHOLDER_SHAPE : null,
+			target: planned
+		};
+	}
+	const caps = block.composition.features.flatMap((f) => {
+		const def = lookupCap(f.cap);
+		return def === null ? [] : [def];
+	});
+	const declarationInput = {
+		blockId: block.id,
+		name: block.name,
+		target,
+		caps
+	};
+	return {
+		block,
+		fields: plan.fields,
+		problems: [],
+		declaration: declarationFor(declarationInput),
+		shape: shapeOf(declarationInput),
+		spec: {
+			type: target.type,
+			...target.role === void 0 ? {} : { role: target.role }
+		},
+		target: planned
+	};
+}
+async function planExisting(input) {
+	const { block, previous, operatorAction } = input;
+	const prior = previous?.target;
+	if (!operatorAction && previous !== void 0 && prior?.kind === "existing" && prior.waiting === null) return {
+		...previous,
+		block
+	};
+	const ref = input.target.device;
+	const key = compositionSourceKey(ref);
+	const knownId = prior?.kind === "existing" ? prior.deviceId : null;
+	if (input.claimsWait !== null) return waitingPlan(block, ref, knownId, input.claimsWait);
+	const resolution = await input.tracker.resolve(ref, operatorAction);
+	if (resolution.kind === "unknown") return waitingPlan(block, ref, knownId, `the target device \`${key}\` could not be resolved (${resolution.error}) — nothing is claimed until it is; retried on the next apply`);
+	const existing = {
+		kind: "existing",
+		ref,
+		deviceId: resolution.kind === "found" ? resolution.deviceId : knownId,
+		waiting: null,
+		gone: null,
+		features: [],
+		nativeCaps: /* @__PURE__ */ new Map()
+	};
+	if (resolution.kind === "missing") return {
+		...NO_PLAN,
+		block,
+		target: {
+			...existing,
+			gone: `${resolution.reason} — two index reads agreed`
+		}
+	};
+	const description = await input.targets.describe(ref, resolution.deviceId, resolution.type, operatorAction);
+	if (description === null) return waitingPlan(block, ref, resolution.deviceId, `the target device \`${key}\` could not be described (its bindings did not read) — nothing is claimed until it is; retried on the next apply`);
+	const plan = planComposition(block.composition, input.lookupCap, description);
+	return {
+		...NO_PLAN,
+		block,
+		fields: plan.problems.length > 0 ? [] : plan.fields,
+		problems: plan.problems.map((p) => `${p.path}: ${p.message}`),
+		target: {
+			...existing,
+			features: plan.features,
+			nativeCaps: description.nativeCaps
+		}
+	};
+}
+function waitingPlan(block, ref, deviceId, waiting) {
+	return {
+		...NO_PLAN,
+		block,
+		target: {
+			kind: "existing",
+			ref,
+			deviceId,
+			waiting,
+			gone: null,
+			features: [],
+			nativeCaps: /* @__PURE__ */ new Map()
+		}
+	};
+}
+/** What `logPlanTransition` compares: problems, and for an existing target its wait or its loss. */
+function planSummary(p) {
+	const target = p.target;
+	return (target.kind === "existing" ? [
+		p.problems.join("; "),
+		target.waiting ?? "",
+		target.gone ?? ""
+	] : [p.problems.join("; ")]).filter((part) => part !== "").join(" | ");
+}
+/**
+* Rule 5 on the PLAN path: `device.unregistered` is telemetry and may be
+* dropped (D8), so a target is often found gone by the operator's next edit or
+* restart. The previous live target is what must be ungrafted — exactly as on
+* the event path. Null when nothing was lost by THIS plan.
+*/
+function lostTarget(p, previous) {
+	const now = p.target;
+	const before = previous?.target;
+	if (now.kind !== "existing" || now.gone === null || before?.kind !== "existing") return null;
+	if (before.deviceId === null || before.gone !== null) return null;
+	return {
+		target: before,
+		deviceId: before.deviceId
+	};
+}
+/** Two plans write the same place: both new, or the very same existing-target plan (reused until the operator acts). */
+function sameTarget(a, b) {
+	return a === b || a.kind === "new" && b.kind === "new";
+}
+/** One line when a block starts or stops planning (or waiting, or loses its target) — never one per apply. */
+function logPlanTransition(logger, previous, p, liveTags) {
+	if (previous !== void 0 && planSummary(previous) === planSummary(p)) return;
+	if (previous === void 0 && planSummary(p) === "") return;
+	const target = p.target;
+	const extras = {
+		tags: target.kind === "existing" && target.deviceId !== null ? { deviceId: target.deviceId } : liveTags,
+		meta: {
+			blockId: p.block.id,
+			problems: p.problems,
+			placeholder: p.declaration !== null
+		}
+	};
+	if (target.kind === "existing" && target.gone !== null) logger.error("customization target device is gone — the block failed; only the operator ends this (edit or restart the block)", {
+		...extras,
+		meta: {
+			...extras.meta,
+			target: compositionSourceKey(target.ref)
+		}
+	});
+	else if (target.kind === "existing" && target.waiting !== null) logger.warn("customization waits — nothing is claimed or released until it plans", {
+		...extras,
+		meta: {
+			...extras.meta,
+			reason: target.waiting
+		}
+	});
+	else if (p.problems.length === 0) logger.info("composition plans again", extras);
+	else logger.warn(p.declaration === null ? "composition does not plan — no device is declared for it" : "composition no longer plans — its device is kept offline with no capabilities", extras);
+}
+//#endregion
+//#region src/builtins/composer/slice-assembler.ts
+/**
+* From the runtime's flat field values to the slice a target takes (D663).
+*
+* A top-level field is written under its path. An item leaf
+* (`consumables.items[desiccant].remaining.value`) is one entry of an ARRAY:
+* every leaf of one item is grouped by `(cap, arrayPath, key)` and set, by
+* path segment, onto the cap's OWN `status.itemArray.emptyItem` — so an
+* unsourced nullable leaf is `null` because the cap says so, not because this
+* module guessed. The key, the label and {@link COMPOSED_ITEM_FIXED_FIELDS}
+* are the composer's; items are sorted by key so two writes of the same
+* values are one slice.
+*
+* A cap the lookup does not know as an item array cannot be assembled: that
+* is thrown by name, and the runtime's write path turns a throw into a named,
+* retried failure — never a half-built array.
+*/
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** `setPath(item, ['remaining', 'value'], 0)` → `{ ...item, remaining: { ...item.remaining, value: 0 } }`. */
+function setPath(record, segments, value) {
+	const [head, ...rest] = segments;
+	if (head === void 0) return record;
+	if (rest.length === 0) return {
+		...record,
+		[head]: value
+	};
+	const current = record[head];
+	return {
+		...record,
+		[head]: setPath(isRecord(current) ? current : {}, rest, value)
+	};
+}
+function itemArrayOf(group, lookupCap) {
+	const itemArray = lookupCap(group.cap)?.status?.itemArray;
+	if (itemArray === void 0 || itemArray.path !== group.arrayPath) throw new Error(`\`${group.cap}\` has no item array at \`${group.arrayPath}\` — \`${compositionItemFieldPath(group.arrayPath, group.key, "*")}\` cannot be assembled`);
+	return itemArray;
+}
+function assembleItem(group, lookupCap) {
+	const itemArray = itemArrayOf(group, lookupCap);
+	const base = {
+		...itemArray.emptyItem,
+		[itemArray.keyField]: group.key,
+		...itemArray.labelField === void 0 ? {} : { [itemArray.labelField]: group.label },
+		...COMPOSED_ITEM_FIXED_FIELDS
+	};
+	return group.leaves.reduce((item, leaf) => setPath(item, leaf.plan.path.split("."), leaf.value), base);
+}
+function groupItems(entries) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const item = entry.plan.item;
+		if (item === void 0) continue;
+		const id = `${entry.plan.cap}\u0000${item.arrayPath}\u0000${item.key}`;
+		const group = groups.get(id) ?? {
+			cap: entry.plan.cap,
+			arrayPath: item.arrayPath,
+			key: item.key,
+			label: item.label,
+			leaves: []
+		};
+		groups.set(id, {
+			...group,
+			leaves: [...group.leaves, entry]
+		});
+	}
+	return [...groups.values()];
+}
+function compareKeys(a, b) {
+	return a < b ? -1 : a > b ? 1 : 0;
+}
+function assembleSlice(entries, lookupCap) {
+	const top = Object.fromEntries(entries.filter((e) => e.plan.item === void 0).map((e) => [e.plan.path, e.value]));
+	const groups = groupItems(entries);
+	const arrays = [...new Set(groups.map((g) => g.arrayPath))].map((arrayPath) => [arrayPath, groups.filter((g) => g.arrayPath === arrayPath).toSorted((a, b) => compareKeys(a.key, b.key)).map((g) => assembleItem(g, lookupCap))]);
+	return {
+		...top,
+		...Object.fromEntries(arrays)
+	};
+}
+//#endregion
+//#region src/builtins/composer/field-record.ts
+/**
+* One composed field's record and the pure judgements over it (D659, D663):
+* what it may write, whether it is released (a CONFIRMED unavailability of a
+* `release`-mode field, S1b) or HELD (no answer yet, D49), and how a report or a
+* log line names it. Split from `composition-runtime.ts`, which holds the
+* behaviour.
+*/
+var NO_FIELDS = /* @__PURE__ */ new Set();
+function fieldKey(plan) {
+	return compositionFieldKey(plan);
+}
+/** The top-level field a record writes: an item leaf writes its whole array. */
+function topLevelField(plan) {
+	return plan.item === void 0 ? plan.path : plan.item.arrayPath;
+}
+/** The field as a report or a log line names it: `items[desiccant].status` for an item leaf. */
+function fieldPath(plan) {
+	return plan.item === void 0 ? plan.path : compositionItemFieldPath(plan.item.arrayPath, plan.item.key, plan.path);
+}
+function itemOf(plan) {
+	return plan.item === void 0 ? {} : { item: plan.item };
+}
+function sameSet(a, b) {
+	return a.size === b.size && [...a].every((x) => b.has(x));
+}
+function valueOf(outcome) {
+	return outcome === null || outcome.state === "unavailable" ? void 0 : outcome.value;
+}
+function reasonOf(outcome) {
+	if (outcome === null) return "not evaluated yet";
+	return outcome.reason;
+}
+/** State, value and reason — what a write or a log line is about. NEVER the deadline (R1). */
+function sameOutcome(a, b) {
+	return a !== null && a.state === b.state && valueOf(a) === valueOf(b) && reasonOf(a) === reasonOf(b);
+}
+/** A source is GONE: the outcome that must never be masked by a non-fatal one. */
+function isFatal(outcome) {
+	return outcome !== null && outcome.state === "unavailable" && outcome.fatal;
+}
+/** A `release`-mode field whose source is CONFIRMED unavailable: not the composition's to write (S1b). Stale is a value (D49). */
+function isReleased(record) {
+	const outcome = record.outcome;
+	return record.plan.unavailable === "release" && outcome?.state === "unavailable" && outcome.confirmed === true;
+}
+/** A `release`-mode field with no value and no ANSWER yet (a failed, first or empty read): held on its last value, never released (D49). */
+function isHeld(record) {
+	const outcome = record.outcome;
+	return record.plan.unavailable === "release" && outcome?.state === "unavailable" && outcome.confirmed !== true;
+}
+function namedField(r) {
+	return {
+		cap: r.plan.cap,
+		path: r.plan.path,
+		...itemOf(r.plan),
+		reason: reasonOf(r.outcome) ?? "unavailable"
+	};
+}
+function writable(record) {
+	const outcome = record.outcome;
+	if (outcome === null) return void 0;
+	if (outcome.state !== "unavailable") return outcome.value;
+	switch (record.plan.unavailable) {
+		case "null": return null;
+		case "unknown": return "unknown";
+		default: return;
+	}
+}
+function errorText(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function pendingReason(cap, pending) {
+	return pending.kind === "refused" ? `the \`${cap}\` capability refused the value: ${pending.error}` : `writing the \`${cap}\` capability threw: ${pending.error}`;
+}
+//#endregion
 //#region src/builtins/composer/composition-runtime.ts
 /**
 * One running composition: per-field state, writes to the composed device, and
@@ -217,37 +795,35 @@ var WithdrawalGate = class {
 * - Nothing escapes: a pass that throws is logged, and the timer is re-armed
 *   from the stored deadlines regardless.
 * - `stop()` is terminal: every entry point is a no-op afterwards.
+*
+* Slice 2 (D663):
+* - Records are keyed by `compositionFieldKey`: two items' `status` are two
+*   records. An item-array cap is written WHOLE — a change to one item leaf
+*   re-sends every item, assembled by `assembleSlice` on the cap's `emptyItem`.
+*   A required item leaf with no fallback holds the array, named once.
+* - `'unknown'` unavailable mode writes the enum's own word.
+* - `'release'` unavailable mode hands the field BACK (ruling S1b): the target
+*   is told to `withhold` it, the field's record forgets what it wrote, and the
+*   source returning re-widens and writes it again. Stale is a value (D49),
+*   never a release — and neither is an UNCONFIRMED unavailability (a failed,
+*   first or empty read): the field is HELD on its last value, not written,
+*   not withheld, its claim kept, until the source answers (D49, fix round 2).
+*   `state().released` / `state().held` name every such field for the report.
+* - A target whose writes are asynchronous (claims on the hub) reports what did
+*   not land through `onAsyncFailure`: the cap is marked write-pending by name
+*   and re-written whole on the next pass — no retry timer (D3).
 */
-function errorText(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-function pendingReason(cap, pending) {
-	return pending.kind === "refused" ? `the \`${cap}\` capability refused the value: ${pending.error}` : `writing the \`${cap}\` capability threw: ${pending.error}`;
-}
-function fieldKey(plan) {
-	return `${plan.cap}.${plan.path}`;
-}
-function valueOf(outcome) {
-	return outcome === null || outcome.state === "unavailable" ? void 0 : outcome.value;
-}
-function reasonOf(outcome) {
-	if (outcome === null) return "not evaluated yet";
-	return outcome.reason;
-}
-/** State, value and reason — what a write or a log line is about. NEVER the deadline (R1). */
-function sameOutcome(a, b) {
-	return a !== null && a.state === b.state && valueOf(a) === valueOf(b) && reasonOf(a) === reasonOf(b);
-}
-/** A source is GONE: the outcome that must never be masked by a non-fatal one. */
-function isFatal(outcome) {
-	return outcome !== null && outcome.state === "unavailable" && outcome.fatal;
-}
-function writable(record) {
-	const outcome = record.outcome;
-	if (outcome === null) return void 0;
-	if (outcome.state !== "unavailable") return outcome.value;
-	return record.plan.unavailable === "null" ? null : void 0;
-}
+/**
+* A refusal nothing on this side can retry away: another owner holds the
+* field, the slice is invalid for the cap, the device is not known. Every
+* other outcome — a throw, an unreadable row, a migration in flight, a lost
+* claim — is transient and retried on the next pass (D6: bounded, never a loop).
+*/
+var TERMINAL_REFUSALS = new Set([
+	"owned-by-other",
+	"invalid-slice",
+	"unknown-device"
+]);
 var CompositionRuntime = class {
 	deps;
 	records;
@@ -260,6 +836,16 @@ var CompositionRuntime = class {
 	lastPassError = null;
 	pending = /* @__PURE__ */ new Map();
 	heldBack = /* @__PURE__ */ new Set();
+	/** Caps whose item array is not written because a required leaf has no value. */
+	itemsHeld = /* @__PURE__ */ new Set();
+	/** Record keys currently released (S1b), for transition logs and the report. */
+	released = /* @__PURE__ */ new Set();
+	/** Per cap, the top-level fields the target last accepted as withheld; absent = none. */
+	withheld = /* @__PURE__ */ new Map();
+	/** Per record key, how many times the field has been released — churn the transition line reports (D391). */
+	releaseFlaps = /* @__PURE__ */ new Map();
+	/** Caps the target refused for good (`TERMINAL_REFUSALS`): never written again by this runtime. */
+	terminal = /* @__PURE__ */ new Map();
 	constructor(deps) {
 		this.deps = deps;
 		this.records = new Map(deps.fields.map((plan) => [fieldKey(plan), {
@@ -267,6 +853,7 @@ var CompositionRuntime = class {
 			outcome: null,
 			written: void 0
 		}]));
+		deps.target.onAsyncFailure?.((cap, failure) => this.onTargetWriteFailed(cap, failure));
 	}
 	start() {
 		if (this.disabledReason !== null) return;
@@ -288,7 +875,8 @@ var CompositionRuntime = class {
 				state: "unavailable",
 				value: null,
 				reason,
-				fatal: false
+				fatal: false,
+				confirmed: true
 			};
 			const touched = [...this.records.values()].filter((r) => !isFatal(r.outcome) && !sameOutcome(r.outcome, outcome));
 			for (const r of touched) this.logTransition(r, outcome);
@@ -310,10 +898,20 @@ var CompositionRuntime = class {
 			failure: this.failure,
 			available: this.available === true,
 			fields: [...this.records.values()].map((r) => {
+				const terminal = this.terminal.get(r.plan.cap);
+				if (terminal !== void 0 && !isFatal(r.outcome)) return {
+					cap: r.plan.cap,
+					path: r.plan.path,
+					...itemOf(r.plan),
+					state: "unavailable",
+					value: null,
+					reason: terminal
+				};
 				const pending = this.pending.get(r.plan.cap);
 				if (pending !== void 0 && !isFatal(r.outcome)) return {
 					cap: r.plan.cap,
 					path: r.plan.path,
+					...itemOf(r.plan),
 					state: "unavailable",
 					value: null,
 					reason: pendingReason(r.plan.cap, pending)
@@ -323,20 +921,69 @@ var CompositionRuntime = class {
 				return {
 					cap: r.plan.cap,
 					path: r.plan.path,
+					...itemOf(r.plan),
 					state: r.outcome?.state ?? "unavailable",
 					value: value === void 0 ? null : value,
 					...reason === null ? {} : { reason }
 				};
-			})
+			}),
+			released: [...this.records.values()].filter(isReleased).map(namedField),
+			held: [...this.records.values()].filter(isHeld).map(namedField)
 		};
 	}
 	/**
-	* Every entry point runs here: a no-op once stopped, nothing thrown escapes,
-	* and the one timer is re-armed from the stored deadlines whatever happened.
+	* The target's enqueued write of `cap` did not land: the cap is write-pending
+	* by name and re-written WHOLE on the next pass that evaluates it (or the next
+	* deadline pass). A withhold sent to that target is forgotten too, so it is
+	* re-sent. No retry timer (D3).
 	*/
-	guarded(during, rearm, body) {
-		if (this.stopped) return;
-		let threw = false;
+	onTargetWriteFailed(cap, failure) {
+		this.guarded("target-failure", false, () => {
+			if (!this.deps.fields.some((f) => f.cap === cap) || this.terminal.has(cap)) return;
+			if (failure.kind === "refused" && TERMINAL_REFUSALS.has(failure.code)) {
+				this.markTerminal(cap, failure.code, failure.message);
+				return;
+			}
+			this.withheld = new Map([...this.withheld].filter(([c]) => c !== cap));
+			this.markPending(cap, this.seeded.has(cap) ? "patch" : "seed", failure.kind === "threw" ? {
+				kind: "threw",
+				error: failure.error
+			} : {
+				kind: "refused",
+				error: `${failure.code}: ${failure.message}`
+			});
+			this.updateAvailability();
+		});
+	}
+	/**
+	* The target refused this cap for good: nothing on this side can retry it
+	* away (I-3). The cap is never written again by this runtime, its fields
+	* report the refusal, and the block fails naming it — only the operator ends
+	* this (edit or delete the block, or the competing one), like a gone source.
+	*/
+	markTerminal(cap, code, message) {
+		const reason = `the \`${cap}\` capability was refused for good: ${code}: ${message} — only the operator ends this (edit or delete the block)`;
+		this.terminal = new Map([...this.terminal, [cap, reason]]);
+		this.pending = new Map([...this.pending].filter(([c]) => c !== cap));
+		if (this.failure === null) this.failure = `composed write refused for good — ${cap}: ${code}: ${message}`;
+		this.deps.logger.error("composed capability refused for good — it is not written again until the operator edits or deletes the block", {
+			tags: { deviceId: this.deps.target.id },
+			meta: {
+				blockId: this.deps.blockId,
+				cap,
+				code,
+				error: message
+			}
+		});
+		this.updateAvailability();
+	}
+	/**
+	* Every entry point runs here: a no-op once stopped, nothing thrown escapes,
+	* and the one timer is re-armed from the stored deadlines whatever happened.
+	*/
+	guarded(during, rearm, body) {
+		if (this.stopped) return;
+		let threw = false;
 		try {
 			body();
 			this.lastPassError = null;
@@ -415,35 +1062,153 @@ var CompositionRuntime = class {
 			const cap = this.records.get(k)?.plan.cap;
 			return cap === void 0 ? [] : [cap];
 		}), ...retry]);
-		for (const cap of caps) if (!this.seeded.has(cap)) this.seedCap(cap);
-		else if (this.pending.has(cap)) this.patchWholeCap(cap);
-		else this.patchCap(cap, touched);
+		for (const cap of caps) {
+			if (this.terminal.has(cap)) continue;
+			const sync = this.syncReleased(cap);
+			if (sync === "failed") continue;
+			if (!this.seeded.has(cap)) this.seedCap(cap);
+			else if (this.pending.has(cap) || sync === "changed") this.patchWholeCap(cap, sync === "changed");
+			else this.patchCap(cap, touched);
+		}
+	}
+	/**
+	* S1b: tell the target which fields of `cap` are released, when that set
+	* changed since it last accepted one. A released record forgets what it wrote,
+	* so the source returning writes it again. False when the target refused or
+	* threw: the cap is write-pending and the withhold is re-sent next pass.
+	*/
+	syncReleased(cap) {
+		const records = this.recordsOf(cap);
+		this.logReleaseTransitions(cap, records);
+		const releasedRecords = records.filter(isReleased);
+		this.records = new Map([...this.records].map(([k, r]) => releasedRecords.includes(r) && r.written !== void 0 ? [k, {
+			...r,
+			written: void 0
+		}] : [k, r]));
+		const withhold = this.deps.target.withhold;
+		if (withhold === void 0) return "unchanged";
+		const fields = new Set(releasedRecords.map((r) => topLevelField(r.plan)));
+		if (sameSet(fields, this.withheld.get(cap) ?? NO_FIELDS)) return "unchanged";
+		let failed;
+		try {
+			const outcome = withhold.call(this.deps.target, cap, [...fields].toSorted());
+			failed = outcome.ok ? null : {
+				kind: "refused",
+				error: outcome.error
+			};
+		} catch (error) {
+			failed = {
+				kind: "threw",
+				error: errorText(error)
+			};
+		}
+		if (failed !== null) {
+			this.markPending(cap, this.seeded.has(cap) ? "patch" : "seed", failed);
+			return "failed";
+		}
+		this.withheld = new Map([...this.withheld.entries()].filter(([c]) => c !== cap).concat(fields.size === 0 ? [] : [[cap, fields]]));
+		return "changed";
+	}
+	/** One info line per field per direction, never one per pass. */
+	logReleaseTransitions(cap, records) {
+		const now = new Set(records.filter(isReleased).map((r) => fieldKey(r.plan)));
+		const before = new Set(records.filter((r) => this.released.has(fieldKey(r.plan))).map((r) => fieldKey(r.plan)));
+		for (const r of records) {
+			const key = fieldKey(r.plan);
+			const direction = now.has(key) && !before.has(key) ? "released" : !now.has(key) && before.has(key) ? "reclaimed" : null;
+			if (direction === null) continue;
+			const flaps = (this.releaseFlaps.get(key) ?? 0) + (direction === "released" ? 1 : 0);
+			this.releaseFlaps = new Map([...this.releaseFlaps, [key, flaps]]);
+			this.deps.logger.info(direction === "released" ? "composed field released to the native provider — its source is unavailable" : "composed field reclaimed from the native provider — its source is back", {
+				tags: { deviceId: this.deps.target.id },
+				meta: {
+					blockId: this.deps.blockId,
+					cap,
+					field: fieldPath(r.plan),
+					direction,
+					reason: reasonOf(r.outcome) ?? "value available again",
+					flaps
+				}
+			});
+		}
+		this.released = new Set([...[...this.released].filter((k) => !before.has(k)), ...now]);
 	}
 	seedCap(cap) {
 		const records = this.recordsOf(cap);
-		const missing = records.filter((r) => r.plan.required && writable(r) === void 0).map((r) => r.plan.path);
+		const missing = records.filter((r) => (r.plan.required || isHeld(r)) && writable(r) === void 0 && !isReleased(r)).map((r) => fieldPath(r.plan));
 		if (missing.length > 0) return this.holdBackSeed(cap, missing);
 		this.heldBack = new Set([...this.heldBack].filter((c) => c !== cap));
-		const entries = this.writableEntries(records);
+		const entries = this.entriesFor(cap, records);
 		if (!this.write(cap, "seed", entries)) return;
 		this.seeded = new Set([...this.seeded, cap]);
 		this.markWritten(cap, entries);
 	}
 	patchCap(cap, touched) {
-		const entries = this.writableEntries(this.recordsOf(cap).filter((r) => touched.has(fieldKey(r.plan)) && writable(r) !== r.written));
+		const entries = this.entriesFor(cap, this.recordsOf(cap).filter((r) => touched.has(fieldKey(r.plan)) && writable(r) !== r.written));
 		if (entries.length === 0) return;
 		if (this.write(cap, "patch", entries)) this.markWritten(cap, entries);
 	}
-	/** After a failed write nothing is known about what landed: send every current value. */
-	patchWholeCap(cap) {
-		const entries = this.writableEntries(this.recordsOf(cap));
-		if (entries.length === 0) return;
+	/**
+	* After a failed write nothing is known about what landed, and after a
+	* changed withhold the claim must be re-stated: send every current value.
+	* `afterWithhold` with nothing left to write means the cap was released
+	* whole — a pending write is moot then, not retried (M-2).
+	*/
+	patchWholeCap(cap, afterWithhold = false) {
+		const entries = this.entriesFor(cap, this.recordsOf(cap));
+		if (entries.length === 0) {
+			if (afterWithhold && this.pending.has(cap)) this.dropPending(cap);
+			return;
+		}
 		if (this.write(cap, "patch", entries)) this.markWritten(cap, entries);
 	}
+	dropPending(cap) {
+		this.pending = new Map([...this.pending].filter(([c]) => c !== cap));
+		this.deps.logger.info("composed capability released whole — its pending write is moot, nothing is left to write", {
+			tags: { deviceId: this.deps.target.id },
+			meta: {
+				blockId: this.deps.blockId,
+				cap
+			}
+		});
+	}
+	/**
+	* What one write of `cap` carries: the writable `candidates` — and, when any
+	* of them is an item leaf, EVERY item leaf of the cap, because the array is
+	* written whole (a patch of `items` replaces it). A required item leaf with
+	* no value holds the whole array (its top-level siblings still go out).
+	*/
+	entriesFor(cap, candidates) {
+		const top = candidates.filter((r) => r.plan.item === void 0);
+		if (!candidates.some((r) => r.plan.item !== void 0)) return this.writableEntries(top);
+		const items = this.recordsOf(cap).filter((r) => r.plan.item !== void 0);
+		const missing = items.filter((r) => r.plan.required && writable(r) === void 0).map((r) => fieldPath(r.plan));
+		if (missing.length > 0) {
+			this.holdItems(cap, missing);
+			return this.writableEntries(top);
+		}
+		this.itemsHeld = new Set([...this.itemsHeld].filter((c) => c !== cap));
+		return this.writableEntries([...top, ...items]);
+	}
 	writableEntries(records) {
 		return records.flatMap((r) => {
-			const v = writable(r);
-			return v === void 0 ? [] : [[r.plan.path, v]];
+			const value = writable(r);
+			return value === void 0 ? [] : [{
+				plan: r.plan,
+				value
+			}];
+		});
+	}
+	holdItems(cap, missing) {
+		if (this.itemsHeld.has(cap)) return;
+		this.itemsHeld = new Set([...this.itemsHeld, cap]);
+		this.deps.logger.warn("composed items held — a required item field has no value; the array is not written until it does", {
+			tags: { deviceId: this.deps.target.id },
+			meta: {
+				blockId: this.deps.blockId,
+				cap,
+				missing
+			}
 		});
 	}
 	holdBackSeed(cap, missing) {
@@ -458,11 +1223,11 @@ var CompositionRuntime = class {
 			}
 		});
 	}
-	/** One write. A refusal or a throw marks the cap write-pending; true when it landed. */
+	/** One write. A refusal or a throw marks the cap write-pending; true when the target took it. */
 	write(cap, op, entries) {
-		const values = Object.fromEntries(entries);
 		let failed;
 		try {
+			const values = assembleSlice(entries, this.deps.lookupCap);
 			const outcome = op === "seed" ? this.deps.target.seed(cap, values) : this.deps.target.patch(cap, values);
 			failed = outcome.ok ? null : {
 				kind: "refused",
@@ -508,10 +1273,10 @@ var CompositionRuntime = class {
 		});
 	}
 	markWritten(cap, entries) {
-		const written = new Map(entries);
-		this.records = new Map([...this.records].map(([k, r]) => r.plan.cap === cap && written.has(r.plan.path) ? [k, {
+		const written = new Map(entries.map((e) => [fieldKey(e.plan), e.value]));
+		this.records = new Map([...this.records].map(([k, r]) => r.plan.cap === cap && written.has(k) ? [k, {
 			...r,
-			written: written.get(r.plan.path)
+			written: written.get(k)
 		}] : [k, r]));
 	}
 	updateAvailability() {
@@ -586,6 +1351,724 @@ var CompositionRuntime = class {
 	}
 };
 //#endregion
+//#region src/builtins/composer/confirmed-seed.ts
+var ConfirmedSeed = class {
+	deps;
+	seeded = false;
+	/** The previous read answered `[]`: one more `[]` confirms it (D49). */
+	emptySeen = false;
+	/** Consecutive applies whose read did not answer: warned once per run. */
+	waitApplies = 0;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	get done() {
+		return this.seeded;
+	}
+	/** Null once seeded, else why this apply must wait. */
+	async ensure() {
+		if (this.seeded) return null;
+		const read = await this.deps.read();
+		if (read.kind === "unknown") {
+			this.emptySeen = false;
+			this.waitApplies += 1;
+			if (this.waitApplies === 1) this.deps.logger.warn(`composer: the ${this.deps.subject} could not be read — nothing is declared, withdrawn, claimed or released from them; retried on the next apply`, { meta: {
+				subject: this.deps.subject,
+				error: read.error
+			} });
+			return this.deps.unreadReason;
+		}
+		if (read.items.length === 0 && !this.emptySeen) {
+			this.emptySeen = true;
+			this.deps.logger.warn(`composer: the ${this.deps.subject} read empty — waiting for the next apply's read to agree before trusting it`, { meta: { subject: this.deps.subject } });
+			return this.deps.emptyUnconfirmedReason;
+		}
+		this.deps.onSeeded(read.items);
+		this.seeded = true;
+		this.deps.logger.info(`composer: seeded from the ${this.deps.subject}`, { meta: {
+			subject: this.deps.subject,
+			items: read.items.length,
+			confirmedEmpty: read.items.length === 0,
+			appliesRefused: this.waitApplies
+		} });
+		return null;
+	}
+};
+//#endregion
+//#region src/builtins/composer/existing-target.ts
+/**
+* What the composer needs to run a composition on an EXISTING device (D663)
+* besides the runtime and the claim-backed target: the target's description,
+* the claim shapes derived from the plan, and the block report's words.
+*
+* - The target is DESCRIBED (bound caps → native addon, row type) with ONE
+*   `getBindings` per plan change, cached until `device.bindings-changed` for
+*   that device. A read that fails keeps the previous description; with none,
+*   the block waits and nothing is claimed (D49).
+* - A claim's field set is the PLAN's (S5): the top-level fields of the cap, an
+*   item leaf contributing its whole array. Its mode is the feature's.
+* - A self-read of the target (rule 6) is served from the NATIVE view unless it
+*   reads an ADDED cap — that is the composition's own output. Whether a native
+*   cap's `device.state-changed` is the native or the composition's own merge
+*   is NOT decided here from the plan: it follows whether the claim has landed
+*   (`HeldClaims`, C-1).
+*/
+/** The reason every ungraft of a gone target carries (Task 9 rule 5 / Task 10 rule 2). */
+var TARGET_GONE_UNGRAFT_REASON = "target device gone";
+/**
+* Rule 5, on either path that finds the target gone (`device.unregistered`, or
+* a later plan when that event was dropped): ungraft every cap the block ADDED
+* on that id, with the one ERROR that says so.
+*/
+function ungraftGoneTarget(input) {
+	const { grafts, deviceId } = input;
+	const added = addedCapsOf(input.features);
+	for (const cap of added) grafts?.ungraft(deviceId, cap, TARGET_GONE_UNGRAFT_REASON);
+	input.logger.error("customization target device is gone — the block failed and its grafts are removed; only the operator ends this (edit or restart the block)", {
+		tags: { deviceId },
+		meta: {
+			blockId: input.blockId,
+			target: compositionSourceKey(input.ref),
+			ungrafted: added,
+			graftHost: grafts !== void 0
+		}
+	});
+}
+var TargetDescriptions = class {
+	logger;
+	readBoundCaps;
+	cache = /* @__PURE__ */ new Map();
+	constructor(logger, readBoundCaps) {
+		this.logger = logger;
+		this.readBoundCaps = readBoundCaps;
+	}
+	/** `device.bindings-changed` for this device: the next read is a real read. */
+	invalidate(deviceId) {
+		this.cache = new Map([...this.cache].filter(([, d]) => d.deviceId !== deviceId));
+	}
+	/**
+	* The description of `ref`, resolved to `deviceId`. Served from the cache
+	* unless `force` (the block's plan changed) or nothing is cached. A read that
+	* fails keeps the previous description of the SAME device id, and answers
+	* null when there is none: the caller waits, and claims nothing.
+	*/
+	async describe(ref, deviceId, type, force) {
+		const key = compositionSourceKey(ref);
+		const cached = this.cache.get(key);
+		const previous = cached !== void 0 && cached.deviceId === deviceId ? cached : null;
+		if (!force && previous !== null) return previous;
+		const read = await this.readBoundCaps(deviceId);
+		if (read.kind === "unreadable") {
+			this.logger.warn(previous === null ? "customization target: its bindings could not be read — nothing is claimed until they are; retried on the next apply" : "customization target: its bindings could not be read — the previous description is kept", {
+				tags: { deviceId },
+				meta: {
+					target: key,
+					error: read.error
+				}
+			});
+			return previous;
+		}
+		const found = {
+			kind: "found",
+			deviceId,
+			type,
+			nativeCaps: read.caps
+		};
+		this.cache = new Map([...this.cache, [key, found]]);
+		return found;
+	}
+};
+/** The PLANNED field set a claim carries for `cap` (S5): an item leaf claims its whole array. */
+function claimFieldsOf(fields, cap) {
+	return [...new Set(fields.filter((f) => f.cap === cap).map((f) => f.item === void 0 ? f.path : f.item.arrayPath))];
+}
+/** The claim mode of `cap`: `replace` for a cap the device serves natively, else `add`. */
+function claimModeOf(features, cap) {
+	return features.find((f) => f.cap === cap)?.mode === "replace" ? "replace" : "add";
+}
+/** The caps a customization ADDS to its target — the ones it grafts a native for (Task 10). */
+function addedCapsOf(features) {
+	return features.filter((f) => f.mode === "add").map((f) => f.cap);
+}
+function selfReadCaps(fields, target, features) {
+	const targetKey = compositionSourceKey(target);
+	const read = new Set(fields.flatMap((f) => f.reads.filter((r) => compositionSourceKey(r.source) === targetKey).map((r) => r.cap)));
+	const added = new Set(addedCapsOf(features));
+	return {
+		effective: [...read].filter((cap) => added.has(cap)),
+		native: [...read].filter((cap) => !added.has(cap))
+	};
+}
+/** The `degraded` reason (rule 8): one entry per released field, the source's own reason after the dash. */
+function degradedReason(released) {
+	return released.map((r) => {
+		const path = r.item === void 0 ? r.path : compositionItemFieldPath(r.item.arrayPath, r.item.key, r.path);
+		return `released to the native provider: ${r.cap}.${path} — ${r.reason}`;
+	}).join("; ");
+}
+/** The `starting` reason of a block with HELD fields: each keeps its last value and claim until its source answers (D49). */
+function heldReason(held) {
+	return held.map((r) => {
+		const path = r.item === void 0 ? r.path : compositionItemFieldPath(r.item.arrayPath, r.item.key, r.path);
+		return `held on its last value until its source answers (D49): ${r.cap}.${path} — ${r.reason}`;
+	}).join("; ");
+}
+/**
+* Rule 4: a customization whose row exists but whose plan failed keeps its
+* claims, so its owned fields stay at their last value on the hub. The report
+* says so — each field that had a value is `stale`, with the reason.
+*/
+function heldFieldsOf(fields, reason) {
+	return fields.map((f) => f.state === "unavailable" ? f : {
+		...f,
+		state: "stale",
+		reason
+	});
+}
+//#endregion
+//#region src/builtins/composer/composer-grafts.ts
+/**
+* The composer's side of grafts (D663, Task 10): WHEN a cap a customization
+* ADDS is grafted, removed or refused — `GraftHost` is only the how. Split from
+* `composer.ts`.
+*
+* - Decided at PLAN time only (rule 2): every added cap is grafted; a grafted
+*   cap the plan now finds native is ungrafted (its event was dropped, D8).
+* - NATIVE ALWAYS WINS (I-2). A foreign `native-registered` on a grafted cap
+*   ungrafts it (the claim stays). One that lands while a plan is in flight —
+*   after the target's description was read, before the graft — is remembered
+*   per described device, so that plan never grafts over it. A foreign
+*   `native-unregistered` never re-grafts (D659).
+* - A cap no graft serves is NAMED for the block verdict (I-1): refused by the
+*   host, or taken by a native. Every added cap unserved → the block fails.
+* - A binding a PREVIOUS composer process left (a respawn, D5) is retracted
+*   when a settled plan does not want it (I-3), or when the gate releases the
+*   add claim of a block that is gone — after reading that the binding IS the
+*   composer's; a read that fails retracts nothing (D49).
+*/
+/** A foreign native now serves the grafted cap: the claim stays (Task 10 rule 2). */
+var NATIVE_APPEARED_UNGRAFT_REASON = "a native provider appeared";
+/** The block's add claim was released by the D49 gate (deleted, disabled, feature removed): its graft goes with it. */
+var NO_LONGER_ADDED_UNGRAFT_REASON = "the block no longer adds this cap";
+/** A binding a previous composer process left, that nothing wants any more (I-3). */
+var STALE_GRAFT_RETRACT_REASON = "a graft left by a previous composer process that no plan wants";
+function withEntry(map, key, value) {
+	return new Map([...map, [key, value]]);
+}
+function nativeTakenReason(addonId, when) {
+	return `a native provider (${addonId}) ${when} — the cap is not grafted and its claim is kept; edit or restart the block to replace the native instead`;
+}
+var ComposerGrafts = class {
+	ports;
+	logger;
+	readBindings;
+	/** Per device: the added caps no graft serves, and why. Reset by each plan of that device. */
+	unserved = /* @__PURE__ */ new Map();
+	/** Per DESCRIBED device: foreign natives registered since its description was read (cap → addonId). */
+	foreignSince = /* @__PURE__ */ new Map();
+	constructor(ports, logger, readBindings) {
+		this.ports = ports;
+		this.logger = logger;
+		this.readBindings = readBindings;
+	}
+	/** A description of `deviceId` is about to be read: it covers every registration before now. */
+	describing(deviceId) {
+		this.foreignSince = withEntry(this.foreignSince, deviceId, /* @__PURE__ */ new Map());
+	}
+	onBindingsChanged(data) {
+		if (data.addonId === "composer") return;
+		this.remember(data);
+		const ports = this.ports;
+		if (data.reason !== "native-registered" || ports === void 0) return;
+		if (!ports.grafted(data.deviceId).has(data.capName)) return;
+		this.logger.info("a native provider appeared on a grafted cap — the graft is removed; the claim stays", {
+			tags: { deviceId: data.deviceId },
+			meta: {
+				cap: data.capName,
+				addonId: data.addonId
+			}
+		});
+		ports.ungraft(data.deviceId, data.capName, NATIVE_APPEARED_UNGRAFT_REASON);
+		this.setUnserved(data.deviceId, data.capName, nativeTakenReason(data.addonId, "appeared"));
+	}
+	/** Rule 2, at plan time only: graft what the plan adds; ungraft what it finds native; retract what a previous process left. */
+	plan(input) {
+		const ports = this.ports;
+		if (ports === void 0) return;
+		const { deviceId } = input;
+		const added = input.enabled && input.settled ? addedCapsOf(input.features) : [];
+		const replaced = new Set(input.features.filter((f) => f.mode === "replace").map((f) => f.cap));
+		for (const cap of ports.grafted(deviceId)) {
+			if (!replaced.has(cap)) continue;
+			this.logger.info("a native provider serves a grafted cap — the graft is removed; the claim stays", {
+				tags: { deviceId },
+				meta: { cap }
+			});
+			ports.ungraft(deviceId, cap, NATIVE_APPEARED_UNGRAFT_REASON);
+		}
+		if (input.settled) this.retractUnwanted(input, new Set(added));
+		const foreign = this.foreignSince.get(deviceId) ?? /* @__PURE__ */ new Map();
+		const unserved = /* @__PURE__ */ new Map();
+		for (const cap of added) {
+			const other = foreign.get(cap);
+			if (other !== void 0) {
+				const reason = nativeTakenReason(other, "registered while the block was planning");
+				this.logger.warn("graft skipped — a native provider serves the cap (native always wins)", {
+					tags: { deviceId },
+					meta: {
+						cap,
+						addonId: other
+					}
+				});
+				unserved.set(cap, reason);
+				continue;
+			}
+			const outcome = ports.graft(deviceId, input.ref.stableId, cap);
+			if (outcome.kind === "refused") unserved.set(cap, `graft refused: ${outcome.reason}`);
+		}
+		this.unserved = withEntry(this.unserved, deviceId, unserved);
+	}
+	/** The gate released a claim: a graft of that cap goes with it; a previous process's binding is retracted once read as the composer's. */
+	async released(deviceId, capName) {
+		const ports = this.ports;
+		if (ports === void 0) return;
+		this.setUnserved(deviceId, capName, null);
+		if (ports.grafted(deviceId).has(capName)) {
+			ports.ungraft(deviceId, capName, NO_LONGER_ADDED_UNGRAFT_REASON);
+			return;
+		}
+		let read;
+		try {
+			read = await this.readBindings(deviceId);
+		} catch (err) {
+			read = {
+				kind: "unreadable",
+				error: errMsg(err)
+			};
+		}
+		if (read.kind === "unreadable") {
+			this.logger.warn("a released claim: the bindings could not be read — a graft left by a previous process, if any, is not retracted (D49)", {
+				tags: { deviceId },
+				meta: {
+					cap: capName,
+					error: read.error
+				}
+			});
+			return;
+		}
+		if (read.caps.get(capName) === "composer") ports.retractStale(deviceId, capName, STALE_GRAFT_RETRACT_REASON);
+	}
+	/** The target row is gone: nothing about it is reported any more. */
+	gone(deviceId) {
+		this.unserved = new Map([...this.unserved].filter(([id]) => id !== deviceId));
+	}
+	verdict(deviceId, features) {
+		const added = addedCapsOf(features);
+		const unserved = this.unserved.get(deviceId) ?? /* @__PURE__ */ new Map();
+		const named = added.flatMap((cap) => {
+			const reason = unserved.get(cap);
+			return reason === void 0 ? [] : [`${cap}: ${reason}`];
+		});
+		if (named.length === 0) return null;
+		return {
+			allUnserved: named.length === added.length && added.length === features.length,
+			reason: `added caps no graft serves — ${named.join("; ")}`
+		};
+	}
+	retractUnwanted(input, wanted) {
+		const ports = this.ports;
+		if (ports === void 0) return;
+		const own = ports.grafted(input.deviceId);
+		for (const [cap, addonId] of input.nativeCaps) {
+			if (addonId !== "composer" || own.has(cap) || wanted.has(cap)) continue;
+			this.logger.info("a graft left by a previous composer process is retracted", {
+				tags: { deviceId: input.deviceId },
+				meta: { cap }
+			});
+			ports.retractStale(input.deviceId, cap, STALE_GRAFT_RETRACT_REASON);
+		}
+	}
+	remember(data) {
+		const seen = this.foreignSince.get(data.deviceId);
+		if (seen === void 0) return;
+		if (data.reason === "native-registered") this.foreignSince = withEntry(this.foreignSince, data.deviceId, new Map([...seen, [data.capName, data.addonId]]));
+		else if (data.reason === "native-unregistered" && seen.get(data.capName) === data.addonId) this.foreignSince = withEntry(this.foreignSince, data.deviceId, new Map([...seen].filter(([cap]) => cap !== data.capName)));
+	}
+	setUnserved(deviceId, cap, reason) {
+		const current = this.unserved.get(deviceId) ?? /* @__PURE__ */ new Map();
+		const next = new Map([...current].filter(([c]) => c !== cap));
+		if (reason !== null) next.set(cap, reason);
+		this.unserved = withEntry(this.unserved, deviceId, next);
+	}
+};
+//#endregion
+//#region src/builtins/composer/composer-verdict.ts
+/** A runtime built by an apply, before the apply's sync decides whether it may start. */
+var NOT_STARTED = "the runtime has not started yet";
+function verdictOf(blockId, entry, unsynced, grafts = null) {
+	if (entry === void 0) return {
+		blockId,
+		status: "starting",
+		reason: "not applied yet"
+	};
+	if (entry.rebuildError !== null) return {
+		blockId,
+		status: "failed",
+		reason: `rebuilding the composed device for its new shape failed: ${entry.rebuildError}`
+	};
+	if (entry.planned.problems.length > 0) {
+		const kept = entry.planned.declaration === null ? "" : " — its device is kept offline with no capabilities";
+		return {
+			blockId,
+			status: "failed",
+			reason: `the composition does not validate: ${entry.planned.problems.join("; ")}${kept}`
+		};
+	}
+	if (!entry.planned.block.enabled) return {
+		blockId,
+		status: "stopped"
+	};
+	const target = entry.planned.target;
+	if (target.kind === "existing") {
+		if (target.gone !== null) return {
+			blockId,
+			status: "failed",
+			reason: `the target device is gone: ${target.gone}`
+		};
+		if (target.waiting !== null) return {
+			blockId,
+			status: "starting",
+			reason: target.waiting
+		};
+	} else if (entry.device === null) return {
+		blockId,
+		status: "starting",
+		reason: "the composed device has not been constructed yet"
+	};
+	const runtime = entry.runtime;
+	if (runtime === null) return target.kind === "existing" ? {
+		blockId,
+		status: "starting",
+		reason: NOT_STARTED
+	} : {
+		blockId,
+		status: "running"
+	};
+	if (unsynced) return {
+		blockId,
+		status: "starting",
+		reason: NOT_STARTED
+	};
+	const state = runtime.state();
+	if (state.failure !== null) return {
+		blockId,
+		status: "failed",
+		reason: state.failure
+	};
+	if (grafts?.allUnserved === true) return {
+		blockId,
+		status: "failed",
+		reason: grafts.reason
+	};
+	const degraded = [...state.released.length > 0 ? [degradedReason(state.released)] : [], ...grafts === null ? [] : [grafts.reason]];
+	if (degraded.length > 0) return {
+		blockId,
+		status: "degraded",
+		reason: degraded.join("; ")
+	};
+	if (state.held.length > 0) return {
+		blockId,
+		status: "starting",
+		reason: heldReason(state.held)
+	};
+	return {
+		blockId,
+		status: "running"
+	};
+}
+//#endregion
+//#region src/builtins/composer/owned-fields-target.ts
+/**
+* The write target of a composition on an EXISTING device (D663): its fields
+* are CLAIMED on the hub (`deviceState.claimFields`), then patched
+* (`patchOwnedFields`). The runtime's `seed`/`patch` are synchronous and never
+* fail here — the RPC is enqueued — so what did not land is reported through
+* `onAsyncFailure`, and the runtime marks the cap write-pending and re-writes
+* it whole on its next pass. No retry timer (D3).
+*
+* - **The claim is re-sent until it has LANDED (ruling S5).** A cap enters
+*   `landed` only on an `ok` claim answer. Every write of a cap not in `landed`
+*   is a claim carrying the FULL planned field set (`fieldsOf`, never inferred
+*   from the values). `not-claimed` / `field-not-claimed` — the hub lost or
+*   never had the claim — drop the cap from `landed` and are escalated by
+*   name, so the next write claims again.
+* - **Concurrent partial patches are MERGED, never dropped (S5).** One chain
+*   per cap: while an RPC is in flight, later patches fold into one pending
+*   value set (later keys win; a seed replaces it wholly), and the landing log
+*   says how many were absorbed (D391).
+* - **A released field is withheld (S1b).** `withhold(cap, fields)` narrows the
+*   next claim to the rest and omits their values; nothing left → the claim is
+*   released at once. `[]` re-widens.
+* - **Every claim RPC of a `replace` cap is reported** (`onClaim`, C-1/N-1):
+*   `claiming` when it goes out, then `held` on an `ok`, `free` on a confirmed
+*   release or `not-claimed`, `unsettled` on a throw or any other refusal (D49:
+*   changes nothing). `field-not-claimed` on a patch drops `landed` so the next
+*   write claims again, but the hub still holds the claim: `held` stays (N-3).
+*   The tracker follows this — never the plan — to know whether
+*   `device.state-changed` of the cap is the provider's native, the
+*   composition's own merge, or (while a claim is in flight) neither.
+* - `setAvailable` is a no-op: `device-status` is the native device's.
+*/
+var ACCEPTED = { ok: true };
+/** The hub has no claim to patch: the next write must claim again. */
+var CLAIM_LOST_CODES = new Set(["not-claimed", "field-not-claimed"]);
+/**
+* Later keys win; a seed replaces the pending values wholly; a release
+* supersedes any pending values (nothing is left to write) and is itself
+* superseded by a later write (a claim REPLACES the hub's field set anyway).
+*/
+function fold(current, next) {
+	if (current === void 0 || next.kind === "release" || current.kind === "release") return next;
+	if (next.op === "seed") return {
+		...next,
+		merged: current.merged + 1
+	};
+	return {
+		kind: "write",
+		op: current.op,
+		values: {
+			...current.values,
+			...next.values
+		},
+		merged: current.merged + 1
+	};
+}
+function omitKeys(values, keys) {
+	if (keys === void 0 || keys.size === 0) return values;
+	return Object.fromEntries(Object.entries(values).filter(([key]) => !keys.has(key)));
+}
+var OwnedFieldsTarget = class {
+	deps;
+	id;
+	landed = /* @__PURE__ */ new Set();
+	withheld = /* @__PURE__ */ new Map();
+	inFlight = /* @__PURE__ */ new Set();
+	pending = /* @__PURE__ */ new Map();
+	listeners = [];
+	/** Per cap, bumped by every `withhold`: a claim that settles under another epoch claimed a stale field set and does not land (I-2). */
+	epoch = /* @__PURE__ */ new Map();
+	constructor(deps) {
+		this.deps = deps;
+		this.id = deps.deviceId;
+	}
+	seed(cap, slice) {
+		this.enqueue(cap, {
+			kind: "write",
+			op: "seed",
+			values: slice,
+			merged: 0
+		});
+		return ACCEPTED;
+	}
+	patch(cap, patch) {
+		this.enqueue(cap, {
+			kind: "write",
+			op: "patch",
+			values: patch,
+			merged: 0
+		});
+		return ACCEPTED;
+	}
+	/** `device-status` belongs to the native device; availability lives in the block report only. */
+	setAvailable(_available) {}
+	onAsyncFailure(listener) {
+		this.listeners = [...this.listeners, listener];
+	}
+	withhold(cap, fields) {
+		this.withheld = new Map([...this.withheld.entries()].filter(([c]) => c !== cap).concat(fields.length === 0 ? [] : [[cap, new Set(fields)]]));
+		this.landed = new Set([...this.landed].filter((c) => c !== cap));
+		this.epoch = new Map([...this.epoch, [cap, (this.epoch.get(cap) ?? 0) + 1]]);
+		if (this.claimableFields(cap).length === 0) this.enqueue(cap, { kind: "release" });
+		return ACCEPTED;
+	}
+	claimableFields(cap) {
+		const held = this.withheld.get(cap);
+		return this.deps.fieldsOf(cap).filter((f) => held === void 0 || !held.has(f));
+	}
+	enqueue(cap, op) {
+		if (!this.inFlight.has(cap)) {
+			this.send(cap, op);
+			return;
+		}
+		this.pending = new Map([...this.pending, [cap, fold(this.pending.get(cap), op)]]);
+	}
+	send(cap, op) {
+		this.inFlight = new Set([...this.inFlight, cap]);
+		(op.kind === "release" ? this.sendRelease(cap) : this.sendWrite(cap, op)).then(() => this.settled(cap), (err) => {
+			this.deps.logger.error("composed write chain threw past its handlers — the chain continues", {
+				tags: { deviceId: this.deps.deviceId },
+				meta: {
+					cap,
+					owner: this.deps.owner,
+					error: errMsg(err)
+				}
+			});
+			this.settled(cap);
+		});
+	}
+	settled(cap) {
+		this.inFlight = new Set([...this.inFlight].filter((c) => c !== cap));
+		const next = this.pending.get(cap);
+		if (next === void 0) return;
+		this.pending = new Map([...this.pending].filter(([c]) => c !== cap));
+		this.send(cap, next);
+	}
+	async sendWrite(cap, op) {
+		const values = omitKeys(op.values, this.withheld.get(cap));
+		const claim = !this.landed.has(cap);
+		const fields = this.claimableFields(cap);
+		const epoch = this.epoch.get(cap) ?? 0;
+		if (claim && fields.length === 0) {
+			this.deps.logger.debug("composed write skipped — every field of the capability is withheld", {
+				tags: { deviceId: this.deps.deviceId },
+				meta: {
+					cap,
+					owner: this.deps.owner,
+					op: op.op
+				}
+			});
+			return;
+		}
+		if (!claim && Object.keys(values).length === 0) return;
+		if (claim) this.report(cap, "claiming");
+		let outcome;
+		try {
+			outcome = claim ? await this.deps.api.claimFields({
+				deviceId: this.deps.deviceId,
+				capName: cap,
+				owner: this.deps.owner,
+				mode: this.deps.modeOf(cap),
+				fields: [...fields],
+				values
+			}) : await this.deps.api.patchOwnedFields({
+				deviceId: this.deps.deviceId,
+				capName: cap,
+				owner: this.deps.owner,
+				values
+			});
+		} catch (err) {
+			if (claim) this.report(cap, "unsettled");
+			this.fail(cap, {
+				kind: "threw",
+				error: errMsg(err)
+			});
+			return;
+		}
+		if (outcome.ok) {
+			if (claim) this.report(cap, "held");
+			const current = (this.epoch.get(cap) ?? 0) === epoch;
+			if (claim && current) this.landed = new Set([...this.landed, cap]);
+			if (claim && !current) this.deps.logger.info("composed claim landed with a field set a withhold has since changed — the next write claims again", {
+				tags: { deviceId: this.deps.deviceId },
+				meta: {
+					cap,
+					owner: this.deps.owner,
+					fields
+				}
+			});
+			this.logLanded(cap, op, claim, fields);
+			return;
+		}
+		if (CLAIM_LOST_CODES.has(outcome.code)) this.landed = new Set([...this.landed].filter((c) => c !== cap));
+		if (outcome.code === "not-claimed") this.report(cap, "free");
+		else if (claim) this.report(cap, "unsettled");
+		this.fail(cap, {
+			kind: "refused",
+			code: outcome.code,
+			message: outcome.message
+		});
+	}
+	async sendRelease(cap) {
+		const extras = {
+			tags: { deviceId: this.deps.deviceId },
+			meta: {
+				cap,
+				owner: this.deps.owner
+			}
+		};
+		let outcome;
+		try {
+			outcome = await this.deps.api.releaseClaim({
+				deviceId: this.deps.deviceId,
+				capName: cap,
+				owner: this.deps.owner
+			});
+		} catch (err) {
+			this.fail(cap, {
+				kind: "threw",
+				error: errMsg(err)
+			});
+			return;
+		}
+		if (outcome.ok) {
+			this.report(cap, "free");
+			this.deps.logger.info("composed claim released — every field of the capability is handed back to the native provider", extras);
+			return;
+		}
+		if (outcome.code === "not-claimed") {
+			this.report(cap, "free");
+			this.deps.logger.debug("composed claim release found nothing to hand back", extras);
+			return;
+		}
+		this.fail(cap, {
+			kind: "refused",
+			code: outcome.code,
+			message: outcome.message
+		});
+	}
+	logLanded(cap, op, claim, fields) {
+		const tags = { deviceId: this.deps.deviceId };
+		if (op.merged > 0) this.deps.logger.info("composed write landed after absorbing merged patches", {
+			tags,
+			meta: {
+				cap,
+				owner: this.deps.owner,
+				op: op.op,
+				claim,
+				merged: op.merged
+			}
+		});
+		if (claim) this.deps.logger.info("composed claim landed", {
+			tags,
+			meta: {
+				cap,
+				owner: this.deps.owner,
+				mode: this.deps.modeOf(cap),
+				fields
+			}
+		});
+	}
+	/** Only a `replace` cap has a native the tracker must tell apart from the merge (N-7). */
+	report(cap, event) {
+		if (this.deps.modeOf(cap) === "replace") this.deps.onClaim?.(cap, event);
+	}
+	/** Escalated to the runtime; a failure nobody listens to is logged — never silent (D391). */
+	fail(cap, failure) {
+		if (this.listeners.length === 0) this.deps.logger.warn("composed write did not land and no runtime listens for it", {
+			tags: { deviceId: this.deps.deviceId },
+			meta: {
+				cap,
+				owner: this.deps.owner,
+				...failure.kind === "threw" ? { error: failure.error } : {
+					code: failure.code,
+					error: failure.message
+				}
+			}
+		});
+		for (const listener of this.listeners) listener(cap, failure);
+	}
+};
+//#endregion
 //#region src/builtins/composer/composer.ts
 /**
 * The composer: every declarative composition on this hub, in one runner
@@ -602,38 +2085,139 @@ var CompositionRuntime = class {
 * (`WithdrawalGate.seed`). A block whose row exists but whose composition no
 * longer plans (a cap renamed by a release) keeps its device as an offline
 * placeholder with no capabilities, and reports `failed` naming why.
+*
+* Slice 2 (D663) — a composition on an EXISTING device declares nothing: the
+* row is not the composer's, `DeclaredDevices` never sees it, and the owner
+* filter in `composer.addon.ts` stays load-bearing. Its fields are CLAIMED on
+* the hub under the block id (`OwnedFieldsTarget`), and released through the
+* `ClaimGate` — two applies must agree, seeded at boot from the claims index —
+* when the block is gone, disabled, or lost the feature. Its own replaced
+* fields are read in the NATIVE view (rule 6). Its target row gone on two
+* agreeing index reads fails the block by name and ungrafts what it added —
+* whether the loss was seen on `device.unregistered` or on a later plan; its
+* claims die with the row. Nothing is claimed or released while the claims
+* index has not loaded (`CLAIMS_NOT_LOADED`). Planning is `composer-plan.ts`.
+*
+* A cap the customization ADDS is GRAFTED (`GraftHost`, Task 10): a
+* method-serving native on the target, decided at plan time only; when and why
+* is `composer-grafts.ts` (native always wins; an unserved cap is named in the
+* verdict; a previous process's leftover is retracted).
+*
+* A replaced field is handed back only on a CONFIRMED unavailability of its
+* source (D49, fix round 2): a failed, first or empty read HOLDS it on its last
+* value with its claim kept — the runtime's `held`, reported `starting` by name.
+* A runtime built by an apply starts in that apply's sync, never earlier from
+* an event (N-5).
 */
 var INTEGRATION_WAIT = "waiting for the shared Blocks integration to reconcile";
 var STORE_NOT_LOADED = "the core_blocks store has not loaded — nothing is declared or withdrawn until it does (D49)";
 var ROWS_UNREAD = "the composer's own device rows could not be read — nothing is declared or withdrawn until they are (D49)";
 var ROWS_EMPTY_UNCONFIRMED = "the composer's own device rows read empty once — a cold registry answers the same, so nothing is declared or withdrawn until the next apply's read agrees (D49)";
-/** The shape of a placeholder: no caps, so no plan to take a shape from. */
-var PLACEHOLDER_SHAPE = "placeholder";
+var CLAIMS_NOT_LOADED = "the claims index has not loaded — nothing is claimed or released until it does (D49)";
+var CLAIMS_EMPTY_UNCONFIRMED = "the claims index read empty once — nothing is claimed or released until the next apply's read agrees (D49)";
+/** A release answered with one of these hands back nothing of ours: the gate forgets the claim. */
+var RELEASE_SETTLED_CODES = new Set([
+	"not-claimed",
+	"unknown-device",
+	"owned-by-other"
+]);
 var Composer = class {
 	deps;
 	live = /* @__PURE__ */ new Map();
-	devices = /* @__PURE__ */ new Map();
-	/** StableIds whose row exists: the seeded persisted rows, then what every declare kept. */
-	rows = /* @__PURE__ */ new Set();
-	seeded = false;
-	/** The previous seed read answered `[]`: one more `[]` confirms it (D49). */
-	emptySeedSeen = false;
+	/** The composed devices of `new`-target blocks, and the rows that exist. */
+	composed;
 	/** Consecutive applies refused because `core_blocks` had not loaded: warned once per run. */
 	storeWaitApplies = 0;
 	/** Consecutive applies refused because the Blocks integration had not reconciled: warned once per run. */
 	integrationWaitApplies = 0;
-	declaredFingerprint = null;
 	gate;
+	claimGate;
+	targets;
+	grafts;
+	/** The rows the composer owns, read ONCE before its first withdrawal decision. */
+	rowSeed;
+	/**
+	* The claims the hub holds, read ONCE before the first release decision (rule
+	* 3). Every owner in it is a composer block id — the Task 6 guard lets nothing
+	* else claim. `not-loaded` is UNKNOWN (D315), never empty. Until seeded, every
+	* existing-target block waits by name; new-target blocks are not held.
+	*/
+	claimSeed;
 	/** Applies never interleave: each one reads and replaces the whole live set. */
 	applyChain = Promise.resolve();
+	/**
+	* Runtimes built by an apply and not started yet: that apply's sync starts
+	* them, with their sources tracked. An event in between never does (N-5) —
+	* it would start one on sources "not tracked yet".
+	*/
+	unsynced = /* @__PURE__ */ new Set();
 	constructor(deps) {
 		this.deps = deps;
-		this.gate = new WithdrawalGate(deps.logger.child("withdrawal"), (stableId) => this.devices.get(stableId)?.id ?? null);
+		this.composed = new ComposedDeviceSet({
+			logger: deps.logger,
+			declare: deps.declare,
+			devices: deps.devices
+		});
+		this.gate = new WithdrawalGate(deps.logger.child("withdrawal"), (stableId) => this.composed.idOf(stableId));
+		this.claimGate = new ClaimGate(deps.logger.child("claims"));
+		this.grafts = new ComposerGrafts(deps.grafts, deps.logger.child("graft"), deps.describeTarget);
+		this.targets = new TargetDescriptions(deps.logger.child("target"), (deviceId) => {
+			this.grafts.describing(deviceId);
+			return deps.describeTarget(deviceId);
+		});
+		this.rowSeed = new ConfirmedSeed({
+			logger: deps.logger,
+			subject: "composer's own device rows",
+			read: async () => {
+				try {
+					return {
+						kind: "items",
+						items: await deps.readPersisted()
+					};
+				} catch (err) {
+					return {
+						kind: "unknown",
+						error: errMsg(err)
+					};
+				}
+			},
+			onSeeded: (rows) => {
+				this.gate.seed(rows);
+				this.composed.seedRows(rows);
+			},
+			unreadReason: ROWS_UNREAD,
+			emptyUnconfirmedReason: ROWS_EMPTY_UNCONFIRMED
+		});
+		this.claimSeed = new ConfirmedSeed({
+			logger: deps.logger,
+			subject: "claims index",
+			read: async () => {
+				try {
+					const listing = await deps.claims.listClaims({ ownerPrefix: "" });
+					return listing.state === "loaded" ? {
+						kind: "items",
+						items: listing.claims
+					} : {
+						kind: "unknown",
+						error: listing.reason
+					};
+				} catch (err) {
+					return {
+						kind: "unknown",
+						error: errMsg(err)
+					};
+				}
+			},
+			onSeeded: (claims) => {
+				this.claimGate.seed(claims);
+				this.deps.tracker.seedClaims(claims);
+			},
+			unreadReason: CLAIMS_NOT_LOADED,
+			emptyUnconfirmedReason: CLAIMS_EMPTY_UNCONFIRMED
+		});
 	}
 	apply(input) {
-		const run = this.applyChain.then(() => this.applyNow(input), () => this.applyNow(input));
-		this.applyChain = run.then(() => void 0, () => void 0);
-		return run;
+		return this.chained(() => this.applyNow(input));
 	}
 	getStates(blockIds) {
 		return blockIds.flatMap((blockId) => {
@@ -642,10 +2226,10 @@ var Composer = class {
 			const verdict = this.verdict(blockId);
 			return [{
 				blockId,
-				deviceId: entry.device?.id ?? null,
+				deviceId: this.deviceIdOf(entry),
 				status: verdict.status,
 				...verdict.reason === void 0 ? {} : { reason: verdict.reason },
-				fields: entry.runtime?.state().fields.map((f) => ({ ...f })) ?? []
+				fields: entry.runtime?.state().fields.map((f) => ({ ...f })) ?? [...entry.heldFields]
 			}];
 		});
 	}
@@ -653,15 +2237,28 @@ var Composer = class {
 	async onStateChanged(data) {
 		this.dispatch(await this.deps.tracker.onStateChanged(data.deviceId, data.capName, data.slice));
 	}
+	async onNativeChanged(data) {
+		this.dispatch(await this.deps.tracker.onNativeChanged(data.deviceId, data.capName, data.native));
+	}
 	async onDeviceUnregistered(deviceId) {
-		this.dispatch(await this.deps.tracker.onDeviceUnregistered(deviceId));
+		const changed = await this.deps.tracker.onDeviceUnregistered(deviceId);
+		await this.chained(() => this.failGoneTargets(deviceId));
+		this.dispatch(changed);
 	}
 	async onBindingsChanged(data) {
+		this.targets.invalidate(data.deviceId);
+		this.grafts.onBindingsChanged(data);
 		this.dispatch(await this.deps.tracker.onBindingsChanged(data.deviceId, data.capName, data.reason));
 	}
 	shutdown() {
 		for (const entry of this.live.values()) entry.runtime?.stop();
 	}
+	/** Run `work` after every apply already queued, whether that settled or failed. */
+	chained(work) {
+		const run = this.applyChain.then(work, work);
+		this.applyChain = run.then(() => void 0, () => void 0);
+		return run;
+	}
 	async applyNow(input) {
 		const ids = [...input.blocks.map((b) => b.id), ...input.unreadableBlocks.map((u) => u.id)];
 		if (!input.storeLoaded) {
@@ -685,15 +2282,26 @@ var Composer = class {
 			this.deps.logger.info("composer: the shared Blocks integration has reconciled — applying again", { meta: { appliesRefused: this.integrationWaitApplies } });
 			this.integrationWaitApplies = 0;
 		}
-		const unseeded = await this.ensureSeeded();
+		const unseeded = await this.rowSeed.ensure();
 		if (unseeded !== null) return this.waiting(ids, unseeded);
-		const planned = [...input.blocks.map((block) => this.plan(block)), ...input.unreadableBlocks.map((block) => this.planUnreadable(block))];
-		this.logPlanTransitions(planned);
+		const claimsWait = await this.claimSeed.ensure();
+		const restart = new Set(input.restartBlockIds);
+		const planned = [];
+		for (const block of input.blocks) planned.push(await this.plan(block, restart, claimsWait));
+		for (const block of input.unreadableBlocks) planned.push(planUnreadable(block, this.composed.rows));
+		for (const p of planned) logPlanTransition(this.deps.logger, this.live.get(p.block.id)?.planned, p, this.tagsOf(p.block.id));
 		const declarations = this.gate.filter(planned.flatMap((p) => p.declaration === null ? [] : [p.declaration]));
-		const rebuildErrors = await this.rebuildShapes(planned);
-		await this.reconcileDevices(input.integrationId, declarations, planned);
-		const rebuilt = await this.rebuildRuntimes(planned, declarations, new Set(input.restartBlockIds), rebuildErrors);
+		const rebuildErrors = await this.composed.rebuildShapes(planned, (blockId) => {
+			const previous = this.live.get(blockId);
+			return previous === void 0 ? void 0 : {
+				device: previous.device,
+				shape: previous.planned.shape
+			};
+		});
+		await this.composed.reconcile(input.integrationId, declarations, planned);
+		const rebuilt = await this.rebuildRuntimes(planned, declarations, restart, rebuildErrors);
 		await this.syncSources(rebuilt);
+		await this.reconcileClaims();
 		return {
 			blocks: planned.map((p) => this.verdict(p.block.id)),
 			acted: true
@@ -709,177 +2317,20 @@ var Composer = class {
 			acted: false
 		};
 	}
-	/**
-	* Seed the withdrawal gate with the rows that exist, ONCE, before its first
-	* `filter`; answers null once seeded, else why this apply must wait.
-	*
-	* An EMPTY answer is the destroying direction: a cold registry answers `[]`
-	* too, and `DeclaredDevices.reconcile` sweeps from its OWN later read — so a
-	* cold seed followed by a warm sweep would delete the row of a block that no
-	* longer plans, with no placeholder to hold it. `[]` is therefore trusted
-	* only when the next apply's read agrees (D49); that apply comes from the
-	* supervisor's existing converge, never a timer here (D3). A failed read
-	* changes nothing and breaks the agreement.
-	*/
-	async ensureSeeded() {
-		if (this.seeded) return null;
-		let rows;
-		try {
-			rows = await this.deps.readPersisted();
-		} catch (err) {
-			this.emptySeedSeen = false;
-			this.deps.logger.warn("composer: reading its own device rows failed — nothing is declared or withdrawn; retried on the next apply", { meta: { error: errMsg(err) } });
-			return ROWS_UNREAD;
-		}
-		if (rows.length === 0 && !this.emptySeedSeen) {
-			this.emptySeedSeen = true;
-			this.deps.logger.warn("composer: its own device rows read empty — waiting for the next apply to confirm before declaring or withdrawing anything");
-			return ROWS_EMPTY_UNCONFIRMED;
-		}
-		this.gate.seed(rows);
-		this.rows = new Set(rows.map((r) => r.stableId));
-		this.seeded = true;
-		this.deps.logger.info("composer: seeded the withdrawal gate from the persisted rows", { meta: {
-			rows: rows.length,
-			confirmedEmpty: rows.length === 0
-		} });
-		return null;
-	}
-	/**
-	* A row that exists but does not parse is held exactly like a composition
-	* that stopped planning: its device (if it has a row) stays as an offline
-	* placeholder, and the block fails naming the parse error. Absent, it would
-	* be withdrawn on the second apply that omitted it (D49).
-	*/
-	planUnreadable(block) {
-		const stableId = composedDeviceStableId(block.id);
-		const hasRow = this.rows.has(stableId);
-		return {
-			block: {
-				id: block.id,
-				name: block.name,
-				enabled: false,
-				updatedAt: 0
-			},
-			fields: [],
-			problems: [`the stored block does not parse — ${block.error}`],
-			declaration: hasRow ? placeholderDeclaration(stableId) : null,
-			shape: hasRow ? PLACEHOLDER_SHAPE : null,
-			spec: null
-		};
-	}
-	plan(block) {
-		const plan = planComposition(block.composition, this.deps.lookupCap);
+	plan(block, restart, claimsWait) {
 		const target = block.composition.target;
-		if (plan.problems.length > 0 || target.kind !== "new") {
-			const problems = plan.problems.length > 0 ? plan.problems.map((p) => `${p.path}: ${p.message}`) : [`target: a \`${target.kind}\` target is not composable in this release`];
-			const stableId = composedDeviceStableId(block.id);
-			const hasRow = this.rows.has(stableId);
-			return {
-				block,
-				fields: [],
-				problems,
-				declaration: hasRow ? placeholderDeclaration(stableId) : null,
-				shape: hasRow ? PLACEHOLDER_SHAPE : null,
-				spec: null
-			};
-		}
-		const caps = block.composition.features.flatMap((f) => {
-			const def = this.deps.lookupCap(f.cap);
-			return def === null ? [] : [def];
-		});
-		const declarationInput = {
-			blockId: block.id,
-			name: block.name,
-			target,
-			caps
-		};
-		return {
+		if (target.kind === "new") return Promise.resolve(planNew(block, target, this.deps.lookupCap, this.composed.rows));
+		const previous = this.live.get(block.id)?.planned;
+		return planExisting({
 			block,
-			fields: plan.fields,
-			problems: [],
-			declaration: declarationFor(declarationInput),
-			shape: shapeOf(declarationInput),
-			spec: {
-				type: target.type,
-				...target.role === void 0 ? {} : { role: target.role }
-			}
-		};
-	}
-	/** One line when a block starts or stops planning — never one per apply. */
-	logPlanTransitions(planned) {
-		for (const p of planned) {
-			const before = this.live.get(p.block.id)?.planned.problems.join("; ") ?? "";
-			const now = p.problems.join("; ");
-			if (before === now) continue;
-			const extras = {
-				tags: this.tagsOf(p.block.id),
-				meta: {
-					blockId: p.block.id,
-					problems: p.problems,
-					placeholder: p.declaration !== null
-				}
-			};
-			if (now === "") this.deps.logger.info("composition plans again", extras);
-			else this.deps.logger.warn(p.declaration === null ? "composition does not plan — no device is declared for it" : "composition no longer plans — its device is kept offline with no capabilities", extras);
-		}
-	}
-	/**
-	* A changed type/role/cap set (or a switch to or from a placeholder) needs a
-	* NEW device object: decommission, and let the reconcile adopt it with the
-	* new class. A failure keeps the old device and is retried next apply.
-	*/
-	async rebuildShapes(planned) {
-		const errors = /* @__PURE__ */ new Map();
-		for (const p of planned) {
-			const previous = this.live.get(p.block.id);
-			const device = previous?.device ?? null;
-			if (previous === void 0 || device === null || p.shape === null) continue;
-			if (previous.planned.shape === p.shape) continue;
-			try {
-				this.deps.logger.info("composition shape changed — rebuilding its device", {
-					tags: { deviceId: device.id },
-					meta: {
-						blockId: p.block.id,
-						from: previous.planned.shape,
-						to: p.shape
-					}
-				});
-				if (p.spec !== null) await this.deps.devices.applyDerivedSpec(device.id, p.spec);
-				await this.deps.devices.decommission(device.id);
-				const stableId = composedDeviceStableId(p.block.id);
-				this.devices = new Map([...this.devices].filter(([s]) => s !== stableId));
-				this.declaredFingerprint = null;
-			} catch (err) {
-				const error = errMsg(err);
-				errors.set(p.block.id, error);
-				this.deps.logger.warn("rebuilding a composed device failed — the old one is kept", {
-					tags: { deviceId: device.id },
-					meta: {
-						blockId: p.block.id,
-						error
-					}
-				});
-			}
-		}
-		return errors;
-	}
-	async reconcileDevices(integrationId, declarations, planned) {
-		const shapes = new Map(planned.flatMap((p) => p.declaration === null ? [] : [[p.declaration.stableId, p.shape]]));
-		const fingerprint = JSON.stringify(declarations.map((d) => [d.stableId, shapes.get(d.stableId) ?? null]).toSorted());
-		const allLive = declarations.every((d) => this.devices.has(d.stableId));
-		if (fingerprint === this.declaredFingerprint && allLive) return;
-		try {
-			const result = await this.deps.declare(integrationId, declarations);
-			this.devices = result.devices;
-			this.rows = new Set(declarations.map((d) => d.stableId).filter((s) => this.rows.has(s) || result.devices.has(s)));
-			this.declaredFingerprint = fingerprint;
-		} catch (err) {
-			this.deps.logger.warn("composer: the device declaration failed — keeping the devices already live", { meta: {
-				error: errMsg(err),
-				declarations: declarations.length
-			} });
-		}
+			target,
+			previous,
+			operatorAction: previous === void 0 || restart.has(block.id) || previous.block.updatedAt !== block.updatedAt,
+			claimsWait,
+			tracker: this.deps.tracker,
+			targets: this.targets,
+			lookupCap: this.deps.lookupCap
+		});
 	}
 	async rebuildRuntimes(planned, declarations, restart, rebuildErrors) {
 		const reset = /* @__PURE__ */ new Set();
@@ -887,6 +2338,8 @@ var Composer = class {
 		const next = /* @__PURE__ */ new Map();
 		for (const p of planned) {
 			const previous = this.live.get(p.block.id);
+			const lost = lostTarget(p, previous?.planned);
+			if (lost !== null) this.ungraftGone(p.block.id, lost.target, lost.deviceId);
 			const rebuildError = rebuildErrors.get(p.block.id) ?? null;
 			if (previous !== void 0 && rebuildError !== null) {
 				next.set(p.block.id, {
@@ -895,28 +2348,45 @@ var Composer = class {
 				});
 				continue;
 			}
-			const device = this.devices.get(composedDeviceStableId(p.block.id)) ?? null;
+			const device = p.target.kind === "existing" ? null : this.composed.get(composedDeviceStableId(p.block.id));
 			const appliedName = device === null ? null : p.block.name === null ? previous?.appliedName ?? device.name : await this.applyName(device, p.block.name, previous?.appliedName ?? null);
-			if (previous?.runtime != null && previous.device === device && previous.planned.block.updatedAt === p.block.updatedAt && previous.planned.block.enabled === p.block.enabled && !restart.has(p.block.id)) {
+			if (previous?.runtime != null && previous.device === device && sameTarget(previous.planned.target, p.target) && previous.planned.block.updatedAt === p.block.updatedAt && previous.planned.block.enabled === p.block.enabled && !restart.has(p.block.id)) {
 				next.set(p.block.id, {
 					planned: p,
 					device,
 					runtime: previous.runtime,
 					appliedName,
-					rebuildError: null
+					rebuildError: null,
+					heldFields: []
 				});
 				continue;
 			}
+			const heldFields = this.heldFieldsFor(p, previous);
 			previous?.runtime?.stop();
-			if (previous === void 0 || restart.has(p.block.id) || previous.planned.block.updatedAt !== p.block.updatedAt) for (const f of p.fields) for (const r of f.reads) reset.add(compositionSourceKey(r.source));
-			const runtime = device === null || p.fields.length === 0 ? null : this.newRuntime(p, device);
+			const operatorAction = previous === void 0 || restart.has(p.block.id) || previous.planned.block.updatedAt !== p.block.updatedAt;
+			const targetKey = p.target.kind === "existing" ? compositionSourceKey(p.target.ref) : null;
+			if (operatorAction) for (const f of p.fields) for (const r of f.reads) {
+				const key = compositionSourceKey(r.source);
+				if (key !== targetKey) reset.add(key);
+			}
+			const writer = this.writerFor(p, device);
+			if (writer !== null && p.target.kind === "existing" && p.target.deviceId !== null) this.grafts.plan({
+				deviceId: p.target.deviceId,
+				ref: p.target.ref,
+				features: p.target.features,
+				nativeCaps: p.target.nativeCaps,
+				enabled: p.block.enabled,
+				settled: p.problems.length === 0
+			});
+			const runtime = writer === null || p.fields.length === 0 ? null : this.newRuntime(p, writer);
 			if (runtime !== null) fresh.add(runtime);
 			next.set(p.block.id, {
 				planned: p,
 				device,
 				runtime,
 				appliedName,
-				rebuildError: null
+				rebuildError: null,
+				heldFields
 			});
 		}
 		const held = new Set(declarations.map((d) => d.stableId));
@@ -926,17 +2396,69 @@ var Composer = class {
 			else entry.runtime?.stop();
 		}
 		this.live = next;
-		return {
-			reset,
-			fresh
-		};
+		const liveRuntimes = new Set([...next.values()].map((e) => e.runtime));
+		this.unsynced = new Set([...[...this.unsynced].filter((r) => liveRuntimes.has(r)), ...fresh]);
+		return { reset };
+	}
+	ungraftGone(blockId, target, deviceId) {
+		this.grafts.gone(deviceId);
+		ungraftGoneTarget({
+			grafts: this.deps.grafts,
+			logger: this.deps.logger,
+			blockId,
+			deviceId,
+			ref: target.ref,
+			features: target.features
+		});
 	}
-	newRuntime(p, device) {
+	/** Where a block's runtime writes: its composed device, or a claim-backed target on the existing device. */
+	writerFor(p, device) {
+		const target = p.target;
+		if (target.kind !== "existing") return device;
+		if (target.deviceId === null || target.waiting !== null || target.gone !== null) return null;
+		const deviceId = target.deviceId;
+		const owner = p.block.id;
+		return new OwnedFieldsTarget({
+			deviceId,
+			owner,
+			modeOf: (cap) => claimModeOf(target.features, cap),
+			fieldsOf: (cap) => claimFieldsOf(p.fields, cap),
+			api: this.deps.claims,
+			logger: this.deps.logger.child("owned"),
+			onClaim: (cap, event) => void this.onClaimEvent(deviceId, cap, owner, event)
+		});
+	}
+	/** C-1/N-1: the tracker follows the block's OWN claim as the hub answers it; every answer re-reads the native once. */
+	async onClaimEvent(deviceId, cap, owner, event) {
+		try {
+			this.dispatch(await this.deps.tracker.claimEvent(deviceId, cap, owner, event));
+		} catch (err) {
+			this.deps.logger.warn("composer: following a claim transition failed", {
+				tags: { deviceId },
+				meta: {
+					cap,
+					owner,
+					event,
+					error: errMsg(err)
+				}
+			});
+		}
+	}
+	heldFieldsFor(p, previous) {
+		if (p.target.kind !== "existing" || p.problems.length === 0 || previous === void 0) return [];
+		if (previous.runtime === null) return previous.heldFields;
+		return heldFieldsOf(previous.runtime.state().fields, `the composition no longer plans — the field keeps its last value on the device: ${p.problems.join("; ")}`);
+	}
+	newRuntime(p, target) {
+		const self = p.target.kind === "existing" ? selfReadCaps(p.fields, p.target.ref, p.target.features) : null;
+		const targetKey = p.target.kind === "existing" ? compositionSourceKey(p.target.ref) : null;
+		const nativeCaps = new Set(self?.native ?? []);
 		return new CompositionRuntime({
 			blockId: p.block.id,
 			fields: p.fields,
-			target: device,
-			read: (read) => this.deps.tracker.read(read),
+			target,
+			lookupCap: this.deps.lookupCap,
+			read: (read) => this.deps.tracker.read(read, compositionSourceKey(read.source) === targetKey && nativeCaps.has(read.cap) ? "native" : "effective"),
 			now: this.deps.now,
 			timer: this.deps.newTimer(),
 			logger: this.deps.logger.child("runtime")
@@ -963,16 +2485,35 @@ var Composer = class {
 		}
 	}
 	async syncSources(rebuilt) {
-		const requests = [...this.live.values()].filter((e) => e.runtime !== null && e.planned.block.enabled).flatMap((e) => e.planned.fields.flatMap((f) => f.reads.map((r) => ({
-			ref: r.source,
-			caps: [r.cap]
-		}))));
+		const requests = [];
+		for (const e of this.live.values()) {
+			const target = e.planned.target;
+			const running = e.runtime !== null && e.planned.block.enabled;
+			let targetKey = null;
+			if (target.kind === "existing") {
+				targetKey = compositionSourceKey(target.ref);
+				const self = running ? selfReadCaps(e.planned.fields, target.ref, target.features) : null;
+				requests.push({
+					ref: target.ref,
+					caps: self?.effective ?? [],
+					nativeCaps: self?.native ?? [],
+					nativeOwner: e.planned.block.id
+				});
+			}
+			if (!running) continue;
+			for (const f of e.planned.fields) for (const r of f.reads) if (compositionSourceKey(r.source) !== targetKey) requests.push({
+				ref: r.source,
+				caps: [r.cap]
+			});
+		}
 		const changed = await this.syncTracker(requests, rebuilt.reset);
 		for (const entry of this.live.values()) {
 			const runtime = entry.runtime;
 			if (runtime === null) continue;
+			const fresh = this.unsynced.has(runtime);
+			this.unsynced = new Set([...this.unsynced].filter((r) => r !== runtime));
 			if (!entry.planned.block.enabled) runtime.disable("the block is disabled");
-			else if (rebuilt.fresh.has(runtime)) runtime.start();
+			else if (fresh) runtime.start();
 			else runtime.onSourcesChanged(changed);
 		}
 	}
@@ -988,53 +2529,105 @@ var Composer = class {
 			return /* @__PURE__ */ new Set();
 		}
 	}
+	/**
+	* Rule 3: the claims every live customization WANTS this apply; everything
+	* else the gate knows is a release candidate, handed back once two applies
+	* agree. A block that cannot plan — waiting, unreadable, failed, or with its
+	* target gone — HOLDS its claims (rule 4, rule 5): they are wanted as they
+	* are. A disabled block wants none (rule 7).
+	*/
+	async reconcileClaims() {
+		if (!this.claimSeed.done) return;
+		const wanted = [];
+		const held = [];
+		for (const [blockId, entry] of this.live) {
+			const target = entry.planned.target;
+			if (target.kind === "new") continue;
+			if (target.kind === "unreadable" || entry.planned.problems.length > 0 || target.waiting !== null || target.gone !== null || target.deviceId === null) {
+				held.push(blockId);
+				continue;
+			}
+			if (!entry.planned.block.enabled) continue;
+			const deviceId = target.deviceId;
+			for (const f of target.features) wanted.push({
+				deviceId,
+				capName: f.cap,
+				owner: blockId
+			});
+		}
+		for (const owner of held) wanted.push(...this.claimGate.claimsOf(owner));
+		for (const key of this.claimGate.filter(wanted)) await this.release(key);
+	}
+	async release(key) {
+		let outcome;
+		try {
+			outcome = await this.deps.claims.releaseClaim(key);
+		} catch (err) {
+			this.claimGate.releaseFailed(key, errMsg(err));
+			return;
+		}
+		if (!outcome.ok && !RELEASE_SETTLED_CODES.has(outcome.code)) {
+			this.claimGate.releaseFailed(key, `${outcome.code}: ${outcome.message}`);
+			return;
+		}
+		this.claimGate.released(key, outcome.ok ? "released" : outcome.code);
+		await this.grafts.released(key.deviceId, key.capName);
+		await this.onClaimEvent(key.deviceId, key.capName, key.owner, "free");
+	}
+	/**
+	* Rule 5: a customization whose target row is gone — the tracker's two
+	* agreeing reads — fails naming it, stops writing, and ungrafts every cap it
+	* added on that id (Task 10's seam). Its claims are left as they are: the row
+	* and its `$owned` died with the device. No auto-repair: an operator edit or
+	* restart re-resolves the target.
+	*/
+	failGoneTargets(deviceId) {
+		const next = new Map(this.live);
+		for (const [blockId, entry] of this.live) {
+			const target = entry.planned.target;
+			if (target.kind !== "existing" || target.deviceId !== deviceId || target.gone !== null) continue;
+			const resolution = this.deps.tracker.resolution(target.ref);
+			if (resolution.kind !== "missing") continue;
+			entry.runtime?.stop();
+			this.unsynced = new Set([...this.unsynced].filter((r) => r !== entry.runtime));
+			this.ungraftGone(blockId, target, deviceId);
+			next.set(blockId, {
+				...entry,
+				runtime: null,
+				planned: {
+					...entry.planned,
+					target: {
+						...target,
+						gone: `${resolution.reason} — two index reads agreed`
+					}
+				}
+			});
+		}
+		this.live = next;
+	}
 	dispatch(changed) {
 		if (changed.size === 0) return;
-		for (const entry of this.live.values()) if (entry.planned.block.enabled) entry.runtime?.onSourcesChanged(changed);
+		for (const entry of this.live.values()) {
+			const runtime = entry.runtime;
+			if (runtime === null || !entry.planned.block.enabled) continue;
+			if (!this.unsynced.has(runtime)) runtime.onSourcesChanged(changed);
+		}
+	}
+	deviceIdOf(entry) {
+		if (entry.device !== null) return entry.device.id;
+		return entry.planned.target.kind === "existing" ? entry.planned.target.deviceId : null;
 	}
 	tagsOf(blockId) {
-		const deviceId = this.devices.get(composedDeviceStableId(blockId))?.id ?? null;
+		const entry = this.live.get(blockId);
+		const deviceId = this.composed.idOf(composedDeviceStableId(blockId)) ?? (entry === void 0 ? null : this.deviceIdOf(entry));
 		return deviceId === null ? {} : { deviceId };
 	}
 	verdict(blockId) {
 		const entry = this.live.get(blockId);
-		if (entry === void 0) return {
-			blockId,
-			status: "starting",
-			reason: "not applied yet"
-		};
-		if (entry.rebuildError !== null) return {
-			blockId,
-			status: "failed",
-			reason: `rebuilding the composed device for its new shape failed: ${entry.rebuildError}`
-		};
-		if (entry.planned.problems.length > 0) {
-			const kept = entry.planned.declaration === null ? "" : " — its device is kept offline with no capabilities";
-			return {
-				blockId,
-				status: "failed",
-				reason: `the composition does not validate: ${entry.planned.problems.join("; ")}${kept}`
-			};
-		}
-		if (!entry.planned.block.enabled) return {
-			blockId,
-			status: "stopped"
-		};
-		if (entry.device === null) return {
-			blockId,
-			status: "starting",
-			reason: "the composed device has not been constructed yet"
-		};
-		const failure = entry.runtime?.state().failure ?? null;
-		if (failure !== null) return {
-			blockId,
-			status: "failed",
-			reason: failure
-		};
-		return {
-			blockId,
-			status: "running"
-		};
+		const runtime = entry?.runtime ?? null;
+		const target = entry?.planned.target;
+		const grafts = target?.kind === "existing" && target.deviceId !== null ? this.grafts.verdict(target.deviceId, target.features) : null;
+		return verdictOf(blockId, entry, runtime !== null && this.unsynced.has(runtime), grafts);
 	}
 };
 //#endregion
@@ -1075,6 +2668,262 @@ var NodeDeadlineTimer = class {
 	}
 };
 //#endregion
+//#region src/builtins/composer/graft-host.ts
+/**
+* Grafts (D663): a method-serving native provider for a cap a customization
+* ADDS to a device the composer does not own — a battery on an HA pet feeder
+* that registers none. Without it the added cap has claimed values on the hub
+* but nothing answers its methods, so `getBindings` never lists it and a caller
+* of `battery.wakeForStream` finds no provider.
+*
+* - The provider is built ONLY from the cap's `composedMethods` (Task 1): an
+*   `answer` resolves to its value, a `refuse` rejects naming its reason. A cap
+*   with a served method that has no composed answer is refused here as it is
+*   at plan time (`has-commands`, slice 1). `getStatus` reads the MERGED slice
+*   (`readMerged`): the hub overlays it anyway (Task 7), but a direct call to
+*   this runner must never answer `{}`.
+* - The context is `createContext(stableId, id)` on a FOREIGN device id: the
+*   second use of the forked-runner native path D659 lists as unverified live
+*   (D659 live item 1). Task 16 step 4.1 is its live proof.
+* - `ungraft` removes only what THIS host registered, through the context's
+*   optional `unregisterNativeCap`. An older kernel without it leaves the graft
+*   routable until the composer respawns — warned once per device, never
+*   silent.
+*/
+/** The served methods of `def` that have no composed answer — non-empty means the cap cannot be grafted. */
+function unanswered(def) {
+	return Object.entries(def.methods).filter(([name, m]) => m.systemOnly !== true && def.composedMethods?.[name] === void 0).map(([name]) => name);
+}
+function composedMethod(answer) {
+	if (answer.kind === "answer") return async () => answer.value;
+	return async () => {
+		throw new Error(answer.reason);
+	};
+}
+var GraftHost = class {
+	ports;
+	lookupCap;
+	readMerged;
+	/** One context per foreign device: `registerNativeCap` is per context, and so is its unregister. */
+	contexts = /* @__PURE__ */ new Map();
+	caps = /* @__PURE__ */ new Map();
+	/** Devices already warned that this kernel cannot unregister a graft. */
+	warnedNoUnregister = /* @__PURE__ */ new Set();
+	constructor(ports, lookupCap, readMerged) {
+		this.ports = ports;
+		this.lookupCap = lookupCap;
+		this.readMerged = readMerged;
+	}
+	graft(deviceId, stableId, capName) {
+		if (this.grafted(deviceId).has(capName)) return { kind: "already" };
+		const def = this.lookupCap(capName);
+		if (def === null) return this.refuse(deviceId, capName, `unknown capability \`${capName}\``);
+		const missing = unanswered(def);
+		if (missing.length > 0) return this.refuse(deviceId, capName, `\`${capName}\` has ${missing.map((m) => `\`${m}\``).join(", ")} with no composed answer — a graft cannot serve it until commands arrive (slice 3)`);
+		const ctx = this.contextFor(deviceId, stableId);
+		try {
+			ctx.registerNativeCap(def, this.providerFor(deviceId, def));
+		} catch (err) {
+			return this.refuse(deviceId, capName, `registerNativeCap threw — ${errMsg(err)}`);
+		}
+		this.caps = new Map([...this.caps, [deviceId, new Set([...this.grafted(deviceId), capName])]]);
+		this.ports.logger.info("graft: an added cap is served on a device the composer does not own", {
+			tags: { deviceId },
+			meta: {
+				cap: capName,
+				stableId
+			}
+		});
+		return { kind: "grafted" };
+	}
+	ungraft(deviceId, capName, reason) {
+		if (!this.grafted(deviceId).has(capName)) return;
+		const ctx = this.contexts.get(deviceId);
+		if (ctx === void 0) return;
+		const outcome = this.unregister(ctx, deviceId, capName, reason);
+		if (outcome === "threw") return;
+		const remaining = new Set([...this.grafted(deviceId)].filter((c) => c !== capName));
+		this.caps = new Map([...this.caps, [deviceId, remaining]]);
+		if (outcome === "unregistered") this.ports.logger.info("graft removed", {
+			tags: { deviceId },
+			meta: {
+				cap: capName,
+				reason
+			}
+		});
+	}
+	/**
+	* I-3: a binding a PREVIOUS composer process left on `deviceId` — this one
+	* never registered it. The kernel retracts it under the composer's addon id;
+	* the hub drops only an entry the composer registered (rule 4). The caller has
+	* read that the binding is the composer's.
+	*/
+	retractStale(deviceId, capName, reason) {
+		if (this.grafted(deviceId).has(capName)) {
+			this.ungraft(deviceId, capName, reason);
+			return;
+		}
+		const ctx = this.contextFor(deviceId, `graft-retract:${deviceId}`);
+		if (this.unregister(ctx, deviceId, capName, reason) === "unregistered") this.ports.logger.info("graft left by a previous composer process retracted", {
+			tags: { deviceId },
+			meta: {
+				cap: capName,
+				reason
+			}
+		});
+	}
+	grafted(deviceId) {
+		return this.caps.get(deviceId) ?? /* @__PURE__ */ new Set();
+	}
+	/** A throw keeps the graft known, so a later plan retries (M-2); an older kernel forgets it (warned once). */
+	unregister(ctx, deviceId, capName, reason) {
+		if (ctx.unregisterNativeCap === void 0) {
+			if (!this.warnedNoUnregister.has(deviceId)) {
+				this.warnedNoUnregister = new Set([...this.warnedNoUnregister, deviceId]);
+				this.ports.logger.warn("graft: this kernel cannot unregister a native — the graft stays routable until the composer respawns", {
+					tags: { deviceId },
+					meta: {
+						cap: capName,
+						reason
+					}
+				});
+			}
+			return "unsupported";
+		}
+		try {
+			ctx.unregisterNativeCap(capName);
+			return "unregistered";
+		} catch (err) {
+			this.ports.logger.error("graft: unregistering the added cap threw — it stays routable and is retried by the next plan", {
+				tags: { deviceId },
+				meta: {
+					cap: capName,
+					reason,
+					error: errMsg(err)
+				}
+			});
+			return "threw";
+		}
+	}
+	contextFor(deviceId, stableId) {
+		const existing = this.contexts.get(deviceId);
+		if (existing !== void 0) return existing;
+		const ctx = this.ports.createContext(stableId, deviceId);
+		this.contexts = new Map([...this.contexts, [deviceId, ctx]]);
+		return ctx;
+	}
+	providerFor(deviceId, def) {
+		const answers = Object.entries(def.composedMethods ?? {}).map(([name, answer]) => [name, composedMethod(answer)]);
+		const withStatus = def.status === void 0 && def.runtimeState === void 0 ? [] : [["getStatus", async () => this.readMerged(deviceId, def.name)]];
+		return Object.fromEntries([...answers, ...withStatus]);
+	}
+	refuse(deviceId, capName, reason) {
+		this.ports.logger.error("graft refused — the added cap has no method-serving native", {
+			tags: { deviceId },
+			meta: {
+				cap: capName,
+				reason
+			}
+		});
+		return {
+			kind: "refused",
+			reason
+		};
+	}
+};
+//#endregion
+//#region src/builtins/composer/held-claims.ts
+function slot(deviceId, cap, owner) {
+	return `${owner}@${deviceId}#${cap}`;
+}
+function without(set, key) {
+	return new Set([...set].filter((k) => k !== key));
+}
+var HeldClaims = class {
+	held = /* @__PURE__ */ new Set();
+	claiming = /* @__PURE__ */ new Set();
+	/** The `replace` claims the hub holds before this process wrote any (the boot seed). */
+	seed(claims) {
+		const replaced = claims.filter((c) => c.mode === "replace");
+		this.held = new Set([...this.held, ...replaced.map((c) => slot(c.deviceId, c.capName, c.owner))]);
+	}
+	apply(deviceId, cap, owner, event) {
+		const k = slot(deviceId, cap, owner);
+		if (event === "claiming") {
+			this.claiming = new Set([...this.claiming, k]);
+			return;
+		}
+		this.claiming = without(this.claiming, k);
+		if (event === "held") this.held = new Set([...this.held, k]);
+		else if (event === "free") this.held = without(this.held, k);
+	}
+	/** `device.state-changed` of `cap` is NOT the native for `owner`'s self-reads: its claim is held, or being asked for. */
+	shadowsNative(deviceId, cap, owner) {
+		const k = slot(deviceId, cap, owner);
+		return this.held.has(k) || this.claiming.has(k);
+	}
+};
+//#endregion
+//#region src/builtins/composer/source-readings.ts
+var DEVICE_STATUS_CAP = "device-status";
+var NATIVE_SUFFIX = "@native";
+var NO_CAPS = [];
+function entryKey(entry) {
+	return entry.view === "native" ? `${entry.cap}${NATIVE_SUFFIX}` : entry.cap;
+}
+function entryOf(key) {
+	return key.endsWith("@native") ? {
+		cap: key.slice(0, -7),
+		view: "native"
+	} : {
+		cap: key,
+		view: "effective"
+	};
+}
+function entriesOf(request) {
+	return [...request.caps.map((cap) => ({
+		cap,
+		view: "effective"
+	})), ...(request.nativeCaps ?? NO_CAPS).map((cap) => ({
+		cap,
+		view: "native"
+	}))];
+}
+function valueAtPath(slice, path) {
+	return path.split(".").reduce((node, segment) => isRecord$1(node) ? node[segment] : void 0, slice);
+}
+function onlineOf(slice) {
+	const online = slice["online"];
+	return typeof online === "boolean" ? online : null;
+}
+function findRow(read, stableId) {
+	if (read.kind === "unreadable") return {
+		kind: "unknown",
+		error: read.error
+	};
+	const row = read.rows.find((r) => r.stableId === stableId);
+	return row === void 0 ? { kind: "absent" } : {
+		kind: "found",
+		deviceId: row.id,
+		type: row.type
+	};
+}
+function resolutionOf(source) {
+	if (source.missingReason !== null) return {
+		kind: "missing",
+		reason: source.missingReason
+	};
+	if (source.deviceId !== null && source.type !== null) return {
+		kind: "found",
+		deviceId: source.deviceId,
+		type: source.type
+	};
+	return {
+		kind: "unknown",
+		error: source.indexError ?? "the device index has not been read for it yet"
+	};
+}
+//#endregion
 //#region src/builtins/composer/source-tracker.ts
 /**
 * What a composition's sources currently say, per source device and per cap
@@ -1116,29 +2965,35 @@ var NodeDeadlineTimer = class {
 * It is served to nobody else — no cap method, no getter for another addon
 * reads this map; the composed device's slice is the only output. A consumer
 * that wants a source's value asks the addon that owns that source.
+*
+* Slice 2 (D663): a cap is read in one of two VIEWS. The `effective` view is
+* what every consumer sees. The `native` view is what the provider wrote — the
+* shadow under a `replace` claim — and it is how a composition reads its OWN
+* target's fields without seeing its own output (rule 6, no self-cycle). The hub
+* emits the shadow (`device.native-shadow-changed`, owner-only) only for a cap
+* under a claim, and for an unclaimed cap `device.state-changed` IS the native;
+* so a native-view cap under the block's OWN claim ignores `device.state-changed`,
+* and one it does not takes it. What is held is what LANDED (`claimEvent`, the
+* boot seed), never what a plan wants (C-1); while the block's claim RPC is in
+* flight, `device.state-changed` is neither (N-1). Every claim or release reply
+* re-reads the native once — the read that closes the window between the RPC
+* and its answer (N-4). The target ROW is resolved through the same path as a
+* source (`resolve`): one list read, two agreeing absent reads to call it
+* missing, sticky until an operator reset.
+*
+* An unavailability is CONFIRMED only when it is an answer (D49, fix round 2):
+* a GONE row (two reads agreed), a cap the provider unregistered that a
+* bindings re-read agrees is unbound, a field the source reported without. A
+* failed read (`unread`, retried by the next `sync` — the converge is the
+* retry), a first read that finds the cap unbound, an empty read, a source not
+* tracked yet: unconfirmed. Only a confirmed one lets a `release`-mode field
+* hand its claim back; an unconfirmed one holds it on its last value.
 */
-var DEVICE_STATUS_CAP = "device-status";
-function valueAtPath(slice, path) {
-	return path.split(".").reduce((node, segment) => isRecord(node) ? node[segment] : void 0, slice);
-}
-function onlineOf(slice) {
-	const online = slice["online"];
-	return typeof online === "boolean" ? online : null;
-}
-function findRow(read, stableId) {
-	if (read.kind === "unreadable") return {
-		kind: "unknown",
-		error: read.error
-	};
-	const row = read.rows.find((r) => r.stableId === stableId);
-	return row === void 0 ? { kind: "absent" } : {
-		kind: "found",
-		deviceId: row.id
-	};
-}
 var SourceTracker = class {
 	ports;
 	sources = /* @__PURE__ */ new Map();
+	/** The claims the hub holds — what LANDED, never what a plan wants (C-1). */
+	held = new HeldClaims();
 	/** The one chain every entry point joins (R3); the pattern is `BlockSupervisor.inFlight`. */
 	chain = Promise.resolve();
 	constructor(ports) {
@@ -1152,9 +3007,67 @@ var SourceTracker = class {
 	sync(requests, reset) {
 		return this.serialized(() => this.syncNow(requests, reset));
 	}
+	/**
+	* Resolve a ref against the device index through the same path as a source
+	* (D663 rule 1): one list read; two agreeing absent reads make it `missing`,
+	* sticky until `reset` (an operator edit or restart). A source already
+	* resolved is answered from memory; one whose index read FAILED is read
+	* again. The bare source stays tracked, so a later `sync` that names it keeps
+	* its resolution and reads only the caps it asks for.
+	*/
+	resolve(ref, reset) {
+		return this.serialized(async () => {
+			const k = compositionSourceKey(ref);
+			const prior = this.sources.get(k);
+			const before = reset ? void 0 : prior;
+			if (before !== void 0 && (before.deviceId !== null || before.missingReason !== null)) return resolutionOf(before);
+			const after = await this.hydrate({
+				ref,
+				caps: []
+			}, before, /* @__PURE__ */ new Map());
+			const kept = prior !== void 0 && after.deviceId !== null && prior.deviceId === after.deviceId ? {
+				...after,
+				caps: prior.caps,
+				online: prior.online
+			} : after;
+			this.sources = new Map([...this.sources, [k, kept]]);
+			return resolutionOf(kept);
+		});
+	}
+	/** The claims the hub held at boot (the claims index seed). Nothing is read: no native self-read is tracked before it. */
+	seedClaims(claims) {
+		this.held.seed(claims);
+	}
+	/**
+	* A claim RPC of `owner` on `(deviceId, cap)`: dispatched (`claiming`), or
+	* answered — the hub holds it (`held`), holds none of it (`free`), or said
+	* nothing that changes it (`unsettled`). Every ANSWER re-reads the owner's
+	* native-view readings of that cap ONCE: while the RPC was in flight (or a
+	* release was being applied) the provider's writes arrived as a
+	* `device.state-changed` the tracker could not take as the native.
+	*/
+	claimEvent(deviceId, cap, owner, event) {
+		return this.serialized(async () => {
+			this.held.apply(deviceId, cap, owner, event);
+			if (event === "claiming") return /* @__PURE__ */ new Set();
+			return this.rereadNative(deviceId, cap, owner);
+		});
+	}
+	/** The last settled resolution of a ref; `unknown` when it was never resolved. Synchronous, from memory. */
+	resolution(ref) {
+		const source = this.sources.get(compositionSourceKey(ref));
+		return source === void 0 ? {
+			kind: "unknown",
+			error: `source \`${compositionSourceKey(ref)}\` is not tracked`
+		} : resolutionOf(source);
+	}
 	onStateChanged(deviceId, capName, slice) {
 		return this.serialized(async () => this.applyStateChanged(deviceId, capName, slice));
 	}
+	/** `device.native-shadow-changed`: the provider's own slice of a cap under a claim (owner-only, D224). */
+	onNativeChanged(deviceId, capName, native) {
+		return this.serialized(async () => this.applyNativeChanged(deviceId, capName, native));
+	}
 	onDeviceUnregistered(deviceId) {
 		return this.serialized(() => this.confirmUnregistered(deviceId));
 	}
@@ -1174,7 +3087,9 @@ var SourceTracker = class {
 			const prior = merged.get(k);
 			merged.set(k, {
 				ref: request.ref,
-				caps: [...new Set([...prior?.caps ?? [], ...request.caps])]
+				caps: [...new Set([...prior?.caps ?? [], ...request.caps])],
+				nativeCaps: [...new Set([...prior?.nativeCaps ?? [], ...request.nativeCaps ?? NO_CAPS])],
+				...(request.nativeOwner ?? prior?.nativeOwner) === void 0 ? {} : { nativeOwner: request.nativeOwner ?? prior?.nativeOwner }
 			});
 		}
 		const lists = /* @__PURE__ */ new Map();
@@ -1184,12 +3099,15 @@ var SourceTracker = class {
 			const before = reset.has(k) ? void 0 : this.sources.get(k);
 			const after = await this.hydrate(request, before, lists);
 			next.set(k, after);
-			for (const cap of request.caps) if (before?.caps.get(cap) !== after.caps.get(cap) || before?.missingReason !== after.missingReason) changed.add(compositionSliceKey(request.ref, cap));
+			for (const entry of entriesOf(request)) {
+				const key = entryKey(entry);
+				if (before?.caps.get(key) !== after.caps.get(key) || before?.missingReason !== after.missingReason) changed.add(compositionSliceKey(request.ref, entry.cap));
+			}
 		}
 		this.sources = next;
 		return changed;
 	}
-	read(read) {
+	read(read, view = "effective") {
 		const label = `${compositionSourceKey(read.source)} ${read.cap}.${read.fieldPath}`;
 		const tracked = this.sources.get(compositionSourceKey(read.source));
 		if (tracked === void 0) return {
@@ -1202,22 +3120,30 @@ var SourceTracker = class {
 			reason: tracked.missingReason,
 			fatal: true
 		};
-		const cap = tracked.caps.get(read.cap);
+		const cap = tracked.caps.get(entryKey({
+			cap: read.cap,
+			view
+		}));
 		if (cap === void 0) return {
 			state: "unavailable",
 			reason: `${label}: not tracked yet`,
 			fatal: false
 		};
-		if (cap.kind === "none" || cap.kind === "unbound") return {
-			state: "unavailable",
-			reason: `${label}: ${cap.reason}`,
-			fatal: false
-		};
+		if (cap.kind !== "slice") {
+			const confirmed = cap.kind === "none" && cap.confirmed;
+			return {
+				state: "unavailable",
+				reason: `${label}: ${cap.reason}`,
+				fatal: false,
+				confirmed
+			};
+		}
 		const value = toExpressionValue(valueAtPath(cap.slice, read.fieldPath));
 		if (value === void 0) return {
 			state: "unavailable",
 			reason: `${label}: the field is absent or not a scalar`,
-			fatal: false
+			fatal: false,
+			confirmed: true
 		};
 		if (cap.staleReason !== null) return {
 			state: "stale",
@@ -1240,22 +3166,28 @@ var SourceTracker = class {
 		for (const [k, source] of this.sources) {
 			if (source.deviceId !== deviceId || source.missingReason !== null) continue;
 			let updated = source;
-			if (capName === DEVICE_STATUS_CAP) {
+			if (capName === "device-status") {
 				const online = onlineOf(slice);
 				if (online !== source.online) {
 					updated = {
 						...updated,
 						online
 					};
-					for (const cap of source.caps.keys()) changed.add(compositionSliceKey(source.ref, cap));
+					for (const key of source.caps.keys()) changed.add(compositionSliceKey(source.ref, entryOf(key).cap));
 				}
 			}
-			const current = source.caps.get(capName);
-			if (current !== void 0) {
+			const views = source.nativeOwner !== null && this.held.shadowsNative(deviceId, capName, source.nativeOwner) ? ["effective"] : ["effective", "native"];
+			for (const view of views) {
+				const key = entryKey({
+					cap: capName,
+					view
+				});
+				const current = source.caps.get(key);
+				if (current === void 0) continue;
 				if (current.kind === "unbound") this.logHealed(deviceId, capName, "device.state-changed");
 				updated = {
 					...updated,
-					caps: new Map([...updated.caps, [capName, {
+					caps: new Map([...updated.caps, [key, {
 						kind: "slice",
 						slice,
 						staleReason: null
@@ -1268,6 +3200,31 @@ var SourceTracker = class {
 		this.sources = next;
 		return changed;
 	}
+	applyNativeChanged(deviceId, capName, native) {
+		const changed = /* @__PURE__ */ new Set();
+		const next = new Map(this.sources);
+		const key = entryKey({
+			cap: capName,
+			view: "native"
+		});
+		for (const [k, source] of this.sources) {
+			if (source.deviceId !== deviceId || source.missingReason !== null) continue;
+			const current = source.caps.get(key);
+			if (current === void 0) continue;
+			if (current.kind === "unbound") this.logHealed(deviceId, capName, "device.native-shadow-changed");
+			next.set(k, {
+				...source,
+				caps: new Map([...source.caps, [key, {
+					kind: "slice",
+					slice: native,
+					staleReason: null
+				}]])
+			});
+			changed.add(compositionSliceKey(source.ref, capName));
+		}
+		this.sources = next;
+		return changed;
+	}
 	async confirmUnregistered(deviceId) {
 		const changed = /* @__PURE__ */ new Set();
 		for (const [k, source] of this.sources) {
@@ -1287,8 +3244,9 @@ var SourceTracker = class {
 			const next = resolution.kind === "missing" ? {
 				...source,
 				deviceId: null,
+				type: null,
 				missingReason: `source \`${k}\` (device ${deviceId}) was removed — two reads agreed`
-			} : await this.rereadUnderNewId(source, resolution.deviceId);
+			} : await this.rereadUnderNewId(source, resolution);
 			this.ports.logger.warn(resolution.kind === "missing" ? "composition source removed — its fields are unavailable until the operator acts" : "composition source re-registered under a new id — re-read under it", {
 				tags: { deviceId },
 				meta: {
@@ -1297,43 +3255,61 @@ var SourceTracker = class {
 				}
 			});
 			this.sources = new Map([...this.sources, [k, next]]);
-			for (const cap of source.caps.keys()) changed.add(compositionSliceKey(source.ref, cap));
+			for (const key of source.caps.keys()) changed.add(compositionSliceKey(source.ref, entryOf(key).cap));
 		}
 		return changed;
 	}
 	async applyBindingsChanged(deviceId, capName, reason) {
 		const changed = /* @__PURE__ */ new Set();
+		let confirm = null;
 		for (const [k, source] of this.sources) {
 			if (source.deviceId !== deviceId || source.missingReason !== null) continue;
-			const current = source.caps.get(capName);
+			const entries = [{
+				cap: capName,
+				view: "effective"
+			}, {
+				cap: capName,
+				view: "native"
+			}];
 			let updated = source;
-			if (reason === "native-unregistered") {
-				if (current?.kind === "slice") {
-					const reading = {
+			let healed = false;
+			for (const entry of entries) {
+				const key = entryKey(entry);
+				const current = source.caps.get(key);
+				if (current === void 0) continue;
+				if (reason === "native-unregistered") {
+					confirm ??= (await this.readBindings(deviceId, [capName])).get(capName) ?? "unknown";
+					const reading = confirm === "bound" ? await this.readCap(deviceId, entry, "bound", current) : {
 						kind: "none",
-						reason: `the provider unregistered \`${capName}\` — no value until it registers again`
+						reason: confirm === "unbound" ? `the provider unregistered \`${capName}\` — a bindings re-read agreed; no value until it registers again` : `the provider unregistered \`${capName}\` — not confirmed (the bindings re-read failed); no value, nothing released`,
+						confirmed: confirm === "unbound"
 					};
 					updated = {
 						...updated,
-						caps: new Map([...updated.caps, [capName, reading]])
+						caps: new Map([...updated.caps, [key, reading]])
 					};
+					continue;
 				}
-			} else {
-				const reading = current !== void 0 ? await this.readCap(deviceId, capName, "bound", current) : null;
-				if (reading !== null) updated = {
+				const reading = await this.readCap(deviceId, entry, "bound", current);
+				updated = {
 					...updated,
-					caps: new Map([...updated.caps, [capName, reading]])
+					caps: new Map([...updated.caps, [key, reading]])
 				};
-				if (current?.kind === "unbound" && reading !== null && reading.kind !== "unbound") this.logHealed(deviceId, capName, reason);
-				if (capName === DEVICE_STATUS_CAP) {
-					const online = reading === null ? await this.readOnline(deviceId) : reading.kind === "slice" ? onlineOf(reading.slice) : null;
-					if (online !== null && online !== source.online) {
-						updated = {
-							...updated,
-							online
-						};
-						for (const cap of source.caps.keys()) changed.add(compositionSliceKey(source.ref, cap));
-					}
+				if (current.kind === "unbound" && reading.kind !== "unbound") healed = true;
+			}
+			if (healed) this.logHealed(deviceId, capName, reason);
+			if (reason !== "native-unregistered" && capName === "device-status") {
+				const reading = updated.caps.get(entryKey({
+					cap: capName,
+					view: "effective"
+				}));
+				const online = reading === void 0 ? await this.readOnline(deviceId) : reading.kind === "slice" ? onlineOf(reading.slice) : null;
+				if (online !== null && online !== source.online) {
+					updated = {
+						...updated,
+						online
+					};
+					for (const key of source.caps.keys()) changed.add(compositionSliceKey(source.ref, entryOf(key).cap));
 				}
 			}
 			if (updated === source) continue;
@@ -1343,26 +3319,33 @@ var SourceTracker = class {
 		return changed;
 	}
 	/** A source found under a NEW id is a re-registration: read it there now (R7c). */
-	async rereadUnderNewId(source, deviceId) {
+	async rereadUnderNewId(source, found) {
 		const caps = /* @__PURE__ */ new Map();
-		for (const [cap, prior] of source.caps) caps.set(cap, await this.readCap(deviceId, cap, "bound", prior));
-		const online = await this.readOnline(deviceId) ?? source.online;
+		for (const [key, prior] of source.caps) caps.set(key, await this.readCap(found.deviceId, entryOf(key), "bound", prior));
+		const online = await this.readOnline(found.deviceId) ?? source.online;
 		return {
 			...source,
-			deviceId,
+			deviceId: found.deviceId,
+			type: found.type,
 			online,
 			caps
 		};
 	}
 	async hydrate(request, before, lists) {
+		const entries = entriesOf(request);
 		if (before !== void 0 && before.missingReason !== null) return before;
 		if (before !== void 0 && before.deviceId !== null) {
-			const added = request.caps.filter((cap) => !before.caps.has(cap));
-			if (added.length === 0 && request.caps.length === before.caps.size) return before;
-			const caps = await this.readCaps(before.deviceId, request.caps, before.caps, added);
+			const toRead = entries.filter((entry) => {
+				const held = before.caps.get(entryKey(entry));
+				return held === void 0 || held.kind === "unread";
+			});
+			const nativeOwner = request.nativeOwner ?? null;
+			if (toRead.length === 0 && entries.length === before.caps.size && nativeOwner === before.nativeOwner) return before;
+			const caps = await this.readCaps(before.deviceId, entries, before.caps, toRead);
 			return {
 				...before,
-				caps
+				caps,
+				nativeOwner
 			};
 		}
 		const k = compositionSourceKey(request.ref);
@@ -1374,9 +3357,12 @@ var SourceTracker = class {
 			return {
 				ref: request.ref,
 				deviceId: null,
+				type: null,
 				missingReason: `source \`${k}\` does not exist — two reads agreed`,
+				indexError: null,
 				online: null,
-				caps: /* @__PURE__ */ new Map()
+				caps: /* @__PURE__ */ new Map(),
+				nativeOwner: request.nativeOwner ?? null
 			};
 		}
 		if (resolution.kind === "unknown") {
@@ -1387,34 +3373,41 @@ var SourceTracker = class {
 			return {
 				ref: request.ref,
 				deviceId: null,
+				type: null,
 				missingReason: null,
+				indexError: resolution.error,
 				online: null,
-				caps: new Map(request.caps.map((cap) => [cap, {
-					kind: "none",
+				caps: new Map(entries.map((entry) => [entryKey(entry), {
+					kind: "unread",
 					reason: `the source could not be resolved: ${resolution.error}`
-				}]))
+				}])),
+				nativeOwner: request.nativeOwner ?? null
 			};
 		}
-		const deviceId = resolution.deviceId;
 		const known = before?.caps ?? /* @__PURE__ */ new Map();
-		const toRead = request.caps.filter((cap) => known.get(cap)?.kind !== "slice");
-		const caps = await this.readCaps(deviceId, request.caps, known, toRead);
-		const online = before?.online ?? await this.readOnline(deviceId);
+		const toRead = entries.filter((entry) => known.get(entryKey(entry))?.kind !== "slice");
+		const caps = await this.readCaps(resolution.deviceId, entries, known, toRead);
+		const online = before?.online ?? await this.readOnline(resolution.deviceId);
 		return {
 			ref: request.ref,
-			deviceId,
+			deviceId: resolution.deviceId,
+			type: resolution.type,
 			missingReason: null,
+			indexError: null,
 			online,
-			caps
+			caps,
+			nativeOwner: request.nativeOwner ?? null
 		};
 	}
-	/** Read `toRead` (bindings first, then slices); every other requested cap keeps what `known` holds. */
+	/** Read `toRead` (bindings first, then slices); every other requested entry keeps what `known` holds. */
 	async readCaps(deviceId, requested, known, toRead) {
-		const bound = toRead.length > 0 ? await this.readBindings(deviceId, toRead) : /* @__PURE__ */ new Map();
+		const bound = toRead.length > 0 ? await this.readBindings(deviceId, [...new Set(toRead.map((e) => e.cap))]) : /* @__PURE__ */ new Map();
+		const reading = new Set(toRead.map(entryKey));
 		const caps = /* @__PURE__ */ new Map();
-		for (const cap of requested) {
-			const prior = known.get(cap);
-			caps.set(cap, prior !== void 0 && !toRead.includes(cap) ? prior : await this.readCap(deviceId, cap, bound.get(cap) ?? "unknown", prior));
+		for (const entry of requested) {
+			const key = entryKey(entry);
+			const prior = known.get(key);
+			caps.set(key, prior !== void 0 && !reading.has(key) ? prior : await this.readCap(deviceId, entry, bound.get(entry.cap) ?? "unknown", prior));
 		}
 		return caps;
 	}
@@ -1429,7 +3422,10 @@ var SourceTracker = class {
 			});
 			return second;
 		}
-		return second.kind === "absent" ? { kind: "missing" } : second;
+		return second.kind === "absent" ? {
+			kind: "missing",
+			reason: `source \`${compositionSourceKey(ref)}\` does not exist`
+		} : second;
 	}
 	/**
 	* One bindings read. A second one would not confirm anything: back to back
@@ -1443,13 +3439,15 @@ var SourceTracker = class {
 			return [c, read.caps.has(c) ? "bound" : "unbound"];
 		}));
 	}
-	async readCap(deviceId, cap, binding, prior) {
+	async readCap(deviceId, entry, binding, prior) {
+		const { cap, view } = entry;
 		if (binding === "unbound") {
 			const reason = `capability \`${cap}\` is not bound on device ${deviceId} — waiting for \`native-registered\``;
 			if (prior?.kind !== "unbound") this.ports.logger.warn("composition source: a requested capability is not bound — the field is unavailable until it registers", {
 				tags: { deviceId },
 				meta: {
 					cap,
+					view,
 					reason
 				}
 			});
@@ -1458,34 +3456,67 @@ var SourceTracker = class {
 				reason
 			};
 		}
-		const read = await this.ports.readSlice(deviceId, cap);
+		const read = await this.ports.readSlice(deviceId, cap, view);
 		if (read.kind === "slice") return {
 			kind: "slice",
 			slice: read.slice,
 			staleReason: null
 		};
-		if (read.kind === "none") return prior?.kind === "slice" ? {
-			...prior,
-			staleReason: `a re-read found no \`${cap}\` report — the last value is kept`
-		} : {
-			kind: "none",
-			reason: `the source has not reported \`${cap}\` yet`
-		};
+		if (read.kind === "none") {
+			if (prior?.kind === "slice") return {
+				...prior,
+				staleReason: `a re-read found no \`${cap}\` report — the last value is kept`
+			};
+			return {
+				kind: "none",
+				reason: `the source has not reported \`${cap}\` yet`,
+				confirmed: false
+			};
+		}
 		this.ports.logger.warn("composition source: a slice read failed — the last value is kept", {
 			tags: { deviceId },
 			meta: {
 				cap,
+				view,
 				error: read.error
 			}
 		});
-		return prior?.kind === "slice" ? {
+		if (prior?.kind === "slice") return {
 			...prior,
 			staleReason: `re-read failed: ${read.error}`
-		} : {
-			kind: "none",
+		};
+		if (prior !== void 0 && prior.kind !== "unread") return prior;
+		return {
+			kind: "unread",
 			reason: `the slice could not be read: ${read.error}`
 		};
 	}
+	/** A claim or release of `owner` on `(deviceId, cap)` was answered: read the owner's native-view readings of it once, in place. */
+	async rereadNative(deviceId, cap, owner) {
+		const changed = /* @__PURE__ */ new Set();
+		const key = entryKey({
+			cap,
+			view: "native"
+		});
+		for (const [k, source] of this.sources) {
+			if (source.deviceId !== deviceId || source.missingReason !== null) continue;
+			if (source.nativeOwner !== owner) continue;
+			const current = source.caps.get(key);
+			if (current === void 0) continue;
+			const reading = await this.readCap(deviceId, {
+				cap,
+				view: "native"
+			}, "bound", current);
+			if (reading === current) continue;
+			const latest = this.sources.get(k) ?? source;
+			this.sources = new Map([...this.sources, [k, {
+				...latest,
+				caps: new Map([...latest.caps, [key, reading]])
+			}]]);
+			changed.add(compositionSliceKey(source.ref, cap));
+		}
+		return changed;
+	}
 	logHealed(deviceId, cap, via) {
 		this.ports.logger.info("composition source: an unbound capability is served again", {
 			tags: { deviceId },
@@ -1496,7 +3527,7 @@ var SourceTracker = class {
 		});
 	}
 	async readOnline(deviceId) {
-		const read = await this.ports.readSlice(deviceId, DEVICE_STATUS_CAP);
+		const read = await this.ports.readSlice(deviceId, DEVICE_STATUS_CAP, "effective");
 		if (read.kind === "unreadable") this.ports.logger.warn("composition source: `device-status` could not be read — online unknown", {
 			tags: { deviceId },
 			meta: { error: read.error }
@@ -1514,9 +3545,28 @@ var SourceTracker = class {
 * enforced by `scripts/check-runner-group-isolation.ts`). `CrashSupervisor`
 * bounds it like every forked runner (D6). Hub-only: declarations are cluster
 * state.
+*
+* Slice 2 (D663): a composition on an EXISTING device claims its fields on the
+* hub (`deviceState.claimFields` …) and reads its own replaced fields from the
+* native shadow (`getNativeCapSlice`, `device.native-shadow-changed`) — the one
+* subscriber that category has (`scripts/check-owner-only-events.ts`).
 */
 /** Ignored by `DeclaredDevices` whenever `integrationId` is supplied, which is always here. */
 var DECLARED_INTEGRATION_NAME_UNUSED = "Blocks";
+/** The owner-only shadow payload is not in the typed catalog: narrowed at the boundary, like `device.state-changed`. */
+function parseNativeShadowChanged(data) {
+	if (!isRecord$1(data)) return null;
+	const deviceId = data["deviceId"];
+	const capName = data["capName"];
+	const native = data["native"];
+	if (typeof deviceId !== "number" || typeof capName !== "string") return null;
+	if (!isRecord$1(native)) return null;
+	return {
+		deviceId,
+		capName,
+		native
+	};
+}
 var ComposerAddon = class extends BaseAddon {
 	composer = null;
 	constructor() {
@@ -1525,6 +3575,21 @@ var ComposerAddon = class extends BaseAddon {
 	async onInitialize() {
 		const api = this.ctx.api;
 		const logger = this.ctx.logger;
+		/** ONE `getBindings`: the tracker's binding check and the target description share it. */
+		const readBoundCaps = async (deviceId) => {
+			try {
+				const bindings = await api.deviceManager.getBindings.query({ deviceId });
+				return {
+					kind: "caps",
+					caps: new Map(bindings.entries.map((e) => [e.capName, e.nativeAddonId]))
+				};
+			} catch (err) {
+				return {
+					kind: "unreadable",
+					error: errMsg(err)
+				};
+			}
+		};
 		const tracker = new SourceTracker({
 			logger: logger.child("sources"),
 			listDevicesOf: async (addonId) => {
@@ -1536,7 +3601,8 @@ var ComposerAddon = class extends BaseAddon {
 							projection: "slim"
 						})).map((r) => ({
 							id: r.id,
-							stableId: r.stableId
+							stableId: r.stableId,
+							type: r.type
 						}))
 					};
 				} catch (err) {
@@ -1546,9 +3612,12 @@ var ComposerAddon = class extends BaseAddon {
 					};
 				}
 			},
-			readSlice: async (deviceId, capName) => {
+			readSlice: async (deviceId, capName, view) => {
 				try {
-					const slice = await api.deviceState.getCapSlice.query({
+					const slice = view === "native" ? await api.deviceState.getNativeCapSlice.query({
+						deviceId,
+						capName
+					}) : await api.deviceState.getCapSlice.query({
 						deviceId,
 						capName
 					});
@@ -1563,20 +3632,7 @@ var ComposerAddon = class extends BaseAddon {
 					};
 				}
 			},
-			readBoundCaps: async (deviceId) => {
-				try {
-					const bindings = await api.deviceManager.getBindings.query({ deviceId });
-					return {
-						kind: "caps",
-						caps: new Set(bindings.entries.map((e) => e.capName))
-					};
-				} catch (err) {
-					return {
-						kind: "unreadable",
-						error: errMsg(err)
-					};
-				}
-			}
+			readBoundCaps
 		});
 		const listOwnDevices = async () => api.deviceManager.listAll.query({ addonId: COMPOSER_ADDON_ID });
 		const declared = new DeclaredDevices({
@@ -1596,10 +3652,18 @@ var ComposerAddon = class extends BaseAddon {
 			listOwnDevices
 		});
 		const devices = this.ctx.kernel.devices;
+		const lookupCap = buildCapabilityLookup(ALL_CAPABILITY_DEFINITIONS);
+		const grafts = new GraftHost({
+			createContext: (stableId, id) => devices.createContext(stableId, id),
+			logger: logger.child("graft")
+		}, lookupCap, async (deviceId, capName) => await api.deviceState.getCapSlice.query({
+			deviceId,
+			capName
+		}) ?? null);
 		this.composer = new Composer({
 			logger: logger.child("composer"),
 			tracker,
-			lookupCap: buildCapabilityLookup(ALL_CAPABILITY_DEFINITIONS),
+			lookupCap,
 			readPersisted: async () => (await listOwnDevices()).map((r) => ({
 				id: r.id,
 				stableId: r.stableId
@@ -1623,6 +3687,14 @@ var ComposerAddon = class extends BaseAddon {
 				decommission: (deviceId) => devices.decommission(deviceId),
 				applyDerivedSpec: (deviceId, derived) => devices.applyDerivedSpec(deviceId, derived)
 			},
+			claims: {
+				claimFields: (input) => api.deviceState.claimFields.mutate(input),
+				patchOwnedFields: (input) => api.deviceState.patchOwnedFields.mutate(input),
+				releaseClaim: (input) => api.deviceState.releaseClaim.mutate(input),
+				listClaims: (input) => api.deviceState.listClaims.query(input)
+			},
+			describeTarget: readBoundCaps,
+			grafts,
 			now: () => Date.now(),
 			newTimer: () => new NodeDeadlineTimer(() => Date.now())
 		});
@@ -1632,6 +3704,12 @@ var ComposerAddon = class extends BaseAddon {
 				this.logEventFailure("device.state-changed", data.deviceId, err);
 			});
 		});
+		this.subscribe({ category: EventCategory.DeviceNativeShadowChanged }, (event) => {
+			const data = parseNativeShadowChanged(event.data);
+			if (data !== null) this.composer?.onNativeChanged(data).catch((err) => {
+				this.logEventFailure(EventCategory.DeviceNativeShadowChanged, data.deviceId, err);
+			});
+		});
 		this.subscribe({ category: EventCategory.DeviceUnregistered }, (event) => {
 			this.composer?.onDeviceUnregistered(event.data.deviceId).catch((err) => {
 				this.logEventFailure("device.unregistered", event.data.deviceId, err);