@camstack/system 1.2.317 → 1.2.319

package/dist/builtins/composer/composer.addon.mjs

@@ -1,6 +1,6 @@
-import { An as cloneStatefulExpressionMemory, Bn as toExpressionValue, Fn as compositionSliceKey, Gn as BaseAddon, In as compositionSourceKey, K as buildCapabilityLookup, Ln as createStatefulExpressionMemory, Mn as composedDeviceStableId, Nn as compositionFeatureEnabled, Pn as compositionItemFieldPath, Un as DeviceType, Wn as errMsg, X as composerCapability, Xt as planComposition, Z as compositionFieldKey, c as COMPOSED_ITEM_FIXED_FIELDS, h as DeclaredDevices, hr as EventCategory, i as BaseDevice, jn as composedDeviceRef, t as ALL_CAPABILITY_DEFINITIONS, tr as createEvent, vt as evaluateCompositionField, wn as COMPOSER_ADDON_ID } from "../../dist-Dori4pf3.mjs";
+import { An as cloneStatefulExpressionMemory, Bn as toExpressionValue, Fn as compositionSliceKey, Gn as BaseAddon, In as compositionSourceKey, K as buildCapabilityLookup, Ln as createStatefulExpressionMemory, Mn as composedDeviceStableId, Nn as compositionFeatureEnabled, Pn as compositionItemFieldPath, Un as DeviceType, Wn as errMsg, X as composerCapability, Xt as planComposition, Z as compositionFieldKey, c as COMPOSED_ITEM_FIXED_FIELDS, h as DeclaredDevices, hr as EventCategory, i as BaseDevice, jn as composedDeviceRef, t as ALL_CAPABILITY_DEFINITIONS, tr as createEvent, vt as evaluateCompositionField, wn as COMPOSER_ADDON_ID } from "../../dist-CQ9vXSUh.mjs";
 import { n as parseDeviceStateChanged, t as isRecord$2 } from "../../device-state-changed-DoBbkyEI.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-DVClu006.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-Cg2MP-qf.mjs";
 import { z } from "zod";
 //#region src/builtins/composer/composed-device.ts
 /**
@@ -292,1781 +292,1788 @@ var ComposedDeviceSet = class {
 	}
 };
 //#endregion
-//#region src/builtins/composer/composition-declarations.ts
+//#region src/builtins/composer/composer-apply-waits.ts
+var INTEGRATION_WAIT = "waiting for the shared Blocks integration to reconcile";
+var STORE_NOT_LOADED = "the core_blocks store has not loaded — nothing is declared or withdrawn until it does (D49)";
+var ApplyWaits = class {
+	logger;
+	/** Consecutive applies refused because `core_blocks` had not loaded: warned once per run. */
+	storeWaitApplies = 0;
+	/** Consecutive applies refused because the Blocks integration had not reconciled: warned once per run. */
+	integrationWaitApplies = 0;
+	constructor(logger) {
+		this.logger = logger;
+	}
+	/** Whether this apply must act on nothing (and why), or may go on. */
+	check(input, liveCount) {
+		if (!input.storeLoaded) {
+			this.storeWaitApplies += 1;
+			if (this.storeWaitApplies === 1) this.logger.warn("composer: the block store has not loaded — no device is declared, withdrawn or renamed", { meta: {
+				blocks: input.blocks.length,
+				live: liveCount
+			} });
+			return {
+				kind: "wait",
+				reason: STORE_NOT_LOADED
+			};
+		}
+		if (this.storeWaitApplies > 0) {
+			this.logger.info("composer: the block store has loaded — applying again", { meta: { appliesRefused: this.storeWaitApplies } });
+			this.storeWaitApplies = 0;
+		}
+		if (input.integrationId === null) {
+			this.integrationWaitApplies += 1;
+			if (this.integrationWaitApplies === 1) this.logger.warn("composer: the shared Blocks integration has not reconciled — no composed device can be declared", { meta: { blocks: input.blocks.length } });
+			return {
+				kind: "wait",
+				reason: INTEGRATION_WAIT
+			};
+		}
+		if (this.integrationWaitApplies > 0) {
+			this.logger.info("composer: the shared Blocks integration has reconciled — applying again", { meta: { appliesRefused: this.integrationWaitApplies } });
+			this.integrationWaitApplies = 0;
+		}
+		return {
+			kind: "go",
+			integrationId: input.integrationId
+		};
+	}
+};
+/** Every block `starting`, naming the wait; nothing acted. */
+function waitingResult(blockIds, reason) {
+	return {
+		blocks: blockIds.map((blockId) => ({
+			blockId,
+			status: "starting",
+			reason
+		})),
+		acted: false
+	};
+}
+//#endregion
+//#region src/builtins/composer/existing-target.ts
 /**
-* Which composed devices exist (D659): one declaration per composition block,
-* owned by `composer` and hung off the shared Blocks integration.
+* What the composer needs to run a composition on an EXISTING device (D663)
+* besides the runtime and the claim-backed target: the target's description,
+* the claim shapes derived from the plan, and the block report's words.
 *
-* `DeclaredDevices` sweeps any row whose declaration is absent. A block missing
-* from ONE apply (a transient store read, a race) would delete the device, and
-* with it its id, exports and rules. The `WithdrawalGate` is D49 for that path:
-* a withdrawal needs a second consecutive apply to agree. The other half of the
-* rule — nothing is declared or withdrawn while the `core_blocks` store has not
-* loaded — is `Composer.apply`'s, which never reaches this gate then (R2).
+* - The target is DESCRIBED (bound caps → native addon, row type) with ONE
+*   `getBindings` per plan change, cached until `device.bindings-changed` for
+*   that device. A read that fails keeps the previous description; with none,
+*   the block waits and nothing is claimed (D49).
+* - A claim's field set is the PLAN's (S5): the top-level fields of the cap, an
+*   item leaf contributing its whole array. Its mode is the feature's.
+* - A self-read of the target (rule 6) is served from the NATIVE view unless it
+*   reads an ADDED cap — that is the composition's own output. Whether a native
+*   cap's `device.state-changed` is the native or the composition's own merge
+*   is NOT decided here from the plan: it follows whether the claim has landed
+*   (`HeldClaims`, C-1).
 */
-function declarationFor(input) {
-	return {
-		stableId: composedDeviceStableId(input.blockId),
-		name: input.name,
-		type: input.target.type,
-		DeviceClass: composedDeviceClass(input.target.type, input.caps),
-		...input.target.role === void 0 ? {} : { role: input.target.role }
-	};
+/**
+* Review M3: an ADDED `restored` cap seeded from NOTHING says so, once per
+* runtime build, on its device. After a restart its state comes from the
+* target's runtime-state row; a row that lost the slice (D677: 615's doorbell,
+* dropped at a hub boot) used to surface as "not seeded yet" and now seeds a
+* clean `{ null, 0 }` — a lifetime count silently reset unless this line
+* names it. A first composition of a device that never had the slice logs it
+* too: the line cannot tell the two apart, and says both.
+*/
+function reportSeedlessRestoredCaps(input) {
+	for (const cap of addedCapsOf(input.features)) {
+		if (input.lookupCap(cap)?.durability !== "restored") continue;
+		if ((input.seed.byCap.get(cap) ?? null) !== null) continue;
+		input.logger.info("composed restored capability seeded from nothing — the target had no slice for it (a first composition, or a lost runtime-state row)", {
+			tags: { deviceId: input.deviceId },
+			meta: {
+				blockId: input.blockId,
+				cap,
+				seededFrom: "none"
+			}
+		});
+	}
 }
-/** What forces a rebuild of the live device: type, role, cap set. Never the name. */
-function shapeOf(input) {
-	return JSON.stringify([
-		input.target.type,
-		input.target.role ?? null,
-		input.caps.map((c) => c.name).toSorted()
-	]);
+/**
+* Read every affected effective capability exactly once, before the composer
+* grafts or claims any of them. A null slice is a successful empty seed; a
+* rejection is deliberately left to the caller so ownership cannot begin.
+*/
+async function readExistingTargetSeeds(targetDeviceId, caps, read) {
+	const byCap = /* @__PURE__ */ new Map();
+	for (const cap of new Set(caps)) byCap.set(cap, await read(targetDeviceId, cap));
+	return { byCap };
 }
+/** The reason every ungraft of a gone target carries (Task 9 rule 5 / Task 10 rule 2). */
+var TARGET_GONE_UNGRAFT_REASON = "target device gone";
 /**
-* The declaration that holds a persisted composed row whose block has no plan
-* in this apply. `name` and `type` are used only if the row has to be CREATED,
-* which `DeclaredDevices` does not do for a row it finds: it adopts it, and the
-* row's own name and type stay canonical (`ComposedPlaceholderDevice`).
+* Rule 5, on either path that finds the target gone (`device.unregistered`, or
+* a later plan when that event was dropped): ungraft every cap the block ADDED
+* on that id, with the one ERROR that says so.
 */
-function placeholderDeclaration(stableId) {
-	return {
-		stableId,
-		name: stableId,
-		type: DeviceType.Generic,
-		DeviceClass: ComposedPlaceholderDevice
-	};
+function ungraftGoneTarget(input) {
+	const { grafts, deviceId } = input;
+	const added = addedCapsOf(input.features);
+	for (const cap of added) grafts?.ungraft(deviceId, cap, TARGET_GONE_UNGRAFT_REASON);
+	input.logger.error("customization target device is gone — the block failed and its grafts are removed; only the operator ends this (edit or restart the block)", {
+		tags: { deviceId },
+		meta: {
+			blockId: input.blockId,
+			target: compositionSourceKey(input.ref),
+			ungrafted: added,
+			graftHost: grafts !== void 0
+		}
+	});
 }
-var WITHDRAWAL_CONFIRMATIONS = 2;
-var WithdrawalGate = class {
+var TargetDescriptions = class {
 	logger;
-	deviceIdOf;
-	known = /* @__PURE__ */ new Map();
-	misses = /* @__PURE__ */ new Map();
-	persistedIds = /* @__PURE__ */ new Map();
-	constructor(logger, deviceIdOf) {
+	readBoundCaps;
+	cache = /* @__PURE__ */ new Map();
+	constructor(logger, readBoundCaps) {
 		this.logger = logger;
-		this.deviceIdOf = deviceIdOf;
+		this.readBoundCaps = readBoundCaps;
+	}
+	/** `device.bindings-changed` for this device: the next read is a real read. */
+	invalidate(deviceId) {
+		this.cache = new Map([...this.cache].filter(([, d]) => d.deviceId !== deviceId));
 	}
 	/**
-	* The rows that exist before this process applied anything. Called once at
-	* boot, before the first `filter`: without it the mirror starts empty and a
-	* row missing from the first apply after a restart (a release, a block that
-	* no longer plans) is swept at once — one apply, not two. A seeded row
-	* missing from that apply counts as its FIRST miss and is held by
-	* `placeholderDeclaration`. A row the gate already knows keeps its entry and
-	* its miss count.
+	* The description of `ref`, resolved to `deviceId`. Served from the cache
+	* unless `force` (the block's plan changed) or nothing is cached. A read that
+	* fails keeps the previous description of the SAME device id, and answers
+	* null when there is none: the caller waits, and claims nothing.
 	*/
-	seed(rows) {
-		const fresh = rows.filter((row) => !this.known.has(row.stableId));
-		this.known = new Map([...this.known, ...fresh.map((row) => [row.stableId, placeholderDeclaration(row.stableId)])]);
-		this.persistedIds = new Map([...this.persistedIds, ...rows.map((row) => [row.stableId, row.id])]);
-	}
-	filter(current) {
-		const present = new Map(current.map((d) => [d.stableId, d]));
-		const kept = [];
-		const misses = /* @__PURE__ */ new Map();
-		for (const [stableId, declaration] of this.known) {
-			if (present.has(stableId)) continue;
-			const count = (this.misses.get(stableId) ?? 0) + 1;
-			if (count < WITHDRAWAL_CONFIRMATIONS) {
-				this.logger.warn("a composition vanished from one apply — its device is kept until a second apply agrees", {
-					tags: this.tagsOf(stableId),
-					meta: {
-						stableId,
-						misses: count
-					}
-				});
-				kept.push(declaration);
-				misses.set(stableId, count);
-				continue;
-			}
-			this.logger.info("a composition is gone on two consecutive applies — its device is withdrawn", {
-				tags: this.tagsOf(stableId),
-				meta: { stableId }
+	async describe(ref, deviceId, type, force) {
+		const key = compositionSourceKey(ref);
+		const cached = this.cache.get(key);
+		const previous = cached !== void 0 && cached.deviceId === deviceId ? cached : null;
+		if (!force && previous !== null) return previous;
+		const read = await this.readBoundCaps(deviceId);
+		if (read.kind === "unreadable") {
+			this.logger.warn(previous === null ? "customization target: its bindings could not be read — nothing is claimed until they are; retried on the next apply" : "customization target: its bindings could not be read — the previous description is kept", {
+				tags: { deviceId },
+				meta: {
+					target: key,
+					error: read.error
+				}
 			});
+			return previous;
 		}
-		this.known = new Map([...kept.map((d) => [d.stableId, d]), ...present]);
-		this.misses = misses;
-		return [...current, ...kept];
-	}
-	/**
-	* The live device's id, else the persisted row's. A declaration whose device
-	* was never built and never persisted has no numeric id to carry: the
-	* stableId in `meta` is then all there is.
-	*/
-	tagsOf(stableId) {
-		const deviceId = this.deviceIdOf(stableId) ?? this.persistedIds.get(stableId) ?? null;
-		return deviceId === null ? {} : { deviceId };
+		const found = {
+			kind: "found",
+			deviceId,
+			type,
+			nativeCaps: read.caps
+		};
+		this.cache = new Map([...this.cache, [key, found]]);
+		return found;
 	}
 };
-//#endregion
-//#region src/builtins/composer/composer-plan.ts
-/**
-* What one apply PLANS for a block, before anything is declared, claimed or
-* run (D659, D663). Pure over its inputs: the composer hands in what it knows
-* (its rows, the previous plan, the tracker) and gets a `PlannedBlock` back.
-*
-* - A `new` target plans as in slice 1: a declaration, a shape, a placeholder
-*   when the composition stopped planning but its row exists.
-* - An `existing` target declares NOTHING (the row is not the composer's). It
-*   is resolved through the tracker's path, described with one bindings read
-*   per plan change, and planned against that description. A settled plan is
-*   kept until the OPERATOR acts (edit, restart): a bindings change alone never
-*   re-plans (Task 10 rule 2, D659). While the claims index is unseeded or the
-*   target is unresolved or undescribed, the block WAITS by name and claims
-*   nothing (D49). A target gone on two agreeing index reads is `gone`.
-* - An unreadable row names no target: whatever it holds is held (D49).
-*/
-/** The shape of a placeholder: no caps, so no plan to take a shape from. */
-var PLACEHOLDER_SHAPE = "placeholder";
-var NO_PLAN = {
-	fields: [],
-	events: [],
-	problems: [],
-	declaration: null,
-	shape: null,
-	spec: null
-};
-/**
-* A row that exists but does not parse is held exactly like a composition
-* that stopped planning: its device (if it has a row) stays as an offline
-* placeholder, its claims (if any) are kept, and the block fails naming the
-* parse error. Absent, it would be withdrawn on the second apply that omitted
-* it (D49).
-*/
-function planUnreadable(block, rows) {
-	const stableId = composedDeviceStableId(block.id);
-	const hasRow = rows.has(stableId);
-	return {
-		...NO_PLAN,
-		block: {
-			id: block.id,
-			name: block.name,
-			enabled: false,
-			updatedAt: 0
-		},
-		problems: [`the stored block does not parse — ${block.error}`],
-		declaration: hasRow ? placeholderDeclaration(stableId) : null,
-		shape: hasRow ? PLACEHOLDER_SHAPE : null,
-		target: { kind: "unreadable" }
-	};
+/** The PLANNED field set a claim carries for `cap` (S5): an item leaf claims its whole array. */
+function claimFieldsOf(fields, cap) {
+	return [...new Set(fields.filter((f) => f.cap === cap).map((f) => f.item === void 0 ? f.path : f.item.arrayPath))];
 }
-/** `target` is the block's own `new` target, narrowed by the caller: this path never sees an existing one (M-5). */
-function planNew(block, target, lookupCap, rows) {
-	const plan = planComposition(block.composition, lookupCap);
-	const planned = { kind: "new" };
-	if (plan.problems.length > 0) {
-		const stableId = composedDeviceStableId(block.id);
-		const hasRow = rows.has(stableId);
-		return {
-			...NO_PLAN,
-			block,
-			problems: plan.problems.map((p) => `${p.path}: ${p.message}`),
-			declaration: hasRow ? placeholderDeclaration(stableId) : null,
-			shape: hasRow ? PLACEHOLDER_SHAPE : null,
-			target: planned
-		};
-	}
-	const caps = block.composition.features.flatMap((f) => {
-		if (!compositionFeatureEnabled(f)) return [];
-		const def = lookupCap(f.cap);
-		return def === null ? [] : [def];
-	});
-	const declarationInput = {
-		blockId: block.id,
-		name: block.name,
-		target,
-		caps
-	};
-	return {
-		block,
-		fields: plan.fields,
-		events: plan.events,
-		problems: [],
-		declaration: declarationFor(declarationInput),
-		shape: shapeOf(declarationInput),
-		spec: {
-			type: target.type,
-			...target.role === void 0 ? {} : { role: target.role }
-		},
-		target: planned
-	};
+/** The claim mode of `cap`: `replace` for a cap the device serves natively, else `add`. */
+function claimModeOf(features, cap) {
+	return features.find((f) => f.cap === cap)?.mode === "replace" ? "replace" : "add";
 }
-async function planExisting(input) {
-	const { block, previous, operatorAction } = input;
-	const prior = previous?.target;
-	if (!operatorAction && previous !== void 0 && prior?.kind === "existing" && prior.waiting === null) return {
-		...previous,
-		block
-	};
-	const ref = input.target.device;
-	const key = compositionSourceKey(ref);
-	const knownId = prior?.kind === "existing" ? prior.deviceId : null;
-	if (input.claimsWait !== null) return waitingPlan(block, ref, knownId, input.claimsWait);
-	const resolution = await input.tracker.resolve(ref, operatorAction);
-	if (resolution.kind === "unknown") return waitingPlan(block, ref, knownId, `the target device \`${key}\` could not be resolved (${resolution.error}) — nothing is claimed until it is; retried on the next apply`);
-	const existing = {
-		kind: "existing",
-		ref,
-		deviceId: resolution.kind === "found" ? resolution.deviceId : knownId,
-		waiting: null,
-		gone: null,
-		features: [],
-		nativeCaps: /* @__PURE__ */ new Map()
-	};
-	if (resolution.kind === "missing") return {
-		...NO_PLAN,
-		block,
-		target: {
-			...existing,
-			gone: `${resolution.reason} — two index reads agreed`
-		}
-	};
-	const description = await input.targets.describe(ref, resolution.deviceId, resolution.type, operatorAction);
-	if (description === null) return waitingPlan(block, ref, resolution.deviceId, `the target device \`${key}\` could not be described (its bindings did not read) — nothing is claimed until it is; retried on the next apply`);
-	const plan = planComposition(block.composition, input.lookupCap, description);
-	return {
-		...NO_PLAN,
-		block,
-		fields: plan.problems.length > 0 ? [] : plan.fields,
-		events: plan.problems.length > 0 ? [] : plan.events,
-		problems: plan.problems.map((p) => `${p.path}: ${p.message}`),
-		target: {
-			...existing,
-			features: plan.features,
-			nativeCaps: description.nativeCaps
-		}
-	};
+/** The caps a customization ADDS to its target — the ones it grafts a native for (Task 10). */
+function addedCapsOf(features) {
+	return features.filter((f) => f.mode === "add").map((f) => f.cap);
 }
-function waitingPlan(block, ref, deviceId, waiting) {
+function selfReadCaps(fields, target, features) {
+	const targetKey = compositionSourceKey(target);
+	const read = new Set(fields.flatMap((f) => f.reads.filter((r) => compositionSourceKey(r.source) === targetKey).map((r) => r.cap)));
+	const added = new Set(addedCapsOf(features));
 	return {
-		...NO_PLAN,
-		block,
-		target: {
-			kind: "existing",
-			ref,
-			deviceId,
-			waiting,
-			gone: null,
-			features: [],
-			nativeCaps: /* @__PURE__ */ new Map()
-		}
+		effective: [...read].filter((cap) => added.has(cap)),
+		native: [...read].filter((cap) => !added.has(cap))
 	};
 }
-/**
-* Runtime preparation can still fail after a complete existing-target plan.
-* Preserve its fields and description for retry, but mark it waiting so claim
-* reconciliation cannot treat the unprepared candidate as live.
-*/
-function withExistingTargetWait(p, waiting) {
-	return p.target.kind === "existing" ? {
-		...p,
-		target: {
-			...p.target,
-			waiting
-		}
-	} : p;
+/** The `degraded` reason (rule 8): one entry per released field, the source's own reason after the dash. */
+function degradedReason(released) {
+	return released.map((r) => {
+		const path = r.item === void 0 ? r.path : compositionItemFieldPath(r.item.arrayPath, r.item.key, r.path);
+		return `released to the native provider: ${r.cap}.${path} — ${r.reason}`;
+	}).join("; ");
 }
-/** What `logPlanTransition` compares: problems, and for an existing target its wait or its loss. */
-function planSummary(p) {
-	const target = p.target;
-	return (target.kind === "existing" ? [
-		p.problems.join("; "),
-		target.waiting ?? "",
-		target.gone ?? ""
-	] : [p.problems.join("; ")]).filter((part) => part !== "").join(" | ");
+/** The `starting` reason of a block with HELD fields: each keeps its last value and claim until its source answers (D49). */
+function heldReason(held) {
+	return held.map((r) => {
+		const path = r.item === void 0 ? r.path : compositionItemFieldPath(r.item.arrayPath, r.item.key, r.path);
+		return `held on its last value until its source answers (D49): ${r.cap}.${path} — ${r.reason}`;
+	}).join("; ");
 }
 /**
-* Rule 5 on the PLAN path: `device.unregistered` is telemetry and may be
-* dropped (D8), so a target is often found gone by the operator's next edit or
-* restart. The previous live target is what must be ungrafted — exactly as on
-* the event path. Null when nothing was lost by THIS plan.
+* Rule 4: a customization whose row exists but whose plan failed keeps its
+* claims, so its owned fields stay at their last value on the hub. The report
+* says so — each field that had a value is `stale`, with the reason.
 */
-function lostTarget(p, previous) {
-	const now = p.target;
-	const before = previous?.target;
-	if (now.kind !== "existing" || now.gone === null || before?.kind !== "existing") return null;
-	if (before.deviceId === null || before.gone !== null) return null;
-	return {
-		target: before,
-		deviceId: before.deviceId
-	};
-}
-/** Two plans write the same place: both new, or the very same existing-target plan (reused until the operator acts). */
-function sameTarget(a, b) {
-	return a === b || a.kind === "new" && b.kind === "new";
-}
-/** One line when a block starts or stops planning (or waiting, or loses its target) — never one per apply. */
-function logPlanTransition(logger, previous, p, liveTags) {
-	if (previous !== void 0 && planSummary(previous) === planSummary(p)) return;
-	if (previous === void 0 && planSummary(p) === "") return;
-	const target = p.target;
-	const extras = {
-		tags: target.kind === "existing" && target.deviceId !== null ? { deviceId: target.deviceId } : liveTags,
-		meta: {
-			blockId: p.block.id,
-			problems: p.problems,
-			placeholder: p.declaration !== null
-		}
-	};
-	if (target.kind === "existing" && target.gone !== null) logger.error("customization target device is gone — the block failed; only the operator ends this (edit or restart the block)", {
-		...extras,
-		meta: {
-			...extras.meta,
-			target: compositionSourceKey(target.ref)
-		}
-	});
-	else if (target.kind === "existing" && target.waiting !== null) logger.warn("customization waits — nothing is claimed or released until it plans", {
-		...extras,
-		meta: {
-			...extras.meta,
-			reason: target.waiting
-		}
+function heldFieldsOf(fields, reason) {
+	return fields.map((f) => f.state === "unavailable" ? f : {
+		...f,
+		state: "stale",
+		reason
 	});
-	else if (p.problems.length === 0) logger.info("composition plans again", extras);
-	else logger.warn(p.declaration === null ? "composition does not plan — no device is declared for it" : "composition no longer plans — its device is kept offline with no capabilities", extras);
 }
 //#endregion
-//#region src/builtins/composer/field-record.ts
+//#region src/builtins/composer/composer-grafts.ts
 /**
-* One composed field's record and the pure judgements over it (D659, D663):
-* what it may write, whether it is released (a CONFIRMED unavailability of a
-* `release`-mode field, S1b) or HELD (no answer yet, D49), and how a report or a
-* log line names it. Split from `composition-runtime.ts`, which holds the
-* behaviour.
+* The composer's side of grafts (D663, Task 10): WHEN a cap a customization
+* ADDS is grafted, removed or refused — `GraftHost` is only the how. Split from
+* `composer.ts`.
+*
+* - Decided at PLAN time only (rule 2): every added cap is grafted; a grafted
+*   cap the plan now finds native is ungrafted (its event was dropped, D8).
+* - NATIVE ALWAYS WINS (I-2). A foreign `native-registered` on a grafted cap
+*   ungrafts it (the claim stays). One that lands while a plan is in flight —
+*   after the target's description was read, before the graft — is remembered
+*   per described device, so that plan never grafts over it. A foreign
+*   `native-unregistered` never re-grafts (D659).
+* - A cap no graft serves is NAMED for the block verdict (I-1): refused by the
+*   host, or taken by a native. Every added cap unserved → the block fails.
+* - A binding a PREVIOUS composer process left (a respawn, D5) is retracted
+*   when a settled plan does not want it (I-3), or when the gate releases the
+*   add claim of a block that is gone — after reading that the binding IS the
+*   composer's; a read that fails retracts nothing (D49).
 */
-var NO_FIELDS = /* @__PURE__ */ new Set();
-function fieldKey(plan) {
-	return compositionFieldKey(plan);
+/** A foreign native now serves the grafted cap: the claim stays (Task 10 rule 2). */
+var NATIVE_APPEARED_UNGRAFT_REASON = "a native provider appeared";
+/** The block's add claim was released by the D49 gate (deleted, disabled, feature removed): its graft goes with it. */
+var NO_LONGER_ADDED_UNGRAFT_REASON = "the block no longer adds this cap";
+/** A binding a previous composer process left, that nothing wants any more (I-3). */
+var STALE_GRAFT_RETRACT_REASON = "a graft left by a previous composer process that no plan wants";
+function withEntry(map, key, value) {
+	return new Map([...map, [key, value]]);
 }
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+function nativeTakenReason(addonId, when) {
+	return `a native provider (${addonId}) ${when} — the cap is not grafted and its claim is kept; edit or restart the block to replace the native instead`;
 }
-function valueAtPath$1(value, path) {
-	return path.split(".").reduce((node, segment) => isRecord$1(node) ? node[segment] : void 0, value);
+var ComposerGrafts = class {
+	ports;
+	logger;
+	readBindings;
+	/** Per device: the added caps no graft serves, and why. Reset by each plan of that device. */
+	unserved = /* @__PURE__ */ new Map();
+	/** Per DESCRIBED device: foreign natives registered since its description was read (cap → addonId). */
+	foreignSince = /* @__PURE__ */ new Map();
+	constructor(ports, logger, readBindings) {
+		this.ports = ports;
+		this.logger = logger;
+		this.readBindings = readBindings;
+	}
+	/** A description of `deviceId` is about to be read: it covers every registration before now. */
+	describing(deviceId) {
+		this.foreignSince = withEntry(this.foreignSince, deviceId, /* @__PURE__ */ new Map());
+	}
+	onBindingsChanged(data) {
+		if (data.addonId === "composer") return;
+		this.remember(data);
+		const ports = this.ports;
+		if (data.reason !== "native-registered" || ports === void 0) return;
+		if (!ports.grafted(data.deviceId).has(data.capName)) return;
+		this.logger.info("a native provider appeared on a grafted cap — the graft is removed; the claim stays", {
+			tags: { deviceId: data.deviceId },
+			meta: {
+				cap: data.capName,
+				addonId: data.addonId
+			}
+		});
+		ports.ungraft(data.deviceId, data.capName, NATIVE_APPEARED_UNGRAFT_REASON);
+		this.setUnserved(data.deviceId, data.capName, nativeTakenReason(data.addonId, "appeared"));
+	}
+	/** Rule 2, at plan time only: graft what the plan adds; ungraft what it finds native; retract what a previous process left. */
+	plan(input) {
+		const ports = this.ports;
+		if (ports === void 0) return;
+		const { deviceId } = input;
+		const added = input.enabled && input.settled ? addedCapsOf(input.features) : [];
+		const replaced = new Set(input.features.filter((f) => f.mode === "replace").map((f) => f.cap));
+		for (const cap of ports.grafted(deviceId)) {
+			if (!replaced.has(cap)) continue;
+			this.logger.info("a native provider serves a grafted cap — the graft is removed; the claim stays", {
+				tags: { deviceId },
+				meta: { cap }
+			});
+			ports.ungraft(deviceId, cap, NATIVE_APPEARED_UNGRAFT_REASON);
+		}
+		if (input.settled) this.retractUnwanted(input, new Set(added));
+		const foreign = this.foreignSince.get(deviceId) ?? /* @__PURE__ */ new Map();
+		const unserved = /* @__PURE__ */ new Map();
+		for (const cap of added) {
+			const other = foreign.get(cap);
+			if (other !== void 0) {
+				const reason = nativeTakenReason(other, "registered while the block was planning");
+				this.logger.warn("graft skipped — a native provider serves the cap (native always wins)", {
+					tags: { deviceId },
+					meta: {
+						cap,
+						addonId: other
+					}
+				});
+				unserved.set(cap, reason);
+				continue;
+			}
+			const outcome = ports.graft(deviceId, input.ref.stableId, cap);
+			if (outcome.kind === "refused") unserved.set(cap, `graft refused: ${outcome.reason}`);
+		}
+		this.unserved = withEntry(this.unserved, deviceId, unserved);
+	}
+	/** The gate released a claim: a graft of that cap goes with it; a previous process's binding is retracted once read as the composer's. */
+	async released(deviceId, capName) {
+		const ports = this.ports;
+		if (ports === void 0) return;
+		this.setUnserved(deviceId, capName, null);
+		if (ports.grafted(deviceId).has(capName)) {
+			ports.ungraft(deviceId, capName, NO_LONGER_ADDED_UNGRAFT_REASON);
+			return;
+		}
+		let read;
+		try {
+			read = await this.readBindings(deviceId);
+		} catch (err) {
+			read = {
+				kind: "unreadable",
+				error: errMsg(err)
+			};
+		}
+		if (read.kind === "unreadable") {
+			this.logger.warn("a released claim: the bindings could not be read — a graft left by a previous process, if any, is not retracted (D49)", {
+				tags: { deviceId },
+				meta: {
+					cap: capName,
+					error: read.error
+				}
+			});
+			return;
+		}
+		if (read.caps.get(capName) === "composer") ports.retractStale(deviceId, capName, STALE_GRAFT_RETRACT_REASON);
+	}
+	/** The target row is gone: nothing about it is reported any more. */
+	gone(deviceId) {
+		this.unserved = new Map([...this.unserved].filter(([id]) => id !== deviceId));
+	}
+	verdict(deviceId, features) {
+		const added = addedCapsOf(features);
+		const unserved = this.unserved.get(deviceId) ?? /* @__PURE__ */ new Map();
+		const named = added.flatMap((cap) => {
+			const reason = unserved.get(cap);
+			return reason === void 0 ? [] : [`${cap}: ${reason}`];
+		});
+		if (named.length === 0) return null;
+		return {
+			allUnserved: named.length === added.length && added.length === features.length,
+			reason: `added caps no graft serves — ${named.join("; ")}`
+		};
+	}
+	retractUnwanted(input, wanted) {
+		const ports = this.ports;
+		if (ports === void 0) return;
+		const own = ports.grafted(input.deviceId);
+		for (const [cap, addonId] of input.nativeCaps) {
+			if (addonId !== "composer" || own.has(cap) || wanted.has(cap)) continue;
+			this.logger.info("a graft left by a previous composer process is retracted", {
+				tags: { deviceId: input.deviceId },
+				meta: { cap }
+			});
+			ports.retractStale(input.deviceId, cap, STALE_GRAFT_RETRACT_REASON);
+		}
+	}
+	remember(data) {
+		const seen = this.foreignSince.get(data.deviceId);
+		if (seen === void 0) return;
+		if (data.reason === "native-registered") this.foreignSince = withEntry(this.foreignSince, data.deviceId, new Map([...seen, [data.capName, data.addonId]]));
+		else if (data.reason === "native-unregistered" && seen.get(data.capName) === data.addonId) this.foreignSince = withEntry(this.foreignSince, data.deviceId, new Map([...seen].filter(([cap]) => cap !== data.capName)));
+	}
+	setUnserved(deviceId, cap, reason) {
+		const current = this.unserved.get(deviceId) ?? /* @__PURE__ */ new Map();
+		const next = new Map([...current].filter(([c]) => c !== cap));
+		if (reason !== null) next.set(cap, reason);
+		this.unserved = withEntry(this.unserved, deviceId, next);
+	}
+};
+//#endregion
+//#region src/builtins/composer/composer-live-set.ts
+/**
+* Pure reads of the composer's live set: which sources it must track, which
+* sources an operator action re-opens, and which claims it still WANTS.
+* Nothing here touches a port; the composer acts on the answers.
+*/
+/** A release answered with one of these hands back nothing of ours: the gate forgets the claim. */
+var RELEASE_SETTLED_CODES = new Set([
+	"not-claimed",
+	"unknown-device",
+	"owned-by-other"
+]);
+/**
+* The source keys an operator action on `p` re-opens: every source its fields
+* read, except its own target (re-resolved by `planExisting` already, never
+* twice).
+*/
+function operatorResetKeys(p) {
+	const targetKey = p.target.kind === "existing" ? compositionSourceKey(p.target.ref) : null;
+	const keys = [];
+	for (const f of p.fields) for (const r of f.reads) {
+		const key = compositionSourceKey(r.source);
+		if (key !== targetKey) keys.push(key);
+	}
+	return keys;
 }
-function initialValue(plan, byCap, lookupCap) {
-	const slice = byCap?.get(plan.cap);
-	if (slice === void 0 || slice === null) return void 0;
-	const item = plan.item;
-	if (item === void 0) return valueAtPath$1(slice, plan.path);
-	const itemArray = lookupCap(plan.cap)?.status?.itemArray;
-	if (itemArray === void 0 || itemArray.path !== item.arrayPath) return void 0;
-	const entries = valueAtPath$1(slice, item.arrayPath);
-	if (!Array.isArray(entries)) return void 0;
-	return valueAtPath$1(entries.find((entry) => isRecord$1(entry) && entry[itemArray.keyField] === item.key), plan.path);
+/** Every source the live set reads, with the view each own cap is read in. */
+function trackedSourceRequests(live) {
+	const requests = [];
+	for (const e of live) {
+		const target = e.planned.target;
+		const running = e.runtime !== null && e.planned.block.enabled;
+		let targetKey = null;
+		if (target.kind === "existing") {
+			targetKey = compositionSourceKey(target.ref);
+			const self = running ? selfReadCaps(e.planned.fields, target.ref, target.features) : null;
+			requests.push({
+				ref: target.ref,
+				caps: self?.effective ?? [],
+				nativeCaps: self?.native ?? [],
+				nativeOwner: e.planned.block.id
+			});
+		}
+		if (!running) continue;
+		for (const f of e.planned.fields) for (const r of f.reads) if (compositionSourceKey(r.source) !== targetKey) requests.push({
+			ref: r.source,
+			caps: [r.cap]
+		});
+	}
+	return requests;
 }
-function createFieldRecord(plan, byCap, lookupCap) {
-	const initial = initialValue(plan, byCap, lookupCap);
+/**
+* Rule 3: the claims every live customization WANTS this apply; everything
+* else the gate knows is a release candidate, handed back once two applies
+* agree. A block that cannot plan — waiting, unreadable, failed, or with its
+* target gone — HOLDS its claims (rule 4, rule 5): they are wanted as they
+* are. A disabled block wants none (rule 7).
+*/
+function wantedClaims(live, claimGate) {
+	const wanted = [];
+	const held = [];
+	for (const [blockId, entry] of live) {
+		const target = entry.planned.target;
+		if (target.kind === "new") continue;
+		if (target.kind === "unreadable" || entry.planned.problems.length > 0 || target.waiting !== null || target.gone !== null || target.deviceId === null) {
+			held.push(blockId);
+			continue;
+		}
+		if (!entry.planned.block.enabled) continue;
+		const deviceId = target.deviceId;
+		for (const f of target.features) wanted.push({
+			deviceId,
+			capName: f.cap,
+			owner: blockId
+		});
+	}
+	for (const owner of held) wanted.push(...claimGate.claimsOf(owner));
+	return wanted;
+}
+//#endregion
+//#region src/builtins/composer/composition-declarations.ts
+/**
+* Which composed devices exist (D659): one declaration per composition block,
+* owned by `composer` and hung off the shared Blocks integration.
+*
+* `DeclaredDevices` sweeps any row whose declaration is absent. A block missing
+* from ONE apply (a transient store read, a race) would delete the device, and
+* with it its id, exports and rules. The `WithdrawalGate` is D49 for that path:
+* a withdrawal needs a second consecutive apply to agree. The other half of the
+* rule — nothing is declared or withdrawn while the `core_blocks` store has not
+* loaded — is `Composer.apply`'s, which never reaches this gate then (R2).
+*/
+function declarationFor(input) {
 	return {
-		plan,
-		outcome: null,
-		initial,
-		hasWritten: false,
-		written: void 0,
-		expressionMemory: createStatefulExpressionMemory(),
-		eventHighWater: typeof initial === "number" && Number.isFinite(initial) ? initial : null
+		stableId: composedDeviceStableId(input.blockId),
+		name: input.name,
+		type: input.target.type,
+		DeviceClass: composedDeviceClass(input.target.type, input.caps),
+		...input.target.role === void 0 ? {} : { role: input.target.role }
 	};
 }
-function currentOutput(record) {
-	return record.hasWritten ? record.written : record.initial;
-}
-/** The top-level field a record writes: an item leaf writes its whole array. */
-function topLevelField(plan) {
-	return plan.item === void 0 ? plan.path : plan.item.arrayPath;
-}
-/** The field as a report or a log line names it: `items[desiccant].status` for an item leaf. */
-function fieldPath(plan) {
-	return plan.item === void 0 ? plan.path : compositionItemFieldPath(plan.item.arrayPath, plan.item.key, plan.path);
-}
-function itemOf(plan) {
-	return plan.item === void 0 ? {} : { item: plan.item };
-}
-function sameSet(a, b) {
-	return a.size === b.size && [...a].every((x) => b.has(x));
-}
-function valueOf(outcome) {
-	return outcome === null || outcome.state === "unavailable" ? void 0 : outcome.value;
-}
-function reasonOf(outcome) {
-	if (outcome === null) return "not evaluated yet";
-	return outcome.reason;
+/** What forces a rebuild of the live device: type, role, cap set. Never the name. */
+function shapeOf(input) {
+	return JSON.stringify([
+		input.target.type,
+		input.target.role ?? null,
+		input.caps.map((c) => c.name).toSorted()
+	]);
 }
-/** State, value and reason — what a write or a log line is about. NEVER the deadline (R1). */
-function sameOutcome(a, b) {
-	return a !== null && a.state === b.state && valueOf(a) === valueOf(b) && reasonOf(a) === reasonOf(b);
+/**
+* The declaration that holds a persisted composed row whose block has no plan
+* in this apply. `name` and `type` are used only if the row has to be CREATED,
+* which `DeclaredDevices` does not do for a row it finds: it adopts it, and the
+* row's own name and type stay canonical (`ComposedPlaceholderDevice`).
+*/
+function placeholderDeclaration(stableId) {
+	return {
+		stableId,
+		name: stableId,
+		type: DeviceType.Generic,
+		DeviceClass: ComposedPlaceholderDevice
+	};
 }
-/** A source is GONE: the outcome that must never be masked by a non-fatal one. */
-function isFatal(outcome) {
-	return outcome !== null && outcome.state === "unavailable" && outcome.fatal;
-}
-/** A `release`-mode field whose source is CONFIRMED unavailable: not the composition's to write (S1b). Stale is a value (D49). */
-function isReleased(record) {
-	const outcome = record.outcome;
-	return record.plan.unavailable === "release" && outcome?.state === "unavailable" && outcome.confirmed === true;
-}
-/** A `release`-mode field with no value and no ANSWER yet (a failed, first or empty read): held on its last value, never released (D49). */
-function isHeld(record) {
-	const outcome = record.outcome;
-	return record.plan.unavailable === "release" && outcome?.state === "unavailable" && outcome.confirmed !== true;
-}
-function namedField(r) {
-	return {
-		cap: r.plan.cap,
-		path: r.plan.path,
-		...itemOf(r.plan),
-		reason: reasonOf(r.outcome) ?? "unavailable"
-	};
-}
-function writable(record) {
-	const outcome = record.outcome;
-	if (outcome === null) return void 0;
-	if (outcome.state !== "unavailable") return outcome.value;
-	switch (record.plan.unavailable) {
-		case "null": return null;
-		case "unknown": return "unknown";
-		default: return;
+var WITHDRAWAL_CONFIRMATIONS = 2;
+var WithdrawalGate = class {
+	logger;
+	deviceIdOf;
+	known = /* @__PURE__ */ new Map();
+	misses = /* @__PURE__ */ new Map();
+	persistedIds = /* @__PURE__ */ new Map();
+	constructor(logger, deviceIdOf) {
+		this.logger = logger;
+		this.deviceIdOf = deviceIdOf;
+	}
+	/**
+	* The rows that exist before this process applied anything. Called once at
+	* boot, before the first `filter`: without it the mirror starts empty and a
+	* row missing from the first apply after a restart (a release, a block that
+	* no longer plans) is swept at once — one apply, not two. A seeded row
+	* missing from that apply counts as its FIRST miss and is held by
+	* `placeholderDeclaration`. A row the gate already knows keeps its entry and
+	* its miss count.
+	*/
+	seed(rows) {
+		const fresh = rows.filter((row) => !this.known.has(row.stableId));
+		this.known = new Map([...this.known, ...fresh.map((row) => [row.stableId, placeholderDeclaration(row.stableId)])]);
+		this.persistedIds = new Map([...this.persistedIds, ...rows.map((row) => [row.stableId, row.id])]);
+	}
+	filter(current) {
+		const present = new Map(current.map((d) => [d.stableId, d]));
+		const kept = [];
+		const misses = /* @__PURE__ */ new Map();
+		for (const [stableId, declaration] of this.known) {
+			if (present.has(stableId)) continue;
+			const count = (this.misses.get(stableId) ?? 0) + 1;
+			if (count < WITHDRAWAL_CONFIRMATIONS) {
+				this.logger.warn("a composition vanished from one apply — its device is kept until a second apply agrees", {
+					tags: this.tagsOf(stableId),
+					meta: {
+						stableId,
+						misses: count
+					}
+				});
+				kept.push(declaration);
+				misses.set(stableId, count);
+				continue;
+			}
+			this.logger.info("a composition is gone on two consecutive applies — its device is withdrawn", {
+				tags: this.tagsOf(stableId),
+				meta: { stableId }
+			});
+		}
+		this.known = new Map([...kept.map((d) => [d.stableId, d]), ...present]);
+		this.misses = misses;
+		return [...current, ...kept];
+	}
+	/**
+	* The live device's id, else the persisted row's. A declaration whose device
+	* was never built and never persisted has no numeric id to carry: the
+	* stableId in `meta` is then all there is.
+	*/
+	tagsOf(stableId) {
+		const deviceId = this.deviceIdOf(stableId) ?? this.persistedIds.get(stableId) ?? null;
+		return deviceId === null ? {} : { deviceId };
 	}
-}
-function errorText(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-function pendingReason(cap, pending) {
-	return pending.kind === "refused" ? `the \`${cap}\` capability refused the value: ${pending.error}` : `writing the \`${cap}\` capability threw: ${pending.error}`;
-}
-//#endregion
-//#region src/builtins/composer/own-field-reads.ts
-/** Derived fields before accumulators: a count reads the value its own pass just computed. */
-var EVALUATION_ORDER = {
-	derived: 0,
-	accumulator: 1
 };
-/** `keys` in evaluation order: derived, then accumulators, then the rest; stable within a rank. */
-function orderForEvaluation(keys, records) {
-	const rank = (k) => EVALUATION_ORDER[records.get(k)?.plan.role ?? ""] ?? 2;
-	return [...keys].toSorted((a, b) => rank(a) - rank(b));
-}
+//#endregion
+//#region src/builtins/composer/composer-plan.ts
 /**
-* The own field `key` as the runtime holds it right now (`records`: the pass in
-* progress) — exactly what the runtime PUBLISHES for it, which is what the hub
-* answered before (review H1). An unavailable field under the `null` or
-* `unknown` policy is published as `null` / `'unknown'`, so a reader sees that
-* value; only a field nothing is written for (`release`, `offline`) reads as
-* unavailable. Answering those as unavailable left `count` unprimed while a
-* source was late at boot, and it then swallowed the first press as its seed.
+* What one apply PLANS for a block, before anything is declared, claimed or
+* run (D659, D663). Pure over its inputs: the composer hands in what it knows
+* (its rows, the previous plan, the tracker) and gets a `PlannedBlock` back.
 *
-* Not evaluated yet is unavailable: nothing is published, and unknown is never
-* `null` (D393). The evaluation order makes this unreachable for a derived
-* reader of a derived field. Never fatal here: a gone source fails the block
-* through the field that reads it directly.
+* - A `new` target plans as in slice 1: a declaration, a shape, a placeholder
+*   when the composition stopped planning but its row exists.
+* - An `existing` target declares NOTHING (the row is not the composer's). It
+*   is resolved through the tracker's path, described with one bindings read
+*   per plan change, and planned against that description. A settled plan is
+*   kept until the OPERATOR acts (edit, restart): a bindings change alone never
+*   re-plans (Task 10 rule 2, D659). While the claims index is unseeded or the
+*   target is unresolved or undescribed, the block WAITS by name and claims
+*   nothing (D49). A target gone on two agreeing index reads is `gone`.
+* - An unreadable row names no target: whatever it holds is held (D49).
 */
-function ownFieldReading(records, key) {
-	const record = records.get(key);
-	const outcome = record?.outcome ?? null;
-	if (record === void 0 || outcome === null) return {
-		state: "unavailable",
-		reason: `own field \`${key}\` not evaluated yet`,
-		fatal: false
+/** The shape of a placeholder: no caps, so no plan to take a shape from. */
+var PLACEHOLDER_SHAPE = "placeholder";
+var NO_PLAN = {
+	fields: [],
+	events: [],
+	problems: [],
+	declaration: null,
+	shape: null,
+	spec: null
+};
+/**
+* A row that exists but does not parse is held exactly like a composition
+* that stopped planning: its device (if it has a row) stays as an offline
+* placeholder, its claims (if any) are kept, and the block fails naming the
+* parse error. Absent, it would be withdrawn on the second apply that omitted
+* it (D49).
+*/
+function planUnreadable(block, rows) {
+	const stableId = composedDeviceStableId(block.id);
+	const hasRow = rows.has(stableId);
+	return {
+		...NO_PLAN,
+		block: {
+			id: block.id,
+			name: block.name,
+			enabled: false,
+			updatedAt: 0
+		},
+		problems: [`the stored block does not parse — ${block.error}`],
+		declaration: hasRow ? placeholderDeclaration(stableId) : null,
+		shape: hasRow ? PLACEHOLDER_SHAPE : null,
+		target: { kind: "unreadable" }
 	};
-	if (outcome.state === "unavailable") {
-		const published = writable(record);
-		if (published !== void 0) return {
-			state: "fresh",
-			value: published
-		};
+}
+/** `target` is the block's own `new` target, narrowed by the caller: this path never sees an existing one (M-5). */
+function planNew(block, target, lookupCap, rows) {
+	const plan = planComposition(block.composition, lookupCap);
+	const planned = { kind: "new" };
+	if (plan.problems.length > 0) {
+		const stableId = composedDeviceStableId(block.id);
+		const hasRow = rows.has(stableId);
 		return {
-			state: "unavailable",
-			reason: `own field \`${key}\`: ${outcome.reason}`,
-			fatal: false,
-			...outcome.confirmed === true ? { confirmed: true } : {}
+			...NO_PLAN,
+			block,
+			problems: plan.problems.map((p) => `${p.path}: ${p.message}`),
+			declaration: hasRow ? placeholderDeclaration(stableId) : null,
+			shape: hasRow ? PLACEHOLDER_SHAPE : null,
+			target: planned
 		};
 	}
-	if (outcome.state === "stale") return {
-		state: "stale",
-		value: outcome.value,
-		reason: `own field \`${key}\`: ${outcome.reason ?? "stale"}`
+	const caps = block.composition.features.flatMap((f) => {
+		if (!compositionFeatureEnabled(f)) return [];
+		const def = lookupCap(f.cap);
+		return def === null ? [] : [def];
+	});
+	const declarationInput = {
+		blockId: block.id,
+		name: block.name,
+		target,
+		caps
 	};
 	return {
-		state: "fresh",
-		value: outcome.value
+		block,
+		fields: plan.fields,
+		events: plan.events,
+		problems: [],
+		declaration: declarationFor(declarationInput),
+		shape: shapeOf(declarationInput),
+		spec: {
+			type: target.type,
+			...target.role === void 0 ? {} : { role: target.role }
+		},
+		target: planned
 	};
 }
-//#endregion
-//#region src/builtins/composer/composition-evaluation.ts
-/**
-* Evaluating a composition's fields (D659, D670): one pass over the keys a
-* change affects, the own-field readers it must re-run (D670 amendment), and
-* the state-derived events it emits. Split from `composition-runtime.ts`,
-* which owns the records and hands them in through {@link EvaluationHost}.
-*
-* - Stateful expression memory commits only when the whole expression
-*   succeeds.
-* - A declared state-derived event advances its high-water and is emitted
-*   BEFORE the corresponding target write; the committed records are visible
-*   to a synchronous subscriber first.
-* - Derived fields are evaluated before accumulators, and every field reading
-*   an own field that changed is re-evaluated in the same pass.
-*/
-function strictFiniteAdvance(previous, next) {
-	return typeof next === "number" && Number.isFinite(next) && (previous === null || next > previous);
-}
-/** The record key an own read is answered from; null when `read` is a source's. */
-function ownKeyOf(host, read) {
-	if (host.isOwnRead === void 0 || !host.isOwnRead(read)) return null;
-	const key = `${read.cap}.${read.fieldPath}`;
-	return host.records().has(key) ? key : null;
-}
-/**
-* `keys`, derived before accumulators, then — in the same pass — every
-* derived/accumulator field that reads an own field that changed. Bounded by
-* the record count: the validator refuses a cycle, so a chain is at most that
-* long (D6).
-*/
-function evaluateWithOwnReaders(host, keys, now) {
-	const changed = /* @__PURE__ */ new Set();
-	const valueCaps = /* @__PURE__ */ new Set();
-	let round = orderForEvaluation(keys, host.records());
-	for (let hop = 0; round.length > 0 && hop <= host.records().size; hop++) {
-		const delta = evaluateFields(host, round, now);
-		for (const k of delta.keys) changed.add(k);
-		for (const c of delta.valueCaps) valueCaps.add(c);
-		round = orderForEvaluation([...host.records().values()].filter((r) => (r.plan.role === "derived" || r.plan.role === "accumulator") && r.plan.reads.some((read) => {
-			const own = ownKeyOf(host, read);
-			return own !== null && delta.keys.has(own);
-		})).map((r) => fieldKey(r.plan)), host.records());
-	}
-	return {
-		keys: changed,
-		valueCaps
+async function planExisting(input) {
+	const { block, previous, operatorAction } = input;
+	const prior = previous?.target;
+	if (!operatorAction && previous !== void 0 && prior?.kind === "existing" && prior.waiting === null) return {
+		...previous,
+		block
 	};
-}
-/** Evaluate `keys` in order against the records in progress; commit whatever was evaluated, even on a throw. */
-function evaluateFields(host, keys, now) {
-	const changed = /* @__PURE__ */ new Set();
-	const valueCaps = /* @__PURE__ */ new Set();
-	const next = new Map(host.records());
-	const read = (r) => {
-		const own = ownKeyOf(host, r);
-		return own === null ? host.read(r) : ownFieldReading(next, own);
+	const ref = input.target.device;
+	const key = compositionSourceKey(ref);
+	const knownId = prior?.kind === "existing" ? prior.deviceId : null;
+	if (input.claimsWait !== null) return waitingPlan(block, ref, knownId, input.claimsWait);
+	const resolution = await input.tracker.resolve(ref, operatorAction);
+	if (resolution.kind === "unknown") return waitingPlan(block, ref, knownId, `the target device \`${key}\` could not be resolved (${resolution.error}) — nothing is claimed until it is; retried on the next apply`);
+	const existing = {
+		kind: "existing",
+		ref,
+		deviceId: resolution.kind === "found" ? resolution.deviceId : knownId,
+		waiting: null,
+		gone: null,
+		features: [],
+		nativeCaps: /* @__PURE__ */ new Map()
 	};
-	try {
-		for (const key of keys) {
-			const record = next.get(key);
-			if (record === void 0) continue;
-			const candidateMemory = cloneStatefulExpressionMemory(record.expressionMemory);
-			const outcome = evaluateCompositionField({
-				source: record.plan.source,
-				read,
-				now,
-				stateful: {
-					currentOutput: currentOutput(record),
-					expressionMemory: candidateMemory,
-					startedAtMs: host.startedAtMs,
-					callPathPrefix: fieldKey(record.plan)
-				}
-			});
-			const expressionSucceeded = outcome.state !== "unavailable";
-			let evaluated = {
-				...record,
-				outcome,
-				...expressionSucceeded ? { expressionMemory: candidateMemory } : {}
-			};
-			const eventPlans = host.eventPlans.filter((eventPlan) => eventPlan.fieldKey === fieldKey(record.plan));
-			if (expressionSucceeded && eventPlans.length > 0 && strictFiniteAdvance(record.eventHighWater, outcome.value)) {
-				const timestamp = outcome.value;
-				evaluated = {
-					...evaluated,
-					eventHighWater: timestamp
-				};
-				next.set(key, evaluated);
-				host.commit(next);
-				for (const eventPlan of eventPlans) host.emit(eventPlan, timestamp);
-			} else next.set(key, evaluated);
-			if (sameOutcome(record.outcome, outcome)) continue;
-			if (record.outcome?.state !== outcome.state) host.logTransition(record, outcome);
-			if (valueOf(record.outcome) !== valueOf(outcome)) valueCaps.add(record.plan.cap);
-			changed.add(key);
+	if (resolution.kind === "missing") return {
+		...NO_PLAN,
+		block,
+		target: {
+			...existing,
+			gone: `${resolution.reason} — two index reads agreed`
 		}
-	} finally {
-		host.commit(next);
-	}
+	};
+	const description = await input.targets.describe(ref, resolution.deviceId, resolution.type, operatorAction);
+	if (description === null) return waitingPlan(block, ref, resolution.deviceId, `the target device \`${key}\` could not be described (its bindings did not read) — nothing is claimed until it is; retried on the next apply`);
+	const plan = planComposition(block.composition, input.lookupCap, description);
 	return {
-		keys: changed,
-		valueCaps
+		...NO_PLAN,
+		block,
+		fields: plan.problems.length > 0 ? [] : plan.fields,
+		events: plan.problems.length > 0 ? [] : plan.events,
+		problems: plan.problems.map((p) => `${p.path}: ${p.message}`),
+		target: {
+			...existing,
+			features: plan.features,
+			nativeCaps: description.nativeCaps
+		}
 	};
 }
-/** Emit one state-derived event; a delivery failure is logged, never thrown (D670). */
-function emitStateDerivedEvent(ctx, plan, timestamp) {
-	const extras = {
-		tags: { deviceId: ctx.deviceId },
-		meta: {
-			blockId: ctx.blockId,
-			cap: plan.cap,
-			eventName: plan.eventName,
-			category: plan.category,
-			timestamp
+function waitingPlan(block, ref, deviceId, waiting) {
+	return {
+		...NO_PLAN,
+		block,
+		target: {
+			kind: "existing",
+			ref,
+			deviceId,
+			waiting,
+			gone: null,
+			features: [],
+			nativeCaps: /* @__PURE__ */ new Map()
 		}
 	};
-	try {
-		if (plan.category !== EventCategory.DoorbellOnPressed) throw new Error(`unsupported state-derived event category \`${plan.category}\``);
-		const event = createEvent(EventCategory.DoorbellOnPressed, {
-			type: "device",
-			id: ctx.deviceId,
-			deviceId: ctx.deviceId
-		}, {
-			deviceId: ctx.deviceId,
-			timestamp
-		});
-		ctx.events.emit(event);
-		ctx.logger.debug("composition: state-derived event emitted", extras);
-	} catch (error) {
-		ctx.logger.warn("composition: state-derived event delivery failed", {
-			...extras,
-			meta: {
-				...extras.meta,
-				error: errorText(error)
-			}
-		});
-	}
 }
-//#endregion
-//#region src/builtins/composer/slice-assembler.ts
 /**
-* From the runtime's flat field values to the slice a target takes (D663).
-*
-* A top-level field is written under its path. An item leaf
-* (`consumables.items[desiccant].remaining.value`) is one entry of an ARRAY:
-* every leaf of one item is grouped by `(cap, arrayPath, key)` and set, by
-* path segment, onto the cap's OWN `status.itemArray.emptyItem` — so an
-* unsourced nullable leaf is `null` because the cap says so, not because this
-* module guessed. The key, the label and {@link COMPOSED_ITEM_FIXED_FIELDS}
-* are the composer's; items are sorted by key so two writes of the same
-* values are one slice.
-*
-* A cap the lookup does not know as an item array cannot be assembled: that
-* is thrown by name, and the runtime's write path turns a throw into a named,
-* retried failure — never a half-built array.
+* Runtime preparation can still fail after a complete existing-target plan.
+* Preserve its fields and description for retry, but mark it waiting so claim
+* reconciliation cannot treat the unprepared candidate as live.
 */
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+function withExistingTargetWait(p, waiting) {
+	return p.target.kind === "existing" ? {
+		...p,
+		target: {
+			...p.target,
+			waiting
+		}
+	} : p;
 }
-/** `setPath(item, ['remaining', 'value'], 0)` → `{ ...item, remaining: { ...item.remaining, value: 0 } }`. */
-function setPath(record, segments, value) {
-	const [head, ...rest] = segments;
-	if (head === void 0) return record;
-	if (rest.length === 0) return {
-		...record,
-		[head]: value
-	};
-	const current = record[head];
+/** What `logPlanTransition` compares: problems, and for an existing target its wait or its loss. */
+function planSummary(p) {
+	const target = p.target;
+	return (target.kind === "existing" ? [
+		p.problems.join("; "),
+		target.waiting ?? "",
+		target.gone ?? ""
+	] : [p.problems.join("; ")]).filter((part) => part !== "").join(" | ");
+}
+/**
+* Rule 5 on the PLAN path: `device.unregistered` is telemetry and may be
+* dropped (D8), so a target is often found gone by the operator's next edit or
+* restart. The previous live target is what must be ungrafted — exactly as on
+* the event path. Null when nothing was lost by THIS plan.
+*/
+function lostTarget(p, previous) {
+	const now = p.target;
+	const before = previous?.target;
+	if (now.kind !== "existing" || now.gone === null || before?.kind !== "existing") return null;
+	if (before.deviceId === null || before.gone !== null) return null;
 	return {
-		...record,
-		[head]: setPath(isRecord(current) ? current : {}, rest, value)
+		target: before,
+		deviceId: before.deviceId
 	};
 }
-function itemArrayOf(group, lookupCap) {
-	const itemArray = lookupCap(group.cap)?.status?.itemArray;
-	if (itemArray === void 0 || itemArray.path !== group.arrayPath) throw new Error(`\`${group.cap}\` has no item array at \`${group.arrayPath}\` — \`${compositionItemFieldPath(group.arrayPath, group.key, "*")}\` cannot be assembled`);
-	return itemArray;
+/** Two plans write the same place: both new, or the very same existing-target plan (reused until the operator acts). */
+function sameTarget(a, b) {
+	return a === b || a.kind === "new" && b.kind === "new";
 }
-function assembleItem(group, lookupCap) {
-	const itemArray = itemArrayOf(group, lookupCap);
-	const base = {
-		...itemArray.emptyItem,
-		[itemArray.keyField]: group.key,
-		...itemArray.labelField === void 0 ? {} : { [itemArray.labelField]: group.label },
-		...COMPOSED_ITEM_FIXED_FIELDS
+/** One line when a block starts or stops planning (or waiting, or loses its target) — never one per apply. */
+function logPlanTransition(logger, previous, p, liveTags) {
+	if (previous !== void 0 && planSummary(previous) === planSummary(p)) return;
+	if (previous === void 0 && planSummary(p) === "") return;
+	const target = p.target;
+	const extras = {
+		tags: target.kind === "existing" && target.deviceId !== null ? { deviceId: target.deviceId } : liveTags,
+		meta: {
+			blockId: p.block.id,
+			problems: p.problems,
+			placeholder: p.declaration !== null
+		}
 	};
-	return group.leaves.reduce((item, leaf) => setPath(item, leaf.plan.path.split("."), leaf.value), base);
+	if (target.kind === "existing" && target.gone !== null) logger.error("customization target device is gone — the block failed; only the operator ends this (edit or restart the block)", {
+		...extras,
+		meta: {
+			...extras.meta,
+			target: compositionSourceKey(target.ref)
+		}
+	});
+	else if (target.kind === "existing" && target.waiting !== null) logger.warn("customization waits — nothing is claimed or released until it plans", {
+		...extras,
+		meta: {
+			...extras.meta,
+			reason: target.waiting
+		}
+	});
+	else if (p.problems.length === 0) logger.info("composition plans again", extras);
+	else logger.warn(p.declaration === null ? "composition does not plan — no device is declared for it" : "composition no longer plans — its device is kept offline with no capabilities", extras);
 }
-function groupItems(entries) {
-	const groups = /* @__PURE__ */ new Map();
-	for (const entry of entries) {
-		const item = entry.plan.item;
-		if (item === void 0) continue;
-		const id = `${entry.plan.cap}\u0000${item.arrayPath}\u0000${item.key}`;
-		const group = groups.get(id) ?? {
-			cap: entry.plan.cap,
-			arrayPath: item.arrayPath,
-			key: item.key,
-			label: item.label,
-			leaves: []
-		};
-		groups.set(id, {
-			...group,
-			leaves: [...group.leaves, entry]
-		});
-	}
-	return [...groups.values()];
+//#endregion
+//#region src/builtins/composer/field-record.ts
+/**
+* One composed field's record and the pure judgements over it (D659, D663):
+* what it may write, whether it is released (a CONFIRMED unavailability of a
+* `release`-mode field, S1b) or HELD (no answer yet, D49), and how a report or a
+* log line names it. Split from `composition-runtime.ts`, which holds the
+* behaviour.
+*/
+var NO_FIELDS = /* @__PURE__ */ new Set();
+function fieldKey(plan) {
+	return compositionFieldKey(plan);
 }
-function compareKeys(a, b) {
-	return a < b ? -1 : a > b ? 1 : 0;
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function assembleSlice(entries, lookupCap) {
-	const top = Object.fromEntries(entries.filter((e) => e.plan.item === void 0).map((e) => [e.plan.path, e.value]));
-	const groups = groupItems(entries);
-	const arrays = [...new Set(groups.map((g) => g.arrayPath))].map((arrayPath) => [arrayPath, groups.filter((g) => g.arrayPath === arrayPath).toSorted((a, b) => compareKeys(a.key, b.key)).map((g) => assembleItem(g, lookupCap))]);
+function valueAtPath$1(value, path) {
+	return path.split(".").reduce((node, segment) => isRecord$1(node) ? node[segment] : void 0, value);
+}
+function initialValue(plan, byCap, lookupCap) {
+	const slice = byCap?.get(plan.cap);
+	if (slice === void 0 || slice === null) return void 0;
+	const item = plan.item;
+	if (item === void 0) return valueAtPath$1(slice, plan.path);
+	const itemArray = lookupCap(plan.cap)?.status?.itemArray;
+	if (itemArray === void 0 || itemArray.path !== item.arrayPath) return void 0;
+	const entries = valueAtPath$1(slice, item.arrayPath);
+	if (!Array.isArray(entries)) return void 0;
+	return valueAtPath$1(entries.find((entry) => isRecord$1(entry) && entry[itemArray.keyField] === item.key), plan.path);
+}
+function createFieldRecord(plan, byCap, lookupCap) {
+	const initial = initialValue(plan, byCap, lookupCap);
 	return {
-		...top,
-		...Object.fromEntries(arrays)
+		plan,
+		outcome: null,
+		initial,
+		hasWritten: false,
+		written: void 0,
+		expressionMemory: createStatefulExpressionMemory(),
+		eventHighWater: typeof initial === "number" && Number.isFinite(initial) ? initial : null
+	};
+}
+function currentOutput(record) {
+	return record.hasWritten ? record.written : record.initial;
+}
+/** The top-level field a record writes: an item leaf writes its whole array. */
+function topLevelField(plan) {
+	return plan.item === void 0 ? plan.path : plan.item.arrayPath;
+}
+/** The field as a report or a log line names it: `items[desiccant].status` for an item leaf. */
+function fieldPath(plan) {
+	return plan.item === void 0 ? plan.path : compositionItemFieldPath(plan.item.arrayPath, plan.item.key, plan.path);
+}
+function itemOf(plan) {
+	return plan.item === void 0 ? {} : { item: plan.item };
+}
+function sameSet(a, b) {
+	return a.size === b.size && [...a].every((x) => b.has(x));
+}
+function valueOf(outcome) {
+	return outcome === null || outcome.state === "unavailable" ? void 0 : outcome.value;
+}
+function reasonOf(outcome) {
+	if (outcome === null) return "not evaluated yet";
+	return outcome.reason;
+}
+/** State, value and reason — what a write or a log line is about. NEVER the deadline (R1). */
+function sameOutcome(a, b) {
+	return a !== null && a.state === b.state && valueOf(a) === valueOf(b) && reasonOf(a) === reasonOf(b);
+}
+/** A source is GONE: the outcome that must never be masked by a non-fatal one. */
+function isFatal(outcome) {
+	return outcome !== null && outcome.state === "unavailable" && outcome.fatal;
+}
+/** A `release`-mode field whose source is CONFIRMED unavailable: not the composition's to write (S1b). Stale is a value (D49). */
+function isReleased(record) {
+	const outcome = record.outcome;
+	return record.plan.unavailable === "release" && outcome?.state === "unavailable" && outcome.confirmed === true;
+}
+/** A `release`-mode field with no value and no ANSWER yet (a failed, first or empty read): held on its last value, never released (D49). */
+function isHeld(record) {
+	const outcome = record.outcome;
+	return record.plan.unavailable === "release" && outcome?.state === "unavailable" && outcome.confirmed !== true;
+}
+function namedField(r) {
+	return {
+		cap: r.plan.cap,
+		path: r.plan.path,
+		...itemOf(r.plan),
+		reason: reasonOf(r.outcome) ?? "unavailable"
 	};
 }
+function writable(record) {
+	const outcome = record.outcome;
+	if (outcome === null) return void 0;
+	if (outcome.state !== "unavailable") return outcome.value;
+	switch (record.plan.unavailable) {
+		case "null": return null;
+		case "unknown": return "unknown";
+		default: return;
+	}
+}
+function errorText(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function pendingReason(cap, pending) {
+	return pending.kind === "refused" ? `the \`${cap}\` capability refused the value: ${pending.error}` : `writing the \`${cap}\` capability threw: ${pending.error}`;
+}
 //#endregion
-//#region src/builtins/composer/composition-runtime.ts
+//#region src/builtins/composer/own-field-reads.ts
+/** Derived fields before accumulators: a count reads the value its own pass just computed. */
+var EVALUATION_ORDER = {
+	derived: 0,
+	accumulator: 1
+};
+/** `keys` in evaluation order: derived, then accumulators, then the rest; stable within a rank. */
+function orderForEvaluation(keys, records) {
+	const rank = (k) => EVALUATION_ORDER[records.get(k)?.plan.role ?? ""] ?? 2;
+	return [...keys].toSorted((a, b) => rank(a) - rank(b));
+}
 /**
-* One running composition: per-field state, writes to the composed device, and
-* one deadline timer (D659).
-*
-* - Only the fields a change affects are recomputed.
-* - A cap is SEEDED once (`setCapState`, every required field present), then
-*   PATCHED (`patchCapState` merges; the runtime-state twin of "`setAll`
-*   already merges").
-* - Unavailable is per field. A nullable field is written `null`; a
-*   non-nullable one is not written and the device goes offline (D393).
-* - A `clock` field (`now` only) is recomputed when a sibling of its cap
-*   changes value, so `binary.lastChangedAt` is the last transition. A
-*   `constant` is computed once.
-* - A windowed expression reports when it flips; ONE timer at the earliest
-*   such instant. It waits for no source (D3). Every evaluation is STORED, so
-*   a deadline that moved reaches the timer even when the value did not: an
-*   unstored deadline fires early, re-evaluates to "same", and re-arms
-*   `setTimeout(0)` until the real window closes — a poll (R1).
-* - A fatal (source gone) outcome is the block's failure, and it is sticky:
-*   the device stays offline until a new runtime, created on an operator edit
-*   or restart, clears it.
-* - A write the target REFUSES or THROWS on leaves the evaluated outcomes
-*   alone and marks its cap write-pending: the next pass that evaluates any
-*   field of that cap, and every deadline pass, re-writes the WHOLE current
-*   slice (a seed if it was never seeded). No retry timer — the next source
-*   event or deadline is the retry (D3). One log line per failure transition.
-* - Nothing escapes: a pass that throws is logged, and the timer is re-armed
-*   from the stored deadlines regardless.
-* - `stop()` is terminal: every entry point is a no-op afterwards.
-*
-* Slice 2 (D663):
-* - Records are keyed by `compositionFieldKey`: two items' `status` are two
-*   records. An item-array cap is written WHOLE — a change to one item leaf
-*   re-sends every item, assembled by `assembleSlice` on the cap's `emptyItem`.
-*   A required item leaf with no fallback holds the array, named once.
-* - `'unknown'` unavailable mode writes the enum's own word.
-* - `'release'` unavailable mode hands the field BACK (ruling S1b): the target
-*   is told to `withhold` it, the field's record forgets what it wrote, and the
-*   source returning re-widens and writes it again. Stale is a value (D49),
-*   never a release — and neither is an UNCONFIRMED unavailability (a failed,
-*   first or empty read): the field is HELD on its last value, not written,
-*   not withheld, its claim kept, until the source answers (D49, fix round 2).
-*   `state().released` / `state().held` name every such field for the report.
-* - A target whose writes are asynchronous (claims on the hub) reports what did
-*   not land through `onAsyncFailure`: the cap is marked write-pending by name
-*   and re-written whole on the next pass — no retry timer (D3).
+* The own field `key` as the runtime holds it right now (`records`: the pass in
+* progress) — exactly what the runtime PUBLISHES for it, which is what the hub
+* answered before (review H1). An unavailable field under the `null` or
+* `unknown` policy is published as `null` / `'unknown'`, so a reader sees that
+* value; only a field nothing is written for (`release`, `offline`) reads as
+* unavailable. Answering those as unavailable left `count` unprimed while a
+* source was late at boot, and it then swallowed the first press as its seed.
 *
-* Slice 2b (D670): evaluation — stateful memory, state-derived events before
-* their write, and reads of the composition's OWN fields answered from the
-* records rather than the hub (D670 amendment) — is `composition-evaluation.ts`.
-* Neither an event-bus failure nor a refused write can replay an event, and the
-* hub's echo of the runtime's own write re-runs nothing.
+* Not evaluated yet is unavailable: nothing is published, and unknown is never
+* `null` (D393). The evaluation order makes this unreachable for a derived
+* reader of a derived field. Never fatal here: a gone source fails the block
+* through the field that reads it directly.
 */
+function ownFieldReading(records, key) {
+	const record = records.get(key);
+	const outcome = record?.outcome ?? null;
+	if (record === void 0 || outcome === null) return {
+		state: "unavailable",
+		reason: `own field \`${key}\` not evaluated yet`,
+		fatal: false
+	};
+	if (outcome.state === "unavailable") {
+		const published = writable(record);
+		if (published !== void 0) return {
+			state: "fresh",
+			value: published
+		};
+		return {
+			state: "unavailable",
+			reason: `own field \`${key}\`: ${outcome.reason}`,
+			fatal: false,
+			...outcome.confirmed === true ? { confirmed: true } : {}
+		};
+	}
+	if (outcome.state === "stale") return {
+		state: "stale",
+		value: outcome.value,
+		reason: `own field \`${key}\`: ${outcome.reason ?? "stale"}`
+	};
+	return {
+		state: "fresh",
+		value: outcome.value
+	};
+}
+//#endregion
+//#region src/builtins/composer/composition-evaluation.ts
 /**
-* A refusal nothing on this side can retry away: another owner holds the
-* field, the slice is invalid for the cap, the device is not known. Every
-* other outcome — a throw, an unreadable row, a migration in flight, a lost
-* claim — is transient and retried on the next pass (D6: bounded, never a loop).
+* Evaluating a composition's fields (D659, D670): one pass over the keys a
+* change affects, the own-field readers it must re-run (D670 amendment), and
+* the state-derived events it emits. Split from `composition-runtime.ts`,
+* which owns the records and hands them in through {@link EvaluationHost}.
+*
+* - Stateful expression memory commits only when the whole expression
+*   succeeds.
+* - A declared state-derived event advances its high-water and is emitted
+*   BEFORE the corresponding target write; the committed records are visible
+*   to a synchronous subscriber first.
+* - Derived fields are evaluated before accumulators, and every field reading
+*   an own field that changed is re-evaluated in the same pass.
 */
-var TERMINAL_REFUSALS = new Set([
-	"owned-by-other",
-	"invalid-slice",
-	"unknown-device"
-]);
-var CompositionRuntime = class {
-	deps;
-	records;
-	startedAtMs;
-	seeded = /* @__PURE__ */ new Set();
-	available = null;
-	failure = null;
-	disabledReason = null;
-	stopped = false;
-	/** The last `pass threw` logged (`during: message`); cleared by a pass that completes. */
-	lastPassError = null;
-	pending = /* @__PURE__ */ new Map();
-	heldBack = /* @__PURE__ */ new Set();
-	/** Caps whose item array is not written because a required leaf has no value. */
-	itemsHeld = /* @__PURE__ */ new Set();
-	/** Record keys currently released (S1b), for transition logs and the report. */
-	released = /* @__PURE__ */ new Set();
-	/** Per cap, the top-level fields the target last accepted as withheld; absent = none. */
-	withheld = /* @__PURE__ */ new Map();
-	/** Per record key, how many times the field has been released — churn the transition line reports (D391). */
-	releaseFlaps = /* @__PURE__ */ new Map();
-	/** Caps the target refused for good (`TERMINAL_REFUSALS`): never written again by this runtime. */
-	terminal = /* @__PURE__ */ new Map();
-	/** What `composition-evaluation.ts` reads and commits through. */
-	evaluation;
-	constructor(deps) {
-		this.deps = deps;
-		this.startedAtMs = deps.now();
-		this.records = new Map(deps.fields.map((plan) => [fieldKey(plan), createFieldRecord(plan, deps.initialByCap, deps.lookupCap)]));
-		deps.target.onAsyncFailure?.((cap, failure) => this.onTargetWriteFailed(cap, failure));
-		const eventContext = {
-			deviceId: deps.target.id,
-			blockId: deps.blockId,
-			events: deps.events,
-			logger: deps.logger
-		};
-		this.evaluation = {
-			records: () => this.records,
-			commit: (records) => {
-				this.records = records;
-			},
-			read: deps.read,
-			...deps.isOwnRead === void 0 ? {} : { isOwnRead: deps.isOwnRead },
-			eventPlans: deps.eventPlans,
-			startedAtMs: this.startedAtMs,
-			emit: (plan, timestamp) => emitStateDerivedEvent(eventContext, plan, timestamp),
-			logTransition: (record, outcome) => this.logTransition(record, outcome)
-		};
-	}
-	start() {
-		if (this.disabledReason !== null) return;
-		this.guarded("start", true, () => this.pass([...this.records.keys()], "start"));
-	}
-	onSourcesChanged(sliceKeys) {
-		if (this.disabledReason !== null) return;
-		this.guarded("source", true, () => {
-			const affected = [...this.records.values()].filter((r) => r.plan.reads.some((read) => ownKeyOf(this.evaluation, read) === null && sliceKeys.has(compositionSliceKey(read.source, read.cap)))).map((r) => fieldKey(r.plan));
-			if (affected.length > 0) this.pass(affected, "source");
-		});
-	}
-	disable(reason) {
-		if (this.stopped) return;
-		this.disabledReason = reason;
-		this.deps.timer.disarm();
-		this.guarded("disable", false, () => {
-			const outcome = {
-				state: "unavailable",
-				value: null,
-				reason,
-				fatal: false,
-				confirmed: true
-			};
-			const touched = [...this.records.values()].filter((r) => !isFatal(r.outcome) && !sameOutcome(r.outcome, outcome));
-			for (const r of touched) this.logTransition(r, outcome);
-			this.records = new Map([...this.records].map(([k, r]) => [k, isFatal(r.outcome) ? r : {
-				...r,
-				outcome
-			}]));
-			this.writeCaps(new Set(touched.map((r) => fieldKey(r.plan))), /* @__PURE__ */ new Set());
-			this.updateAvailability();
-		});
-	}
-	/** Terminal: no write, no evaluation and no timer after this. */
-	stop() {
-		this.stopped = true;
-		this.deps.timer.disarm();
-	}
-	state() {
-		return {
-			failure: this.failure,
-			available: this.available === true,
-			fields: [...this.records.values()].map((r) => {
-				const terminal = this.terminal.get(r.plan.cap);
-				if (terminal !== void 0 && !isFatal(r.outcome)) return {
-					cap: r.plan.cap,
-					path: r.plan.path,
-					...itemOf(r.plan),
-					state: "unavailable",
-					value: null,
-					reason: terminal
-				};
-				const pending = this.pending.get(r.plan.cap);
-				if (pending !== void 0 && !isFatal(r.outcome)) return {
-					cap: r.plan.cap,
-					path: r.plan.path,
-					...itemOf(r.plan),
-					state: "unavailable",
-					value: null,
-					reason: pendingReason(r.plan.cap, pending)
-				};
-				const value = valueOf(r.outcome);
-				const reason = reasonOf(r.outcome);
-				return {
-					cap: r.plan.cap,
-					path: r.plan.path,
-					...itemOf(r.plan),
-					state: r.outcome?.state ?? "unavailable",
-					value: value === void 0 ? null : value,
-					...reason === null ? {} : { reason }
-				};
-			}),
-			released: [...this.records.values()].filter(isReleased).map(namedField),
-			held: [...this.records.values()].filter(isHeld).map(namedField)
-		};
-	}
-	/**
-	* The target's enqueued write of `cap` did not land: the cap is write-pending
-	* by name and re-written WHOLE on the next pass that evaluates it (or the next
-	* deadline pass). A withhold sent to that target is forgotten too, so it is
-	* re-sent. No retry timer (D3).
-	*/
-	onTargetWriteFailed(cap, failure) {
-		this.guarded("target-failure", false, () => {
-			if (!this.deps.fields.some((f) => f.cap === cap) || this.terminal.has(cap)) return;
-			if (failure.kind === "refused" && TERMINAL_REFUSALS.has(failure.code)) {
-				this.markTerminal(cap, failure.code, failure.message);
-				return;
-			}
-			this.withheld = new Map([...this.withheld].filter(([c]) => c !== cap));
-			this.markPending(cap, this.seeded.has(cap) ? "patch" : "seed", failure.kind === "threw" ? {
-				kind: "threw",
-				error: failure.error
-			} : {
-				kind: "refused",
-				error: `${failure.code}: ${failure.message}`
-			});
-			this.updateAvailability();
-		});
-	}
-	/**
-	* The target refused this cap for good: nothing on this side can retry it
-	* away (I-3). The cap is never written again by this runtime, its fields
-	* report the refusal, and the block fails naming it — only the operator ends
-	* this (edit or delete the block, or the competing one), like a gone source.
-	*/
-	markTerminal(cap, code, message) {
-		const reason = `the \`${cap}\` capability was refused for good: ${code}: ${message} — only the operator ends this (edit or delete the block)`;
-		this.terminal = new Map([...this.terminal, [cap, reason]]);
-		this.pending = new Map([...this.pending].filter(([c]) => c !== cap));
-		if (this.failure === null) this.failure = `composed write refused for good — ${cap}: ${code}: ${message}`;
-		this.deps.logger.error("composed capability refused for good — it is not written again until the operator edits or deletes the block", {
-			tags: { deviceId: this.deps.target.id },
-			meta: {
-				blockId: this.deps.blockId,
-				cap,
-				code,
-				error: message
-			}
-		});
-		this.updateAvailability();
-	}
-	/**
-	* Every entry point runs here: a no-op once stopped, nothing thrown escapes,
-	* and the one timer is re-armed from the stored deadlines whatever happened.
-	*/
-	guarded(during, rearm, body) {
-		if (this.stopped) return;
-		let threw = false;
-		try {
-			body();
-			this.lastPassError = null;
-		} catch (error) {
-			threw = true;
-			this.logPassError(during, errorText(error));
-		} finally {
-			if (rearm && !this.stopped && this.disabledReason === null) this.armDeadline(threw ? this.deps.now() : null);
-		}
-	}
-	/** Once per distinct failure, not once per pass: a reader that keeps throwing logs one line. */
-	logPassError(during, error) {
-		const key = `${during}: ${error}`;
-		if (key === this.lastPassError) return;
-		this.lastPassError = key;
-		this.deps.logger.error("composition pass threw — the runtime keeps running; the next source event or deadline re-runs it", {
-			tags: { deviceId: this.deps.target.id },
-			meta: {
-				blockId: this.deps.blockId,
-				during,
-				error
-			}
-		});
-	}
-	pass(keys, trigger) {
-		const initial = trigger === "start";
-		const now = this.deps.now();
-		const calculated = evaluateWithOwnReaders(this.evaluation, keys.filter((k) => {
-			const role = this.records.get(k)?.plan.role;
-			return role === "derived" || role === "accumulator";
-		}), now);
-		const followers = [...this.records.values()].filter((r) => r.plan.role === "clock" ? initial || calculated.valueCaps.has(r.plan.cap) : r.plan.role === "constant" && initial).map((r) => fieldKey(r.plan));
-		const extra = evaluateFields(this.evaluation, followers, now);
-		const evaluatedCaps = new Set([...keys, ...followers].flatMap((k) => {
-			const cap = this.records.get(k)?.plan.cap;
-			return cap === void 0 ? [] : [cap];
-		}));
-		const retry = new Set([...this.pending.keys()].filter((cap) => trigger === "deadline" || evaluatedCaps.has(cap)));
-		this.writeCaps(new Set([...calculated.keys, ...extra.keys]), retry);
-		this.updateFailure();
-		this.updateAvailability();
-	}
-	recordsOf(cap) {
-		return [...this.records.values()].filter((r) => r.plan.cap === cap);
-	}
-	/** `retry`: write-pending caps this pass re-writes WHOLE, whether or not a value changed. */
-	writeCaps(touched, retry) {
-		const caps = new Set([...[...touched].flatMap((k) => {
-			const cap = this.records.get(k)?.plan.cap;
-			return cap === void 0 ? [] : [cap];
-		}), ...retry]);
-		for (const cap of caps) {
-			if (this.terminal.has(cap)) continue;
-			const sync = this.syncReleased(cap);
-			if (sync === "failed") continue;
-			if (!this.seeded.has(cap)) this.seedCap(cap);
-			else if (this.pending.has(cap) || sync === "changed") this.patchWholeCap(cap, sync === "changed");
-			else this.patchCap(cap, touched);
-		}
-	}
-	/**
-	* S1b: tell the target which fields of `cap` are released, when that set
-	* changed since it last accepted one. A released record forgets what it wrote,
-	* so the source returning writes it again. False when the target refused or
-	* threw: the cap is write-pending and the withhold is re-sent next pass.
-	*/
-	syncReleased(cap) {
-		const records = this.recordsOf(cap);
-		this.logReleaseTransitions(cap, records);
-		const releasedRecords = records.filter(isReleased);
-		this.records = new Map([...this.records].map(([k, r]) => releasedRecords.includes(r) && r.hasWritten ? [k, {
-			...r,
-			hasWritten: false,
-			written: void 0
-		}] : [k, r]));
-		const withhold = this.deps.target.withhold;
-		if (withhold === void 0) return "unchanged";
-		const fields = new Set(releasedRecords.map((r) => topLevelField(r.plan)));
-		if (sameSet(fields, this.withheld.get(cap) ?? NO_FIELDS)) return "unchanged";
-		let failed;
-		try {
-			const outcome = withhold.call(this.deps.target, cap, [...fields].toSorted());
-			failed = outcome.ok ? null : {
-				kind: "refused",
-				error: outcome.error
-			};
-		} catch (error) {
-			failed = {
-				kind: "threw",
-				error: errorText(error)
-			};
-		}
-		if (failed !== null) {
-			this.markPending(cap, this.seeded.has(cap) ? "patch" : "seed", failed);
-			return "failed";
-		}
-		this.withheld = new Map([...this.withheld.entries()].filter(([c]) => c !== cap).concat(fields.size === 0 ? [] : [[cap, fields]]));
-		return "changed";
+function strictFiniteAdvance(previous, next) {
+	return typeof next === "number" && Number.isFinite(next) && (previous === null || next > previous);
+}
+/** The record key an own read is answered from; null when `read` is a source's. */
+function ownKeyOf(host, read) {
+	if (host.isOwnRead === void 0 || !host.isOwnRead(read)) return null;
+	const key = `${read.cap}.${read.fieldPath}`;
+	return host.records().has(key) ? key : null;
+}
+/**
+* `keys`, derived before accumulators, then — in the same pass — every
+* derived/accumulator field that reads an own field that changed. Bounded by
+* the record count: the validator refuses a cycle, so a chain is at most that
+* long (D6).
+*/
+function evaluateWithOwnReaders(host, keys, now) {
+	const changed = /* @__PURE__ */ new Set();
+	const valueCaps = /* @__PURE__ */ new Set();
+	let round = orderForEvaluation(keys, host.records());
+	for (let hop = 0; round.length > 0 && hop <= host.records().size; hop++) {
+		const delta = evaluateFields(host, round, now);
+		for (const k of delta.keys) changed.add(k);
+		for (const c of delta.valueCaps) valueCaps.add(c);
+		round = orderForEvaluation([...host.records().values()].filter((r) => (r.plan.role === "derived" || r.plan.role === "accumulator") && r.plan.reads.some((read) => {
+			const own = ownKeyOf(host, read);
+			return own !== null && delta.keys.has(own);
+		})).map((r) => fieldKey(r.plan)), host.records());
 	}
-	/** One info line per field per direction, never one per pass. */
-	logReleaseTransitions(cap, records) {
-		const now = new Set(records.filter(isReleased).map((r) => fieldKey(r.plan)));
-		const before = new Set(records.filter((r) => this.released.has(fieldKey(r.plan))).map((r) => fieldKey(r.plan)));
-		for (const r of records) {
-			const key = fieldKey(r.plan);
-			const direction = now.has(key) && !before.has(key) ? "released" : !now.has(key) && before.has(key) ? "reclaimed" : null;
-			if (direction === null) continue;
-			const flaps = (this.releaseFlaps.get(key) ?? 0) + (direction === "released" ? 1 : 0);
-			this.releaseFlaps = new Map([...this.releaseFlaps, [key, flaps]]);
-			this.deps.logger.info(direction === "released" ? "composed field released to the native provider — its source is unavailable" : "composed field reclaimed from the native provider — its source is back", {
-				tags: { deviceId: this.deps.target.id },
-				meta: {
-					blockId: this.deps.blockId,
-					cap,
-					field: fieldPath(r.plan),
-					direction,
-					reason: reasonOf(r.outcome) ?? "value available again",
-					flaps
+	return {
+		keys: changed,
+		valueCaps
+	};
+}
+/** Evaluate `keys` in order against the records in progress; commit whatever was evaluated, even on a throw. */
+function evaluateFields(host, keys, now) {
+	const changed = /* @__PURE__ */ new Set();
+	const valueCaps = /* @__PURE__ */ new Set();
+	const next = new Map(host.records());
+	const read = (r) => {
+		const own = ownKeyOf(host, r);
+		return own === null ? host.read(r) : ownFieldReading(next, own);
+	};
+	try {
+		for (const key of keys) {
+			const record = next.get(key);
+			if (record === void 0) continue;
+			const candidateMemory = cloneStatefulExpressionMemory(record.expressionMemory);
+			const outcome = evaluateCompositionField({
+				source: record.plan.source,
+				read,
+				now,
+				stateful: {
+					currentOutput: currentOutput(record),
+					expressionMemory: candidateMemory,
+					startedAtMs: host.startedAtMs,
+					callPathPrefix: fieldKey(record.plan)
 				}
 			});
+			const expressionSucceeded = outcome.state !== "unavailable";
+			let evaluated = {
+				...record,
+				outcome,
+				...expressionSucceeded ? { expressionMemory: candidateMemory } : {}
+			};
+			const eventPlans = host.eventPlans.filter((eventPlan) => eventPlan.fieldKey === fieldKey(record.plan));
+			if (expressionSucceeded && eventPlans.length > 0 && strictFiniteAdvance(record.eventHighWater, outcome.value)) {
+				const timestamp = outcome.value;
+				evaluated = {
+					...evaluated,
+					eventHighWater: timestamp
+				};
+				next.set(key, evaluated);
+				host.commit(next);
+				for (const eventPlan of eventPlans) host.emit(eventPlan, timestamp);
+			} else next.set(key, evaluated);
+			if (sameOutcome(record.outcome, outcome)) continue;
+			if (record.outcome?.state !== outcome.state) host.logTransition(record, outcome);
+			if (valueOf(record.outcome) !== valueOf(outcome)) valueCaps.add(record.plan.cap);
+			changed.add(key);
 		}
-		this.released = new Set([...[...this.released].filter((k) => !before.has(k)), ...now]);
-	}
-	seedCap(cap) {
-		const records = this.recordsOf(cap);
-		const missing = records.filter((r) => (r.plan.required || isHeld(r)) && writable(r) === void 0 && !isReleased(r)).map((r) => fieldPath(r.plan));
-		if (missing.length > 0) return this.holdBackSeed(cap, missing);
-		this.heldBack = new Set([...this.heldBack].filter((c) => c !== cap));
-		const entries = this.entriesFor(cap, records);
-		if (!this.write(cap, "seed", entries)) return;
-		this.seeded = new Set([...this.seeded, cap]);
-		this.markWritten(cap, entries);
-	}
-	patchCap(cap, touched) {
-		const entries = this.entriesFor(cap, this.recordsOf(cap).filter((r) => touched.has(fieldKey(r.plan)) && (!r.hasWritten || writable(r) !== r.written)));
-		if (entries.length === 0) return;
-		if (this.write(cap, "patch", entries)) this.markWritten(cap, entries);
+	} finally {
+		host.commit(next);
 	}
-	/**
-	* After a failed write nothing is known about what landed, and after a
-	* changed withhold the claim must be re-stated: send every current value.
-	* `afterWithhold` with nothing left to write means the cap was released
-	* whole — a pending write is moot then, not retried (M-2).
-	*/
-	patchWholeCap(cap, afterWithhold = false) {
-		const entries = this.entriesFor(cap, this.recordsOf(cap));
-		if (entries.length === 0) {
-			if (afterWithhold && this.pending.has(cap)) this.dropPending(cap);
-			return;
+	return {
+		keys: changed,
+		valueCaps
+	};
+}
+/** Emit one state-derived event; a delivery failure is logged, never thrown (D670). */
+function emitStateDerivedEvent(ctx, plan, timestamp) {
+	const extras = {
+		tags: { deviceId: ctx.deviceId },
+		meta: {
+			blockId: ctx.blockId,
+			cap: plan.cap,
+			eventName: plan.eventName,
+			category: plan.category,
+			timestamp
 		}
-		if (this.write(cap, "patch", entries)) this.markWritten(cap, entries);
-	}
-	dropPending(cap) {
-		this.pending = new Map([...this.pending].filter(([c]) => c !== cap));
-		this.deps.logger.info("composed capability released whole — its pending write is moot, nothing is left to write", {
-			tags: { deviceId: this.deps.target.id },
+	};
+	try {
+		if (plan.category !== EventCategory.DoorbellOnPressed) throw new Error(`unsupported state-derived event category \`${plan.category}\``);
+		const event = createEvent(EventCategory.DoorbellOnPressed, {
+			type: "device",
+			id: ctx.deviceId,
+			deviceId: ctx.deviceId
+		}, {
+			deviceId: ctx.deviceId,
+			timestamp
+		});
+		ctx.events.emit(event);
+		ctx.logger.debug("composition: state-derived event emitted", extras);
+	} catch (error) {
+		ctx.logger.warn("composition: state-derived event delivery failed", {
+			...extras,
 			meta: {
-				blockId: this.deps.blockId,
-				cap
+				...extras.meta,
+				error: errorText(error)
 			}
 		});
 	}
-	/**
-	* What one write of `cap` carries: the writable `candidates` — and, when any
-	* of them is an item leaf, EVERY item leaf of the cap, because the array is
-	* written whole (a patch of `items` replaces it). A required item leaf with
-	* no value holds the whole array (its top-level siblings still go out).
-	*/
-	entriesFor(cap, candidates) {
-		const top = candidates.filter((r) => r.plan.item === void 0);
-		if (!candidates.some((r) => r.plan.item !== void 0)) return this.writableEntries(top);
-		const items = this.recordsOf(cap).filter((r) => r.plan.item !== void 0);
-		const missing = items.filter((r) => r.plan.required && writable(r) === void 0).map((r) => fieldPath(r.plan));
-		if (missing.length > 0) {
-			this.holdItems(cap, missing);
-			return this.writableEntries(top);
-		}
-		this.itemsHeld = new Set([...this.itemsHeld].filter((c) => c !== cap));
-		return this.writableEntries([...top, ...items]);
-	}
-	writableEntries(records) {
-		return records.flatMap((r) => {
-			const value = writable(r);
-			return value === void 0 ? [] : [{
-				plan: r.plan,
-				value
-			}];
+}
+//#endregion
+//#region src/builtins/composer/slice-assembler.ts
+/**
+* From the runtime's flat field values to the slice a target takes (D663).
+*
+* A top-level field is written under its path. An item leaf
+* (`consumables.items[desiccant].remaining.value`) is one entry of an ARRAY:
+* every leaf of one item is grouped by `(cap, arrayPath, key)` and set, by
+* path segment, onto the cap's OWN `status.itemArray.emptyItem` — so an
+* unsourced nullable leaf is `null` because the cap says so, not because this
+* module guessed. The key, the label and {@link COMPOSED_ITEM_FIXED_FIELDS}
+* are the composer's; items are sorted by key so two writes of the same
+* values are one slice.
+*
+* A cap the lookup does not know as an item array cannot be assembled: that
+* is thrown by name, and the runtime's write path turns a throw into a named,
+* retried failure — never a half-built array.
+*/
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** `setPath(item, ['remaining', 'value'], 0)` → `{ ...item, remaining: { ...item.remaining, value: 0 } }`. */
+function setPath(record, segments, value) {
+	const [head, ...rest] = segments;
+	if (head === void 0) return record;
+	if (rest.length === 0) return {
+		...record,
+		[head]: value
+	};
+	const current = record[head];
+	return {
+		...record,
+		[head]: setPath(isRecord(current) ? current : {}, rest, value)
+	};
+}
+function itemArrayOf(group, lookupCap) {
+	const itemArray = lookupCap(group.cap)?.status?.itemArray;
+	if (itemArray === void 0 || itemArray.path !== group.arrayPath) throw new Error(`\`${group.cap}\` has no item array at \`${group.arrayPath}\` — \`${compositionItemFieldPath(group.arrayPath, group.key, "*")}\` cannot be assembled`);
+	return itemArray;
+}
+function assembleItem(group, lookupCap) {
+	const itemArray = itemArrayOf(group, lookupCap);
+	const base = {
+		...itemArray.emptyItem,
+		[itemArray.keyField]: group.key,
+		...itemArray.labelField === void 0 ? {} : { [itemArray.labelField]: group.label },
+		...COMPOSED_ITEM_FIXED_FIELDS
+	};
+	return group.leaves.reduce((item, leaf) => setPath(item, leaf.plan.path.split("."), leaf.value), base);
+}
+function groupItems(entries) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const entry of entries) {
+		const item = entry.plan.item;
+		if (item === void 0) continue;
+		const id = `${entry.plan.cap}\u0000${item.arrayPath}\u0000${item.key}`;
+		const group = groups.get(id) ?? {
+			cap: entry.plan.cap,
+			arrayPath: item.arrayPath,
+			key: item.key,
+			label: item.label,
+			leaves: []
+		};
+		groups.set(id, {
+			...group,
+			leaves: [...group.leaves, entry]
 		});
 	}
-	holdItems(cap, missing) {
-		if (this.itemsHeld.has(cap)) return;
-		this.itemsHeld = new Set([...this.itemsHeld, cap]);
-		this.deps.logger.warn("composed items held — a required item field has no value; the array is not written until it does", {
-			tags: { deviceId: this.deps.target.id },
-			meta: {
-				blockId: this.deps.blockId,
-				cap,
-				missing
-			}
-		});
+	return [...groups.values()];
+}
+function compareKeys(a, b) {
+	return a < b ? -1 : a > b ? 1 : 0;
+}
+function assembleSlice(entries, lookupCap) {
+	const top = Object.fromEntries(entries.filter((e) => e.plan.item === void 0).map((e) => [e.plan.path, e.value]));
+	const groups = groupItems(entries);
+	const arrays = [...new Set(groups.map((g) => g.arrayPath))].map((arrayPath) => [arrayPath, groups.filter((g) => g.arrayPath === arrayPath).toSorted((a, b) => compareKeys(a.key, b.key)).map((g) => assembleItem(g, lookupCap))]);
+	return {
+		...top,
+		...Object.fromEntries(arrays)
+	};
+}
+//#endregion
+//#region src/builtins/composer/composition-runtime.ts
+/**
+* One running composition: per-field state, writes to the composed device, and
+* one deadline timer (D659).
+*
+* - Only the fields a change affects are recomputed.
+* - A cap is SEEDED once (`setCapState`, every required field present), then
+*   PATCHED (`patchCapState` merges; the runtime-state twin of "`setAll`
+*   already merges").
+* - Unavailable is per field. A nullable field is written `null`; a
+*   non-nullable one is not written and the device goes offline (D393).
+* - A `clock` field (`now` only) is recomputed when a sibling of its cap
+*   changes value, so `binary.lastChangedAt` is the last transition. A
+*   `constant` is computed once.
+* - A windowed expression reports when it flips; ONE timer at the earliest
+*   such instant. It waits for no source (D3). Every evaluation is STORED, so
+*   a deadline that moved reaches the timer even when the value did not: an
+*   unstored deadline fires early, re-evaluates to "same", and re-arms
+*   `setTimeout(0)` until the real window closes — a poll (R1).
+* - A fatal (source gone) outcome is the block's failure, and it is sticky:
+*   the device stays offline until a new runtime, created on an operator edit
+*   or restart, clears it.
+* - A write the target REFUSES or THROWS on leaves the evaluated outcomes
+*   alone and marks its cap write-pending: the next pass that evaluates any
+*   field of that cap, and every deadline pass, re-writes the WHOLE current
+*   slice (a seed if it was never seeded). No retry timer — the next source
+*   event or deadline is the retry (D3). One log line per failure transition.
+* - Nothing escapes: a pass that throws is logged, and the timer is re-armed
+*   from the stored deadlines regardless.
+* - `stop()` is terminal: every entry point is a no-op afterwards.
+*
+* Slice 2 (D663):
+* - Records are keyed by `compositionFieldKey`: two items' `status` are two
+*   records. An item-array cap is written WHOLE — a change to one item leaf
+*   re-sends every item, assembled by `assembleSlice` on the cap's `emptyItem`.
+*   A required item leaf with no fallback holds the array, named once.
+* - `'unknown'` unavailable mode writes the enum's own word.
+* - `'release'` unavailable mode hands the field BACK (ruling S1b): the target
+*   is told to `withhold` it, the field's record forgets what it wrote, and the
+*   source returning re-widens and writes it again. Stale is a value (D49),
+*   never a release — and neither is an UNCONFIRMED unavailability (a failed,
+*   first or empty read): the field is HELD on its last value, not written,
+*   not withheld, its claim kept, until the source answers (D49, fix round 2).
+*   `state().released` / `state().held` name every such field for the report.
+* - A target whose writes are asynchronous (claims on the hub) reports what did
+*   not land through `onAsyncFailure`: the cap is marked write-pending by name
+*   and re-written whole on the next pass — no retry timer (D3).
+*
+* Slice 2b (D670): evaluation — stateful memory, state-derived events before
+* their write, and reads of the composition's OWN fields answered from the
+* records rather than the hub (D670 amendment) — is `composition-evaluation.ts`.
+* Neither an event-bus failure nor a refused write can replay an event, and the
+* hub's echo of the runtime's own write re-runs nothing.
+*/
+/**
+* A refusal nothing on this side can retry away: another owner holds the
+* field, the slice is invalid for the cap, the device is not known. Every
+* other outcome — a throw, an unreadable row, a migration in flight, a lost
+* claim — is transient and retried on the next pass (D6: bounded, never a loop).
+*/
+var TERMINAL_REFUSALS = new Set([
+	"owned-by-other",
+	"invalid-slice",
+	"unknown-device"
+]);
+var CompositionRuntime = class {
+	deps;
+	records;
+	startedAtMs;
+	seeded = /* @__PURE__ */ new Set();
+	available = null;
+	failure = null;
+	disabledReason = null;
+	stopped = false;
+	/** The last `pass threw` logged (`during: message`); cleared by a pass that completes. */
+	lastPassError = null;
+	pending = /* @__PURE__ */ new Map();
+	heldBack = /* @__PURE__ */ new Set();
+	/** Caps whose item array is not written because a required leaf has no value. */
+	itemsHeld = /* @__PURE__ */ new Set();
+	/** Record keys currently released (S1b), for transition logs and the report. */
+	released = /* @__PURE__ */ new Set();
+	/** Per cap, the top-level fields the target last accepted as withheld; absent = none. */
+	withheld = /* @__PURE__ */ new Map();
+	/** Per record key, how many times the field has been released — churn the transition line reports (D391). */
+	releaseFlaps = /* @__PURE__ */ new Map();
+	/** Caps the target refused for good (`TERMINAL_REFUSALS`): never written again by this runtime. */
+	terminal = /* @__PURE__ */ new Map();
+	/** What `composition-evaluation.ts` reads and commits through. */
+	evaluation;
+	constructor(deps) {
+		this.deps = deps;
+		this.startedAtMs = deps.now();
+		this.records = new Map(deps.fields.map((plan) => [fieldKey(plan), createFieldRecord(plan, deps.initialByCap, deps.lookupCap)]));
+		deps.target.onAsyncFailure?.((cap, failure) => this.onTargetWriteFailed(cap, failure));
+		const eventContext = {
+			deviceId: deps.target.id,
+			blockId: deps.blockId,
+			events: deps.events,
+			logger: deps.logger
+		};
+		this.evaluation = {
+			records: () => this.records,
+			commit: (records) => {
+				this.records = records;
+			},
+			read: deps.read,
+			...deps.isOwnRead === void 0 ? {} : { isOwnRead: deps.isOwnRead },
+			eventPlans: deps.eventPlans,
+			startedAtMs: this.startedAtMs,
+			emit: (plan, timestamp) => emitStateDerivedEvent(eventContext, plan, timestamp),
+			logTransition: (record, outcome) => this.logTransition(record, outcome)
+		};
+	}
+	start() {
+		if (this.disabledReason !== null) return;
+		this.guarded("start", true, () => this.pass([...this.records.keys()], "start"));
 	}
-	holdBackSeed(cap, missing) {
-		if (this.heldBack.has(cap)) return;
-		this.heldBack = new Set([...this.heldBack, cap]);
-		this.deps.logger.warn("composed capability not seeded yet — a required field has no value", {
-			tags: { deviceId: this.deps.target.id },
-			meta: {
-				blockId: this.deps.blockId,
-				cap,
-				missing
-			}
+	onSourcesChanged(sliceKeys) {
+		if (this.disabledReason !== null) return;
+		this.guarded("source", true, () => {
+			const affected = [...this.records.values()].filter((r) => r.plan.reads.some((read) => ownKeyOf(this.evaluation, read) === null && sliceKeys.has(compositionSliceKey(read.source, read.cap)))).map((r) => fieldKey(r.plan));
+			if (affected.length > 0) this.pass(affected, "source");
 		});
 	}
-	/** One write. A refusal or a throw marks the cap write-pending; true when the target took it. */
-	write(cap, op, entries) {
-		let failed;
-		try {
-			const values = assembleSlice(entries, this.deps.lookupCap);
-			const outcome = op === "seed" ? this.deps.target.seed(cap, values) : this.deps.target.patch(cap, values);
-			failed = outcome.ok ? null : {
-				kind: "refused",
-				error: outcome.error
-			};
-		} catch (error) {
-			failed = {
-				kind: "threw",
-				error: errorText(error)
+	disable(reason) {
+		if (this.stopped) return;
+		this.disabledReason = reason;
+		this.deps.timer.disarm();
+		this.guarded("disable", false, () => {
+			const outcome = {
+				state: "unavailable",
+				value: null,
+				reason,
+				fatal: false,
+				confirmed: true
 			};
-		}
-		if (failed === null) {
-			this.clearPending(cap);
-			return true;
-		}
-		this.markPending(cap, op, failed);
-		return false;
-	}
-	clearPending(cap) {
-		if (!this.pending.has(cap)) return;
-		this.pending = new Map([...this.pending].filter(([c]) => c !== cap));
-		this.deps.logger.info("composed capability written again after a failed write", {
-			tags: { deviceId: this.deps.target.id },
-			meta: {
-				blockId: this.deps.blockId,
-				cap
-			}
-		});
-	}
-	markPending(cap, op, failed) {
-		const wasPending = this.pending.has(cap);
-		this.pending = new Map([...this.pending, [cap, failed]]);
-		if (wasPending) return;
-		const message = failed.kind === "refused" ? "composed capability refused a write — its whole slice is re-written on the next pass that evaluates it" : "composed capability write threw — its whole slice is re-written on the next pass that evaluates it";
-		this.deps.logger.warn(message, {
-			tags: { deviceId: this.deps.target.id },
-			meta: {
-				blockId: this.deps.blockId,
-				cap,
-				op,
-				error: failed.error
-			}
+			const touched = [...this.records.values()].filter((r) => !isFatal(r.outcome) && !sameOutcome(r.outcome, outcome));
+			for (const r of touched) this.logTransition(r, outcome);
+			this.records = new Map([...this.records].map(([k, r]) => [k, isFatal(r.outcome) ? r : {
+				...r,
+				outcome
+			}]));
+			this.writeCaps(new Set(touched.map((r) => fieldKey(r.plan))), /* @__PURE__ */ new Set());
+			this.updateAvailability();
 		});
 	}
-	markWritten(cap, entries) {
-		const written = new Map(entries.map((e) => [fieldKey(e.plan), e.value]));
-		this.records = new Map([...this.records].map(([k, r]) => r.plan.cap === cap && written.has(k) ? [k, {
-			...r,
-			hasWritten: true,
-			written: written.get(k)
-		}] : [k, r]));
+	/** Terminal: no write, no evaluation and no timer after this. */
+	stop() {
+		this.stopped = true;
+		this.deps.timer.disarm();
 	}
-	updateAvailability() {
-		const blocking = [...this.records.values()].filter((r) => r.plan.unavailable === "offline" && r.outcome?.state === "unavailable").map((r) => fieldKey(r.plan));
-		const unseeded = [...new Set(this.deps.fields.map((f) => f.cap))].filter((c) => !this.seeded.has(c));
-		const writePending = [...this.pending.keys()];
-		const available = this.disabledReason === null && this.failure === null && blocking.length === 0 && unseeded.length === 0 && writePending.length === 0;
-		if (available === this.available) return;
-		this.deps.target.setAvailable(available);
-		this.available = available;
-		const extras = {
-			tags: { deviceId: this.deps.target.id },
-			meta: {
-				blockId: this.deps.blockId,
-				blocking,
-				unseeded,
-				writePending,
-				failure: this.failure,
-				disabled: this.disabledReason
-			}
+	state() {
+		return {
+			failure: this.failure,
+			available: this.available === true,
+			fields: [...this.records.values()].map((r) => {
+				const terminal = this.terminal.get(r.plan.cap);
+				if (terminal !== void 0 && !isFatal(r.outcome)) return {
+					cap: r.plan.cap,
+					path: r.plan.path,
+					...itemOf(r.plan),
+					state: "unavailable",
+					value: null,
+					reason: terminal
+				};
+				const pending = this.pending.get(r.plan.cap);
+				if (pending !== void 0 && !isFatal(r.outcome)) return {
+					cap: r.plan.cap,
+					path: r.plan.path,
+					...itemOf(r.plan),
+					state: "unavailable",
+					value: null,
+					reason: pendingReason(r.plan.cap, pending)
+				};
+				const value = valueOf(r.outcome);
+				const reason = reasonOf(r.outcome);
+				return {
+					cap: r.plan.cap,
+					path: r.plan.path,
+					...itemOf(r.plan),
+					state: r.outcome?.state ?? "unavailable",
+					value: value === void 0 ? null : value,
+					...reason === null ? {} : { reason }
+				};
+			}),
+			released: [...this.records.values()].filter(isReleased).map(namedField),
+			held: [...this.records.values()].filter(isHeld).map(namedField)
 		};
-		if (available) this.deps.logger.info("composed device available", extras);
-		else this.deps.logger.warn("composed device unavailable — a field has no value, a write is pending, or the block failed", extras);
 	}
-	updateFailure() {
-		if (this.failure !== null) return;
-		const fatal = [...this.records.values()].find((r) => r.outcome?.state === "unavailable" && r.outcome.fatal);
-		if (fatal === void 0 || fatal.outcome === null || fatal.outcome.state !== "unavailable") return;
-		this.failure = `source missing — ${fatal.outcome.reason}`;
-		this.deps.logger.error("composition failed: a source is gone — only the operator ends this (repair the source, edit or delete the block)", {
-			tags: { deviceId: this.deps.target.id },
-			meta: {
-				blockId: this.deps.blockId,
-				field: fieldKey(fatal.plan),
-				reason: fatal.outcome.reason
+	/**
+	* The target's enqueued write of `cap` did not land: the cap is write-pending
+	* by name and re-written WHOLE on the next pass that evaluates it (or the next
+	* deadline pass). A withhold sent to that target is forgotten too, so it is
+	* re-sent. No retry timer (D3).
+	*/
+	onTargetWriteFailed(cap, failure) {
+		this.guarded("target-failure", false, () => {
+			if (!this.deps.fields.some((f) => f.cap === cap) || this.terminal.has(cap)) return;
+			if (failure.kind === "refused" && TERMINAL_REFUSALS.has(failure.code)) {
+				this.markTerminal(cap, failure.code, failure.message);
+				return;
 			}
+			this.withheld = new Map([...this.withheld].filter(([c]) => c !== cap));
+			this.markPending(cap, this.seeded.has(cap) ? "patch" : "seed", failure.kind === "threw" ? {
+				kind: "threw",
+				error: failure.error
+			} : {
+				kind: "refused",
+				error: `${failure.code}: ${failure.message}`
+			});
+			this.updateAvailability();
 		});
 	}
-	/** `after`: arm only deadlines later than this instant; null arms the earliest stored one. */
-	armDeadline(after) {
-		const deadlines = [...this.records.values()].flatMap((r) => r.outcome !== null && r.outcome.state !== "unavailable" && r.outcome.deadline !== null && (after === null || r.outcome.deadline > after) ? [r.outcome.deadline] : []);
-		if (deadlines.length === 0) {
-			this.deps.timer.disarm();
-			return;
-		}
-		this.deps.timer.arm(Math.min(...deadlines), () => this.onDeadline());
-	}
-	onDeadline() {
-		this.guarded("deadline", true, () => {
-			const now = this.deps.now();
-			const due = [...this.records.values()].filter((r) => r.outcome !== null && r.outcome.state !== "unavailable" && r.outcome.deadline !== null && r.outcome.deadline <= now).map((r) => fieldKey(r.plan));
-			if (due.length > 0) this.pass(due, "deadline");
-		});
-	}
-	logTransition(record, outcome) {
-		const from = record.outcome?.state ?? "pending";
-		if (from === "pending" && outcome.state === "fresh") return;
-		const extras = {
+	/**
+	* The target refused this cap for good: nothing on this side can retry it
+	* away (I-3). The cap is never written again by this runtime, its fields
+	* report the refusal, and the block fails naming it — only the operator ends
+	* this (edit or delete the block, or the competing one), like a gone source.
+	*/
+	markTerminal(cap, code, message) {
+		const reason = `the \`${cap}\` capability was refused for good: ${code}: ${message} — only the operator ends this (edit or delete the block)`;
+		this.terminal = new Map([...this.terminal, [cap, reason]]);
+		this.pending = new Map([...this.pending].filter(([c]) => c !== cap));
+		if (this.failure === null) this.failure = `composed write refused for good — ${cap}: ${code}: ${message}`;
+		this.deps.logger.error("composed capability refused for good — it is not written again until the operator edits or deletes the block", {
 			tags: { deviceId: this.deps.target.id },
 			meta: {
 				blockId: this.deps.blockId,
-				cap: record.plan.cap,
-				field: record.plan.path,
-				from,
-				to: outcome.state,
-				reason: reasonOf(outcome)
+				cap,
+				code,
+				error: message
 			}
-		};
-		const message = `composed field ${fieldKey(record.plan)}: ${from} → ${outcome.state}`;
-		if (outcome.state === "fresh") this.deps.logger.info(message, extras);
-		else this.deps.logger.warn(message, extras);
-	}
-};
-//#endregion
-//#region src/builtins/composer/confirmed-seed.ts
-var ConfirmedSeed = class {
-	deps;
-	seeded = false;
-	/** The previous read answered `[]`: one more `[]` confirms it (D49). */
-	emptySeen = false;
-	/** Consecutive applies whose read did not answer: warned once per run. */
-	waitApplies = 0;
-	constructor(deps) {
-		this.deps = deps;
-	}
-	get done() {
-		return this.seeded;
+		});
+		this.updateAvailability();
 	}
-	/** Null once seeded, else why this apply must wait. */
-	async ensure() {
-		if (this.seeded) return null;
-		const read = await this.deps.read();
-		if (read.kind === "unknown") {
-			this.emptySeen = false;
-			this.waitApplies += 1;
-			if (this.waitApplies === 1) this.deps.logger.warn(`composer: the ${this.deps.subject} could not be read — nothing is declared, withdrawn, claimed or released from them; retried on the next apply`, { meta: {
-				subject: this.deps.subject,
-				error: read.error
-			} });
-			return this.deps.unreadReason;
-		}
-		if (read.items.length === 0 && !this.emptySeen) {
-			this.emptySeen = true;
-			this.deps.logger.warn(`composer: the ${this.deps.subject} read empty — waiting for the next apply's read to agree before trusting it`, { meta: { subject: this.deps.subject } });
-			return this.deps.emptyUnconfirmedReason;
+	/**
+	* Every entry point runs here: a no-op once stopped, nothing thrown escapes,
+	* and the one timer is re-armed from the stored deadlines whatever happened.
+	*/
+	guarded(during, rearm, body) {
+		if (this.stopped) return;
+		let threw = false;
+		try {
+			body();
+			this.lastPassError = null;
+		} catch (error) {
+			threw = true;
+			this.logPassError(during, errorText(error));
+		} finally {
+			if (rearm && !this.stopped && this.disabledReason === null) this.armDeadline(threw ? this.deps.now() : null);
 		}
-		this.deps.onSeeded(read.items);
-		this.seeded = true;
-		this.deps.logger.info(`composer: seeded from the ${this.deps.subject}`, { meta: {
-			subject: this.deps.subject,
-			items: read.items.length,
-			confirmedEmpty: read.items.length === 0,
-			appliesRefused: this.waitApplies
-		} });
-		return null;
 	}
-};
-//#endregion
-//#region src/builtins/composer/existing-target.ts
-/**
-* What the composer needs to run a composition on an EXISTING device (D663)
-* besides the runtime and the claim-backed target: the target's description,
-* the claim shapes derived from the plan, and the block report's words.
-*
-* - The target is DESCRIBED (bound caps → native addon, row type) with ONE
-*   `getBindings` per plan change, cached until `device.bindings-changed` for
-*   that device. A read that fails keeps the previous description; with none,
-*   the block waits and nothing is claimed (D49).
-* - A claim's field set is the PLAN's (S5): the top-level fields of the cap, an
-*   item leaf contributing its whole array. Its mode is the feature's.
-* - A self-read of the target (rule 6) is served from the NATIVE view unless it
-*   reads an ADDED cap — that is the composition's own output. Whether a native
-*   cap's `device.state-changed` is the native or the composition's own merge
-*   is NOT decided here from the plan: it follows whether the claim has landed
-*   (`HeldClaims`, C-1).
-*/
-/**
-* Review M3: an ADDED `restored` cap seeded from NOTHING says so, once per
-* runtime build, on its device. After a restart its state comes from the
-* target's runtime-state row; a row that lost the slice (D677: 615's doorbell,
-* dropped at a hub boot) used to surface as "not seeded yet" and now seeds a
-* clean `{ null, 0 }` — a lifetime count silently reset unless this line
-* names it. A first composition of a device that never had the slice logs it
-* too: the line cannot tell the two apart, and says both.
-*/
-function reportSeedlessRestoredCaps(input) {
-	for (const cap of addedCapsOf(input.features)) {
-		if (input.lookupCap(cap)?.durability !== "restored") continue;
-		if ((input.seed.byCap.get(cap) ?? null) !== null) continue;
-		input.logger.info("composed restored capability seeded from nothing — the target had no slice for it (a first composition, or a lost runtime-state row)", {
-			tags: { deviceId: input.deviceId },
+	/** Once per distinct failure, not once per pass: a reader that keeps throwing logs one line. */
+	logPassError(during, error) {
+		const key = `${during}: ${error}`;
+		if (key === this.lastPassError) return;
+		this.lastPassError = key;
+		this.deps.logger.error("composition pass threw — the runtime keeps running; the next source event or deadline re-runs it", {
+			tags: { deviceId: this.deps.target.id },
 			meta: {
-				blockId: input.blockId,
-				cap,
-				seededFrom: "none"
+				blockId: this.deps.blockId,
+				during,
+				error
 			}
 		});
 	}
-}
-/**
-* Read every affected effective capability exactly once, before the composer
-* grafts or claims any of them. A null slice is a successful empty seed; a
-* rejection is deliberately left to the caller so ownership cannot begin.
-*/
-async function readExistingTargetSeeds(targetDeviceId, caps, read) {
-	const byCap = /* @__PURE__ */ new Map();
-	for (const cap of new Set(caps)) byCap.set(cap, await read(targetDeviceId, cap));
-	return { byCap };
-}
-/** The reason every ungraft of a gone target carries (Task 9 rule 5 / Task 10 rule 2). */
-var TARGET_GONE_UNGRAFT_REASON = "target device gone";
-/**
-* Rule 5, on either path that finds the target gone (`device.unregistered`, or
-* a later plan when that event was dropped): ungraft every cap the block ADDED
-* on that id, with the one ERROR that says so.
-*/
-function ungraftGoneTarget(input) {
-	const { grafts, deviceId } = input;
-	const added = addedCapsOf(input.features);
-	for (const cap of added) grafts?.ungraft(deviceId, cap, TARGET_GONE_UNGRAFT_REASON);
-	input.logger.error("customization target device is gone — the block failed and its grafts are removed; only the operator ends this (edit or restart the block)", {
-		tags: { deviceId },
-		meta: {
-			blockId: input.blockId,
-			target: compositionSourceKey(input.ref),
-			ungrafted: added,
-			graftHost: grafts !== void 0
-		}
-	});
-}
-var TargetDescriptions = class {
-	logger;
-	readBoundCaps;
-	cache = /* @__PURE__ */ new Map();
-	constructor(logger, readBoundCaps) {
-		this.logger = logger;
-		this.readBoundCaps = readBoundCaps;
+	pass(keys, trigger) {
+		const initial = trigger === "start";
+		const now = this.deps.now();
+		const calculated = evaluateWithOwnReaders(this.evaluation, keys.filter((k) => {
+			const role = this.records.get(k)?.plan.role;
+			return role === "derived" || role === "accumulator";
+		}), now);
+		const followers = [...this.records.values()].filter((r) => r.plan.role === "clock" ? initial || calculated.valueCaps.has(r.plan.cap) : r.plan.role === "constant" && initial).map((r) => fieldKey(r.plan));
+		const extra = evaluateFields(this.evaluation, followers, now);
+		const evaluatedCaps = new Set([...keys, ...followers].flatMap((k) => {
+			const cap = this.records.get(k)?.plan.cap;
+			return cap === void 0 ? [] : [cap];
+		}));
+		const retry = new Set([...this.pending.keys()].filter((cap) => trigger === "deadline" || evaluatedCaps.has(cap)));
+		this.writeCaps(new Set([...calculated.keys, ...extra.keys]), retry);
+		this.updateFailure();
+		this.updateAvailability();
 	}
-	/** `device.bindings-changed` for this device: the next read is a real read. */
-	invalidate(deviceId) {
-		this.cache = new Map([...this.cache].filter(([, d]) => d.deviceId !== deviceId));
+	recordsOf(cap) {
+		return [...this.records.values()].filter((r) => r.plan.cap === cap);
+	}
+	/** `retry`: write-pending caps this pass re-writes WHOLE, whether or not a value changed. */
+	writeCaps(touched, retry) {
+		const caps = new Set([...[...touched].flatMap((k) => {
+			const cap = this.records.get(k)?.plan.cap;
+			return cap === void 0 ? [] : [cap];
+		}), ...retry]);
+		for (const cap of caps) {
+			if (this.terminal.has(cap)) continue;
+			const sync = this.syncReleased(cap);
+			if (sync === "failed") continue;
+			if (!this.seeded.has(cap)) this.seedCap(cap);
+			else if (this.pending.has(cap) || sync === "changed") this.patchWholeCap(cap, sync === "changed");
+			else this.patchCap(cap, touched);
+		}
 	}
 	/**
-	* The description of `ref`, resolved to `deviceId`. Served from the cache
-	* unless `force` (the block's plan changed) or nothing is cached. A read that
-	* fails keeps the previous description of the SAME device id, and answers
-	* null when there is none: the caller waits, and claims nothing.
+	* S1b: tell the target which fields of `cap` are released, when that set
+	* changed since it last accepted one. A released record forgets what it wrote,
+	* so the source returning writes it again. False when the target refused or
+	* threw: the cap is write-pending and the withhold is re-sent next pass.
 	*/
-	async describe(ref, deviceId, type, force) {
-		const key = compositionSourceKey(ref);
-		const cached = this.cache.get(key);
-		const previous = cached !== void 0 && cached.deviceId === deviceId ? cached : null;
-		if (!force && previous !== null) return previous;
-		const read = await this.readBoundCaps(deviceId);
-		if (read.kind === "unreadable") {
-			this.logger.warn(previous === null ? "customization target: its bindings could not be read — nothing is claimed until they are; retried on the next apply" : "customization target: its bindings could not be read — the previous description is kept", {
-				tags: { deviceId },
+	syncReleased(cap) {
+		const records = this.recordsOf(cap);
+		this.logReleaseTransitions(cap, records);
+		const releasedRecords = records.filter(isReleased);
+		this.records = new Map([...this.records].map(([k, r]) => releasedRecords.includes(r) && r.hasWritten ? [k, {
+			...r,
+			hasWritten: false,
+			written: void 0
+		}] : [k, r]));
+		const withhold = this.deps.target.withhold;
+		if (withhold === void 0) return "unchanged";
+		const fields = new Set(releasedRecords.map((r) => topLevelField(r.plan)));
+		if (sameSet(fields, this.withheld.get(cap) ?? NO_FIELDS)) return "unchanged";
+		let failed;
+		try {
+			const outcome = withhold.call(this.deps.target, cap, [...fields].toSorted());
+			failed = outcome.ok ? null : {
+				kind: "refused",
+				error: outcome.error
+			};
+		} catch (error) {
+			failed = {
+				kind: "threw",
+				error: errorText(error)
+			};
+		}
+		if (failed !== null) {
+			this.markPending(cap, this.seeded.has(cap) ? "patch" : "seed", failed);
+			return "failed";
+		}
+		this.withheld = new Map([...this.withheld.entries()].filter(([c]) => c !== cap).concat(fields.size === 0 ? [] : [[cap, fields]]));
+		return "changed";
+	}
+	/** One info line per field per direction, never one per pass. */
+	logReleaseTransitions(cap, records) {
+		const now = new Set(records.filter(isReleased).map((r) => fieldKey(r.plan)));
+		const before = new Set(records.filter((r) => this.released.has(fieldKey(r.plan))).map((r) => fieldKey(r.plan)));
+		for (const r of records) {
+			const key = fieldKey(r.plan);
+			const direction = now.has(key) && !before.has(key) ? "released" : !now.has(key) && before.has(key) ? "reclaimed" : null;
+			if (direction === null) continue;
+			const flaps = (this.releaseFlaps.get(key) ?? 0) + (direction === "released" ? 1 : 0);
+			this.releaseFlaps = new Map([...this.releaseFlaps, [key, flaps]]);
+			this.deps.logger.info(direction === "released" ? "composed field released to the native provider — its source is unavailable" : "composed field reclaimed from the native provider — its source is back", {
+				tags: { deviceId: this.deps.target.id },
 				meta: {
-					target: key,
-					error: read.error
+					blockId: this.deps.blockId,
+					cap,
+					field: fieldPath(r.plan),
+					direction,
+					reason: reasonOf(r.outcome) ?? "value available again",
+					flaps
 				}
 			});
-			return previous;
 		}
-		const found = {
-			kind: "found",
-			deviceId,
-			type,
-			nativeCaps: read.caps
-		};
-		this.cache = new Map([...this.cache, [key, found]]);
-		return found;
+		this.released = new Set([...[...this.released].filter((k) => !before.has(k)), ...now]);
 	}
-};
-/** The PLANNED field set a claim carries for `cap` (S5): an item leaf claims its whole array. */
-function claimFieldsOf(fields, cap) {
-	return [...new Set(fields.filter((f) => f.cap === cap).map((f) => f.item === void 0 ? f.path : f.item.arrayPath))];
-}
-/** The claim mode of `cap`: `replace` for a cap the device serves natively, else `add`. */
-function claimModeOf(features, cap) {
-	return features.find((f) => f.cap === cap)?.mode === "replace" ? "replace" : "add";
-}
-/** The caps a customization ADDS to its target — the ones it grafts a native for (Task 10). */
-function addedCapsOf(features) {
-	return features.filter((f) => f.mode === "add").map((f) => f.cap);
-}
-function selfReadCaps(fields, target, features) {
-	const targetKey = compositionSourceKey(target);
-	const read = new Set(fields.flatMap((f) => f.reads.filter((r) => compositionSourceKey(r.source) === targetKey).map((r) => r.cap)));
-	const added = new Set(addedCapsOf(features));
-	return {
-		effective: [...read].filter((cap) => added.has(cap)),
-		native: [...read].filter((cap) => !added.has(cap))
-	};
-}
-/** The `degraded` reason (rule 8): one entry per released field, the source's own reason after the dash. */
-function degradedReason(released) {
-	return released.map((r) => {
-		const path = r.item === void 0 ? r.path : compositionItemFieldPath(r.item.arrayPath, r.item.key, r.path);
-		return `released to the native provider: ${r.cap}.${path} — ${r.reason}`;
-	}).join("; ");
-}
-/** The `starting` reason of a block with HELD fields: each keeps its last value and claim until its source answers (D49). */
-function heldReason(held) {
-	return held.map((r) => {
-		const path = r.item === void 0 ? r.path : compositionItemFieldPath(r.item.arrayPath, r.item.key, r.path);
-		return `held on its last value until its source answers (D49): ${r.cap}.${path} — ${r.reason}`;
-	}).join("; ");
-}
-/**
-* Rule 4: a customization whose row exists but whose plan failed keeps its
-* claims, so its owned fields stay at their last value on the hub. The report
-* says so — each field that had a value is `stale`, with the reason.
-*/
-function heldFieldsOf(fields, reason) {
-	return fields.map((f) => f.state === "unavailable" ? f : {
-		...f,
-		state: "stale",
-		reason
-	});
-}
-//#endregion
-//#region src/builtins/composer/composer-grafts.ts
-/**
-* The composer's side of grafts (D663, Task 10): WHEN a cap a customization
-* ADDS is grafted, removed or refused — `GraftHost` is only the how. Split from
-* `composer.ts`.
-*
-* - Decided at PLAN time only (rule 2): every added cap is grafted; a grafted
-*   cap the plan now finds native is ungrafted (its event was dropped, D8).
-* - NATIVE ALWAYS WINS (I-2). A foreign `native-registered` on a grafted cap
-*   ungrafts it (the claim stays). One that lands while a plan is in flight —
-*   after the target's description was read, before the graft — is remembered
-*   per described device, so that plan never grafts over it. A foreign
-*   `native-unregistered` never re-grafts (D659).
-* - A cap no graft serves is NAMED for the block verdict (I-1): refused by the
-*   host, or taken by a native. Every added cap unserved → the block fails.
-* - A binding a PREVIOUS composer process left (a respawn, D5) is retracted
-*   when a settled plan does not want it (I-3), or when the gate releases the
-*   add claim of a block that is gone — after reading that the binding IS the
-*   composer's; a read that fails retracts nothing (D49).
-*/
-/** A foreign native now serves the grafted cap: the claim stays (Task 10 rule 2). */
-var NATIVE_APPEARED_UNGRAFT_REASON = "a native provider appeared";
-/** The block's add claim was released by the D49 gate (deleted, disabled, feature removed): its graft goes with it. */
-var NO_LONGER_ADDED_UNGRAFT_REASON = "the block no longer adds this cap";
-/** A binding a previous composer process left, that nothing wants any more (I-3). */
-var STALE_GRAFT_RETRACT_REASON = "a graft left by a previous composer process that no plan wants";
-function withEntry(map, key, value) {
-	return new Map([...map, [key, value]]);
-}
-function nativeTakenReason(addonId, when) {
-	return `a native provider (${addonId}) ${when} — the cap is not grafted and its claim is kept; edit or restart the block to replace the native instead`;
-}
-var ComposerGrafts = class {
-	ports;
-	logger;
-	readBindings;
-	/** Per device: the added caps no graft serves, and why. Reset by each plan of that device. */
-	unserved = /* @__PURE__ */ new Map();
-	/** Per DESCRIBED device: foreign natives registered since its description was read (cap → addonId). */
-	foreignSince = /* @__PURE__ */ new Map();
-	constructor(ports, logger, readBindings) {
-		this.ports = ports;
-		this.logger = logger;
-		this.readBindings = readBindings;
+	seedCap(cap) {
+		const records = this.recordsOf(cap);
+		const missing = records.filter((r) => (r.plan.required || isHeld(r)) && writable(r) === void 0 && !isReleased(r)).map((r) => fieldPath(r.plan));
+		if (missing.length > 0) return this.holdBackSeed(cap, missing);
+		this.heldBack = new Set([...this.heldBack].filter((c) => c !== cap));
+		const entries = this.entriesFor(cap, records);
+		if (!this.write(cap, "seed", entries)) return;
+		this.seeded = new Set([...this.seeded, cap]);
+		this.markWritten(cap, entries);
 	}
-	/** A description of `deviceId` is about to be read: it covers every registration before now. */
-	describing(deviceId) {
-		this.foreignSince = withEntry(this.foreignSince, deviceId, /* @__PURE__ */ new Map());
+	patchCap(cap, touched) {
+		const entries = this.entriesFor(cap, this.recordsOf(cap).filter((r) => touched.has(fieldKey(r.plan)) && (!r.hasWritten || writable(r) !== r.written)));
+		if (entries.length === 0) return;
+		if (this.write(cap, "patch", entries)) this.markWritten(cap, entries);
 	}
-	onBindingsChanged(data) {
-		if (data.addonId === "composer") return;
-		this.remember(data);
-		const ports = this.ports;
-		if (data.reason !== "native-registered" || ports === void 0) return;
-		if (!ports.grafted(data.deviceId).has(data.capName)) return;
-		this.logger.info("a native provider appeared on a grafted cap — the graft is removed; the claim stays", {
-			tags: { deviceId: data.deviceId },
+	/**
+	* After a failed write nothing is known about what landed, and after a
+	* changed withhold the claim must be re-stated: send every current value.
+	* `afterWithhold` with nothing left to write means the cap was released
+	* whole — a pending write is moot then, not retried (M-2).
+	*/
+	patchWholeCap(cap, afterWithhold = false) {
+		const entries = this.entriesFor(cap, this.recordsOf(cap));
+		if (entries.length === 0) {
+			if (afterWithhold && this.pending.has(cap)) this.dropPending(cap);
+			return;
+		}
+		if (this.write(cap, "patch", entries)) this.markWritten(cap, entries);
+	}
+	dropPending(cap) {
+		this.pending = new Map([...this.pending].filter(([c]) => c !== cap));
+		this.deps.logger.info("composed capability released whole — its pending write is moot, nothing is left to write", {
+			tags: { deviceId: this.deps.target.id },
 			meta: {
-				cap: data.capName,
-				addonId: data.addonId
+				blockId: this.deps.blockId,
+				cap
 			}
 		});
-		ports.ungraft(data.deviceId, data.capName, NATIVE_APPEARED_UNGRAFT_REASON);
-		this.setUnserved(data.deviceId, data.capName, nativeTakenReason(data.addonId, "appeared"));
 	}
-	/** Rule 2, at plan time only: graft what the plan adds; ungraft what it finds native; retract what a previous process left. */
-	plan(input) {
-		const ports = this.ports;
-		if (ports === void 0) return;
-		const { deviceId } = input;
-		const added = input.enabled && input.settled ? addedCapsOf(input.features) : [];
-		const replaced = new Set(input.features.filter((f) => f.mode === "replace").map((f) => f.cap));
-		for (const cap of ports.grafted(deviceId)) {
-			if (!replaced.has(cap)) continue;
-			this.logger.info("a native provider serves a grafted cap — the graft is removed; the claim stays", {
-				tags: { deviceId },
-				meta: { cap }
-			});
-			ports.ungraft(deviceId, cap, NATIVE_APPEARED_UNGRAFT_REASON);
+	/**
+	* What one write of `cap` carries: the writable `candidates` — and, when any
+	* of them is an item leaf, EVERY item leaf of the cap, because the array is
+	* written whole (a patch of `items` replaces it). A required item leaf with
+	* no value holds the whole array (its top-level siblings still go out).
+	*/
+	entriesFor(cap, candidates) {
+		const top = candidates.filter((r) => r.plan.item === void 0);
+		if (!candidates.some((r) => r.plan.item !== void 0)) return this.writableEntries(top);
+		const items = this.recordsOf(cap).filter((r) => r.plan.item !== void 0);
+		const missing = items.filter((r) => r.plan.required && writable(r) === void 0).map((r) => fieldPath(r.plan));
+		if (missing.length > 0) {
+			this.holdItems(cap, missing);
+			return this.writableEntries(top);
 		}
-		if (input.settled) this.retractUnwanted(input, new Set(added));
-		const foreign = this.foreignSince.get(deviceId) ?? /* @__PURE__ */ new Map();
-		const unserved = /* @__PURE__ */ new Map();
-		for (const cap of added) {
-			const other = foreign.get(cap);
-			if (other !== void 0) {
-				const reason = nativeTakenReason(other, "registered while the block was planning");
-				this.logger.warn("graft skipped — a native provider serves the cap (native always wins)", {
-					tags: { deviceId },
-					meta: {
-						cap,
-						addonId: other
-					}
-				});
-				unserved.set(cap, reason);
-				continue;
+		this.itemsHeld = new Set([...this.itemsHeld].filter((c) => c !== cap));
+		return this.writableEntries([...top, ...items]);
+	}
+	writableEntries(records) {
+		return records.flatMap((r) => {
+			const value = writable(r);
+			return value === void 0 ? [] : [{
+				plan: r.plan,
+				value
+			}];
+		});
+	}
+	holdItems(cap, missing) {
+		if (this.itemsHeld.has(cap)) return;
+		this.itemsHeld = new Set([...this.itemsHeld, cap]);
+		this.deps.logger.warn("composed items held — a required item field has no value; the array is not written until it does", {
+			tags: { deviceId: this.deps.target.id },
+			meta: {
+				blockId: this.deps.blockId,
+				cap,
+				missing
 			}
-			const outcome = ports.graft(deviceId, input.ref.stableId, cap);
-			if (outcome.kind === "refused") unserved.set(cap, `graft refused: ${outcome.reason}`);
-		}
-		this.unserved = withEntry(this.unserved, deviceId, unserved);
+		});
 	}
-	/** The gate released a claim: a graft of that cap goes with it; a previous process's binding is retracted once read as the composer's. */
-	async released(deviceId, capName) {
-		const ports = this.ports;
-		if (ports === void 0) return;
-		this.setUnserved(deviceId, capName, null);
-		if (ports.grafted(deviceId).has(capName)) {
-			ports.ungraft(deviceId, capName, NO_LONGER_ADDED_UNGRAFT_REASON);
-			return;
-		}
-		let read;
+	holdBackSeed(cap, missing) {
+		if (this.heldBack.has(cap)) return;
+		this.heldBack = new Set([...this.heldBack, cap]);
+		this.deps.logger.warn("composed capability not seeded yet — a required field has no value", {
+			tags: { deviceId: this.deps.target.id },
+			meta: {
+				blockId: this.deps.blockId,
+				cap,
+				missing
+			}
+		});
+	}
+	/** One write. A refusal or a throw marks the cap write-pending; true when the target took it. */
+	write(cap, op, entries) {
+		let failed;
 		try {
-			read = await this.readBindings(deviceId);
-		} catch (err) {
-			read = {
-				kind: "unreadable",
-				error: errMsg(err)
+			const values = assembleSlice(entries, this.deps.lookupCap);
+			const outcome = op === "seed" ? this.deps.target.seed(cap, values) : this.deps.target.patch(cap, values);
+			failed = outcome.ok ? null : {
+				kind: "refused",
+				error: outcome.error
+			};
+		} catch (error) {
+			failed = {
+				kind: "threw",
+				error: errorText(error)
 			};
 		}
-		if (read.kind === "unreadable") {
-			this.logger.warn("a released claim: the bindings could not be read — a graft left by a previous process, if any, is not retracted (D49)", {
-				tags: { deviceId },
-				meta: {
-					cap: capName,
-					error: read.error
-				}
-			});
-			return;
+		if (failed === null) {
+			this.clearPending(cap);
+			return true;
 		}
-		if (read.caps.get(capName) === "composer") ports.retractStale(deviceId, capName, STALE_GRAFT_RETRACT_REASON);
+		this.markPending(cap, op, failed);
+		return false;
 	}
-	/** The target row is gone: nothing about it is reported any more. */
-	gone(deviceId) {
-		this.unserved = new Map([...this.unserved].filter(([id]) => id !== deviceId));
+	clearPending(cap) {
+		if (!this.pending.has(cap)) return;
+		this.pending = new Map([...this.pending].filter(([c]) => c !== cap));
+		this.deps.logger.info("composed capability written again after a failed write", {
+			tags: { deviceId: this.deps.target.id },
+			meta: {
+				blockId: this.deps.blockId,
+				cap
+			}
+		});
 	}
-	verdict(deviceId, features) {
-		const added = addedCapsOf(features);
-		const unserved = this.unserved.get(deviceId) ?? /* @__PURE__ */ new Map();
-		const named = added.flatMap((cap) => {
-			const reason = unserved.get(cap);
-			return reason === void 0 ? [] : [`${cap}: ${reason}`];
+	markPending(cap, op, failed) {
+		const wasPending = this.pending.has(cap);
+		this.pending = new Map([...this.pending, [cap, failed]]);
+		if (wasPending) return;
+		const message = failed.kind === "refused" ? "composed capability refused a write — its whole slice is re-written on the next pass that evaluates it" : "composed capability write threw — its whole slice is re-written on the next pass that evaluates it";
+		this.deps.logger.warn(message, {
+			tags: { deviceId: this.deps.target.id },
+			meta: {
+				blockId: this.deps.blockId,
+				cap,
+				op,
+				error: failed.error
+			}
 		});
-		if (named.length === 0) return null;
-		return {
-			allUnserved: named.length === added.length && added.length === features.length,
-			reason: `added caps no graft serves — ${named.join("; ")}`
-		};
 	}
-	retractUnwanted(input, wanted) {
-		const ports = this.ports;
-		if (ports === void 0) return;
-		const own = ports.grafted(input.deviceId);
-		for (const [cap, addonId] of input.nativeCaps) {
-			if (addonId !== "composer" || own.has(cap) || wanted.has(cap)) continue;
-			this.logger.info("a graft left by a previous composer process is retracted", {
-				tags: { deviceId: input.deviceId },
-				meta: { cap }
-			});
-			ports.retractStale(input.deviceId, cap, STALE_GRAFT_RETRACT_REASON);
-		}
+	markWritten(cap, entries) {
+		const written = new Map(entries.map((e) => [fieldKey(e.plan), e.value]));
+		this.records = new Map([...this.records].map(([k, r]) => r.plan.cap === cap && written.has(k) ? [k, {
+			...r,
+			hasWritten: true,
+			written: written.get(k)
+		}] : [k, r]));
 	}
-	remember(data) {
-		const seen = this.foreignSince.get(data.deviceId);
-		if (seen === void 0) return;
-		if (data.reason === "native-registered") this.foreignSince = withEntry(this.foreignSince, data.deviceId, new Map([...seen, [data.capName, data.addonId]]));
-		else if (data.reason === "native-unregistered" && seen.get(data.capName) === data.addonId) this.foreignSince = withEntry(this.foreignSince, data.deviceId, new Map([...seen].filter(([cap]) => cap !== data.capName)));
+	updateAvailability() {
+		const blocking = [...this.records.values()].filter((r) => r.plan.unavailable === "offline" && r.outcome?.state === "unavailable").map((r) => fieldKey(r.plan));
+		const unseeded = [...new Set(this.deps.fields.map((f) => f.cap))].filter((c) => !this.seeded.has(c));
+		const writePending = [...this.pending.keys()];
+		const available = this.disabledReason === null && this.failure === null && blocking.length === 0 && unseeded.length === 0 && writePending.length === 0;
+		if (available === this.available) return;
+		this.deps.target.setAvailable(available);
+		this.available = available;
+		const extras = {
+			tags: { deviceId: this.deps.target.id },
+			meta: {
+				blockId: this.deps.blockId,
+				blocking,
+				unseeded,
+				writePending,
+				failure: this.failure,
+				disabled: this.disabledReason
+			}
+		};
+		if (available) this.deps.logger.info("composed device available", extras);
+		else this.deps.logger.warn("composed device unavailable — a field has no value, a write is pending, or the block failed", extras);
 	}
-	setUnserved(deviceId, cap, reason) {
-		const current = this.unserved.get(deviceId) ?? /* @__PURE__ */ new Map();
-		const next = new Map([...current].filter(([c]) => c !== cap));
-		if (reason !== null) next.set(cap, reason);
-		this.unserved = withEntry(this.unserved, deviceId, next);
+	updateFailure() {
+		if (this.failure !== null) return;
+		const fatal = [...this.records.values()].find((r) => r.outcome?.state === "unavailable" && r.outcome.fatal);
+		if (fatal === void 0 || fatal.outcome === null || fatal.outcome.state !== "unavailable") return;
+		this.failure = `source missing — ${fatal.outcome.reason}`;
+		this.deps.logger.error("composition failed: a source is gone — only the operator ends this (repair the source, edit or delete the block)", {
+			tags: { deviceId: this.deps.target.id },
+			meta: {
+				blockId: this.deps.blockId,
+				field: fieldKey(fatal.plan),
+				reason: fatal.outcome.reason
+			}
+		});
 	}
-};
-//#endregion
-//#region src/builtins/composer/composer-verdict.ts
-/** A runtime built by an apply, before the apply's sync decides whether it may start. */
-var NOT_STARTED = "the runtime has not started yet";
-function verdictOf(blockId, entry, unsynced, grafts = null) {
-	if (entry === void 0) return {
-		blockId,
-		status: "starting",
-		reason: "not applied yet"
-	};
-	if (entry.rebuildError !== null) return {
-		blockId,
-		status: "failed",
-		reason: `rebuilding the composed device for its new shape failed: ${entry.rebuildError}`
-	};
-	if (entry.planned.problems.length > 0) {
-		const kept = entry.planned.declaration === null ? "" : " — its device is kept offline with no capabilities";
-		return {
-			blockId,
-			status: "failed",
-			reason: `the composition does not validate: ${entry.planned.problems.join("; ")}${kept}`
-		};
+	/** `after`: arm only deadlines later than this instant; null arms the earliest stored one. */
+	armDeadline(after) {
+		const deadlines = [...this.records.values()].flatMap((r) => r.outcome !== null && r.outcome.state !== "unavailable" && r.outcome.deadline !== null && (after === null || r.outcome.deadline > after) ? [r.outcome.deadline] : []);
+		if (deadlines.length === 0) {
+			this.deps.timer.disarm();
+			return;
+		}
+		this.deps.timer.arm(Math.min(...deadlines), () => this.onDeadline());
 	}
-	if (!entry.planned.block.enabled) return {
-		blockId,
-		status: "stopped"
-	};
-	const target = entry.planned.target;
-	if (target.kind === "existing") {
-		if (target.gone !== null) return {
-			blockId,
-			status: "failed",
-			reason: `the target device is gone: ${target.gone}`
-		};
-		if (target.waiting !== null) return {
-			blockId,
-			status: "starting",
-			reason: target.waiting
-		};
-	} else if (entry.device === null) return {
-		blockId,
-		status: "starting",
-		reason: "the composed device has not been constructed yet"
-	};
-	const runtime = entry.runtime;
-	if (runtime === null) {
-		if (target.kind !== "existing" || target.features.length === 0) return {
-			blockId,
-			status: "running"
-		};
-		return {
-			blockId,
-			status: "starting",
-			reason: NOT_STARTED
-		};
+	onDeadline() {
+		this.guarded("deadline", true, () => {
+			const now = this.deps.now();
+			const due = [...this.records.values()].filter((r) => r.outcome !== null && r.outcome.state !== "unavailable" && r.outcome.deadline !== null && r.outcome.deadline <= now).map((r) => fieldKey(r.plan));
+			if (due.length > 0) this.pass(due, "deadline");
+		});
 	}
-	if (unsynced) return {
-		blockId,
-		status: "starting",
-		reason: NOT_STARTED
-	};
-	const state = runtime.state();
-	if (state.failure !== null) return {
-		blockId,
-		status: "failed",
-		reason: state.failure
-	};
-	if (grafts?.allUnserved === true) return {
-		blockId,
-		status: "failed",
-		reason: grafts.reason
-	};
-	const degraded = [...state.released.length > 0 ? [degradedReason(state.released)] : [], ...grafts === null ? [] : [grafts.reason]];
-	if (degraded.length > 0) return {
-		blockId,
-		status: "degraded",
-		reason: degraded.join("; ")
-	};
-	if (state.held.length > 0) return {
-		blockId,
-		status: "starting",
-		reason: heldReason(state.held)
-	};
-	return {
-		blockId,
-		status: "running"
-	};
-}
+	logTransition(record, outcome) {
+		const from = record.outcome?.state ?? "pending";
+		if (from === "pending" && outcome.state === "fresh") return;
+		const extras = {
+			tags: { deviceId: this.deps.target.id },
+			meta: {
+				blockId: this.deps.blockId,
+				cap: record.plan.cap,
+				field: record.plan.path,
+				from,
+				to: outcome.state,
+				reason: reasonOf(outcome)
+			}
+		};
+		const message = `composed field ${fieldKey(record.plan)}: ${from} → ${outcome.state}`;
+		if (outcome.state === "fresh") this.deps.logger.info(message, extras);
+		else this.deps.logger.warn(message, extras);
+	}
+};
 //#endregion
 //#region src/builtins/composer/owned-fields-target.ts
 /**
@@ -2350,6 +2357,249 @@ var OwnedFieldsTarget = class {
 	}
 };
 //#endregion
+//#region src/builtins/composer/composer-runtime-factory.ts
+/**
+* What a planned block's runtime is built from: WHERE it writes (its composed
+* device, or a claim-backed target on an existing device) and HOW it reads
+* (rule 6: a self-read of a field the block did not ADD is the native, never
+* the merge; the block's own output is answered by the runtime, never through
+* the hub — D670 amendment).
+*/
+/** Where a block's runtime writes: its composed device, or a claim-backed target on the existing device. */
+function writerFor(deps, p, device, onClaimEvent) {
+	const target = p.target;
+	if (target.kind !== "existing") return device;
+	if (target.deviceId === null || target.waiting !== null || target.gone !== null) return null;
+	const deviceId = target.deviceId;
+	const owner = p.block.id;
+	return new OwnedFieldsTarget({
+		deviceId,
+		owner,
+		modeOf: (cap) => claimModeOf(target.features, cap),
+		fieldsOf: (cap) => claimFieldsOf(p.fields, cap),
+		api: deps.claims,
+		logger: deps.logger.child("owned"),
+		onClaim: (cap, event) => onClaimEvent(deviceId, cap, owner, event)
+	});
+}
+function newCompositionRuntime(deps, p, target, seed) {
+	const self = p.target.kind === "existing" ? selfReadCaps(p.fields, p.target.ref, p.target.features) : null;
+	const targetKey = p.target.kind === "existing" ? compositionSourceKey(p.target.ref) : null;
+	const nativeCaps = new Set(self?.native ?? []);
+	const ownKey = targetKey ?? compositionSourceKey(composedDeviceRef(p.block.id));
+	return new CompositionRuntime({
+		blockId: p.block.id,
+		fields: p.fields,
+		eventPlans: p.events,
+		events: deps.events,
+		target,
+		lookupCap: deps.lookupCap,
+		...seed === void 0 ? {} : { initialByCap: seed.byCap },
+		read: (read) => deps.tracker.read(read, compositionSourceKey(read.source) === targetKey && nativeCaps.has(read.cap) ? "native" : "effective"),
+		isOwnRead: (read) => compositionSourceKey(read.source) === ownKey && !nativeCaps.has(read.cap),
+		now: deps.now,
+		timer: deps.newTimer(),
+		logger: deps.logger.child("runtime")
+	});
+}
+//#endregion
+//#region src/builtins/composer/confirmed-seed.ts
+var ConfirmedSeed = class {
+	deps;
+	seeded = false;
+	/** The previous read answered `[]`: one more `[]` confirms it (D49). */
+	emptySeen = false;
+	/** Consecutive applies whose read did not answer: warned once per run. */
+	waitApplies = 0;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	get done() {
+		return this.seeded;
+	}
+	/** Null once seeded, else why this apply must wait. */
+	async ensure() {
+		if (this.seeded) return null;
+		const read = await this.deps.read();
+		if (read.kind === "unknown") {
+			this.emptySeen = false;
+			this.waitApplies += 1;
+			if (this.waitApplies === 1) this.deps.logger.warn(`composer: the ${this.deps.subject} could not be read — nothing is declared, withdrawn, claimed or released from them; retried on the next apply`, { meta: {
+				subject: this.deps.subject,
+				error: read.error
+			} });
+			return this.deps.unreadReason;
+		}
+		if (read.items.length === 0 && !this.emptySeen) {
+			this.emptySeen = true;
+			this.deps.logger.warn(`composer: the ${this.deps.subject} read empty — waiting for the next apply's read to agree before trusting it`, { meta: { subject: this.deps.subject } });
+			return this.deps.emptyUnconfirmedReason;
+		}
+		this.deps.onSeeded(read.items);
+		this.seeded = true;
+		this.deps.logger.info(`composer: seeded from the ${this.deps.subject}`, { meta: {
+			subject: this.deps.subject,
+			items: read.items.length,
+			confirmedEmpty: read.items.length === 0,
+			appliesRefused: this.waitApplies
+		} });
+		return null;
+	}
+};
+//#endregion
+//#region src/builtins/composer/composer-seeds.ts
+/**
+* The two reads the composer takes ONCE before its first decision (D49): the
+* composed rows it already owns (before any withdrawal) and the claims the hub
+* holds (before any release). Each is a `ConfirmedSeed`: an unread or a
+* first-empty answer waits, by name, for an agreeing read.
+*/
+var ROWS_UNREAD = "the composer's own device rows could not be read — nothing is declared or withdrawn until they are (D49)";
+var ROWS_EMPTY_UNCONFIRMED = "the composer's own device rows read empty once — a cold registry answers the same, so nothing is declared or withdrawn until the next apply's read agrees (D49)";
+var CLAIMS_NOT_LOADED = "the claims index has not loaded — nothing is claimed or released until it does (D49)";
+var CLAIMS_EMPTY_UNCONFIRMED = "the claims index read empty once — nothing is claimed or released until the next apply's read agrees (D49)";
+/** The rows the composer owns, read ONCE before its first withdrawal decision. */
+function composedRowSeed(deps) {
+	return new ConfirmedSeed({
+		logger: deps.logger,
+		subject: "composer's own device rows",
+		read: async () => {
+			try {
+				return {
+					kind: "items",
+					items: await deps.readPersisted()
+				};
+			} catch (err) {
+				return {
+					kind: "unknown",
+					error: errMsg(err)
+				};
+			}
+		},
+		onSeeded: deps.onSeeded,
+		unreadReason: ROWS_UNREAD,
+		emptyUnconfirmedReason: ROWS_EMPTY_UNCONFIRMED
+	});
+}
+/**
+* The claims the hub holds, read ONCE before the first release decision (rule
+* 3). `not-loaded` is UNKNOWN (D315), never empty.
+*/
+function claimIndexSeed(deps) {
+	return new ConfirmedSeed({
+		logger: deps.logger,
+		subject: "claims index",
+		read: async () => {
+			try {
+				const listing = await deps.claims.listClaims({ ownerPrefix: "" });
+				return listing.state === "loaded" ? {
+					kind: "items",
+					items: listing.claims
+				} : {
+					kind: "unknown",
+					error: listing.reason
+				};
+			} catch (err) {
+				return {
+					kind: "unknown",
+					error: errMsg(err)
+				};
+			}
+		},
+		onSeeded: deps.onSeeded,
+		unreadReason: CLAIMS_NOT_LOADED,
+		emptyUnconfirmedReason: CLAIMS_EMPTY_UNCONFIRMED
+	});
+}
+//#endregion
+//#region src/builtins/composer/composer-verdict.ts
+/** A runtime built by an apply, before the apply's sync decides whether it may start. */
+var NOT_STARTED = "the runtime has not started yet";
+function verdictOf(blockId, entry, unsynced, grafts = null) {
+	if (entry === void 0) return {
+		blockId,
+		status: "starting",
+		reason: "not applied yet"
+	};
+	if (entry.rebuildError !== null) return {
+		blockId,
+		status: "failed",
+		reason: `rebuilding the composed device for its new shape failed: ${entry.rebuildError}`
+	};
+	if (entry.planned.problems.length > 0) {
+		const kept = entry.planned.declaration === null ? "" : " — its device is kept offline with no capabilities";
+		return {
+			blockId,
+			status: "failed",
+			reason: `the composition does not validate: ${entry.planned.problems.join("; ")}${kept}`
+		};
+	}
+	if (!entry.planned.block.enabled) return {
+		blockId,
+		status: "stopped"
+	};
+	const target = entry.planned.target;
+	if (target.kind === "existing") {
+		if (target.gone !== null) return {
+			blockId,
+			status: "failed",
+			reason: `the target device is gone: ${target.gone}`
+		};
+		if (target.waiting !== null) return {
+			blockId,
+			status: "starting",
+			reason: target.waiting
+		};
+	} else if (entry.device === null) return {
+		blockId,
+		status: "starting",
+		reason: "the composed device has not been constructed yet"
+	};
+	const runtime = entry.runtime;
+	if (runtime === null) {
+		if (target.kind !== "existing" || target.features.length === 0) return {
+			blockId,
+			status: "running"
+		};
+		return {
+			blockId,
+			status: "starting",
+			reason: NOT_STARTED
+		};
+	}
+	if (unsynced) return {
+		blockId,
+		status: "starting",
+		reason: NOT_STARTED
+	};
+	const state = runtime.state();
+	if (state.failure !== null) return {
+		blockId,
+		status: "failed",
+		reason: state.failure
+	};
+	if (grafts?.allUnserved === true) return {
+		blockId,
+		status: "failed",
+		reason: grafts.reason
+	};
+	const degraded = [...state.released.length > 0 ? [degradedReason(state.released)] : [], ...grafts === null ? [] : [grafts.reason]];
+	if (degraded.length > 0) return {
+		blockId,
+		status: "degraded",
+		reason: degraded.join("; ")
+	};
+	if (state.held.length > 0) return {
+		blockId,
+		status: "starting",
+		reason: heldReason(state.held)
+	};
+	return {
+		blockId,
+		status: "running"
+	};
+}
+//#endregion
 //#region src/builtins/composer/composer.ts
 /**
 * The composer: every declarative composition on this hub, in one runner
@@ -2389,28 +2639,20 @@ var OwnedFieldsTarget = class {
 * value with its claim kept — the runtime's `held`, reported `starting` by name.
 * A runtime built by an apply starts in that apply's sync, never earlier from
 * an event (N-5).
+*
+* This file is the orchestration; the pieces live beside it:
+* `composer-apply-waits.ts` (the store / integration preconditions),
+* `composer-seeds.ts` (the two boot reads), `composer-runtime-factory.ts`
+* (where a runtime writes and how it reads) and `composer-live-set.ts` (the
+* pure reads of the live set: tracked sources, reset keys, wanted claims).
 */
-var INTEGRATION_WAIT = "waiting for the shared Blocks integration to reconcile";
-var STORE_NOT_LOADED = "the core_blocks store has not loaded — nothing is declared or withdrawn until it does (D49)";
-var ROWS_UNREAD = "the composer's own device rows could not be read — nothing is declared or withdrawn until they are (D49)";
-var ROWS_EMPTY_UNCONFIRMED = "the composer's own device rows read empty once — a cold registry answers the same, so nothing is declared or withdrawn until the next apply's read agrees (D49)";
-var CLAIMS_NOT_LOADED = "the claims index has not loaded — nothing is claimed or released until it does (D49)";
-var CLAIMS_EMPTY_UNCONFIRMED = "the claims index read empty once — nothing is claimed or released until the next apply's read agrees (D49)";
-/** A release answered with one of these hands back nothing of ours: the gate forgets the claim. */
-var RELEASE_SETTLED_CODES = new Set([
-	"not-claimed",
-	"unknown-device",
-	"owned-by-other"
-]);
 var Composer = class {
 	deps;
 	live = /* @__PURE__ */ new Map();
 	/** The composed devices of `new`-target blocks, and the rows that exist. */
 	composed;
-	/** Consecutive applies refused because `core_blocks` had not loaded: warned once per run. */
-	storeWaitApplies = 0;
-	/** Consecutive applies refused because the Blocks integration had not reconciled: warned once per run. */
-	integrationWaitApplies = 0;
+	/** The store / integration preconditions every apply waits on first (D49, R2). */
+	waits;
 	gate;
 	claimGate;
 	targets;
@@ -2446,55 +2688,22 @@ var Composer = class {
 			this.grafts.describing(deviceId);
 			return deps.describeTarget(deviceId);
 		});
-		this.rowSeed = new ConfirmedSeed({
+		this.waits = new ApplyWaits(deps.logger);
+		this.rowSeed = composedRowSeed({
 			logger: deps.logger,
-			subject: "composer's own device rows",
-			read: async () => {
-				try {
-					return {
-						kind: "items",
-						items: await deps.readPersisted()
-					};
-				} catch (err) {
-					return {
-						kind: "unknown",
-						error: errMsg(err)
-					};
-				}
-			},
+			readPersisted: deps.readPersisted,
 			onSeeded: (rows) => {
 				this.gate.seed(rows);
 				this.composed.seedRows(rows);
-			},
-			unreadReason: ROWS_UNREAD,
-			emptyUnconfirmedReason: ROWS_EMPTY_UNCONFIRMED
+			}
 		});
-		this.claimSeed = new ConfirmedSeed({
+		this.claimSeed = claimIndexSeed({
 			logger: deps.logger,
-			subject: "claims index",
-			read: async () => {
-				try {
-					const listing = await deps.claims.listClaims({ ownerPrefix: "" });
-					return listing.state === "loaded" ? {
-						kind: "items",
-						items: listing.claims
-					} : {
-						kind: "unknown",
-						error: listing.reason
-					};
-				} catch (err) {
-					return {
-						kind: "unknown",
-						error: errMsg(err)
-					};
-				}
-			},
+			claims: deps.claims,
 			onSeeded: (claims) => {
 				this.claimGate.seed(claims);
 				this.deps.tracker.seedClaims(claims);
-			},
-			unreadReason: CLAIMS_NOT_LOADED,
-			emptyUnconfirmedReason: CLAIMS_EMPTY_UNCONFIRMED
+			}
 		});
 	}
 	apply(input) {
@@ -2542,29 +2751,10 @@ var Composer = class {
 	}
 	async applyNow(input) {
 		const ids = [...input.blocks.map((b) => b.id), ...input.unreadableBlocks.map((u) => u.id)];
-		if (!input.storeLoaded) {
-			this.storeWaitApplies += 1;
-			if (this.storeWaitApplies === 1) this.deps.logger.warn("composer: the block store has not loaded — no device is declared, withdrawn or renamed", { meta: {
-				blocks: input.blocks.length,
-				live: this.live.size
-			} });
-			return this.waiting(ids, STORE_NOT_LOADED);
-		}
-		if (this.storeWaitApplies > 0) {
-			this.deps.logger.info("composer: the block store has loaded — applying again", { meta: { appliesRefused: this.storeWaitApplies } });
-			this.storeWaitApplies = 0;
-		}
-		if (input.integrationId === null) {
-			this.integrationWaitApplies += 1;
-			if (this.integrationWaitApplies === 1) this.deps.logger.warn("composer: the shared Blocks integration has not reconciled — no composed device can be declared", { meta: { blocks: input.blocks.length } });
-			return this.waiting(ids, INTEGRATION_WAIT);
-		}
-		if (this.integrationWaitApplies > 0) {
-			this.deps.logger.info("composer: the shared Blocks integration has reconciled — applying again", { meta: { appliesRefused: this.integrationWaitApplies } });
-			this.integrationWaitApplies = 0;
-		}
+		const gate = this.waits.check(input, this.live.size);
+		if (gate.kind === "wait") return waitingResult(ids, gate.reason);
 		const unseeded = await this.rowSeed.ensure();
-		if (unseeded !== null) return this.waiting(ids, unseeded);
+		if (unseeded !== null) return waitingResult(ids, unseeded);
 		const claimsWait = await this.claimSeed.ensure();
 		const restart = new Set(input.restartBlockIds);
 		const planned = [];
@@ -2579,7 +2769,7 @@ var Composer = class {
 				shape: previous.planned.shape
 			};
 		});
-		await this.composed.reconcile(input.integrationId, declarations, planned);
+		await this.composed.reconcile(gate.integrationId, declarations, planned);
 		const rebuilt = await this.rebuildRuntimes(planned, declarations, restart, rebuildErrors);
 		await this.syncSources(rebuilt);
 		await this.reconcileClaims();
@@ -2588,16 +2778,6 @@ var Composer = class {
 			acted: true
 		};
 	}
-	waiting(blockIds, reason) {
-		return {
-			blocks: blockIds.map((blockId) => ({
-				blockId,
-				status: "starting",
-				reason
-			})),
-			acted: false
-		};
-	}
 	plan(block, restart, claimsWait) {
 		const target = block.composition.target;
 		if (target.kind === "new") return Promise.resolve(planNew(block, target, this.deps.lookupCap, this.composed.rows));
@@ -2674,14 +2854,11 @@ var Composer = class {
 				continue;
 			}
 			const heldFields = this.heldFieldsFor(p, previous);
-			const operatorAction = previous === void 0 || restart.has(p.block.id) || previous.planned.block.updatedAt !== p.block.updatedAt;
-			const targetKey = p.target.kind === "existing" ? compositionSourceKey(p.target.ref) : null;
-			if (operatorAction) for (const f of p.fields) for (const r of f.reads) {
-				const key = compositionSourceKey(r.source);
-				if (key !== targetKey) reset.add(key);
-			}
-			const writer = this.writerFor(p, device);
-			const runtime = writer === null || p.fields.length === 0 ? null : this.newRuntime(p, writer, targetSeed);
+			if (previous === void 0 || restart.has(p.block.id) || previous.planned.block.updatedAt !== p.block.updatedAt) for (const key of operatorResetKeys(p)) reset.add(key);
+			const writer = writerFor(this.deps, p, device, (deviceId, cap, owner, event) => {
+				this.onClaimEvent(deviceId, cap, owner, event);
+			});
+			const runtime = writer === null || p.fields.length === 0 ? null : newCompositionRuntime(this.deps, p, writer, targetSeed);
 			if (writer !== null && p.target.kind === "existing" && p.target.deviceId !== null) this.grafts.plan({
 				deviceId: p.target.deviceId,
 				ref: p.target.ref,
@@ -2723,23 +2900,6 @@ var Composer = class {
 			features: target.features
 		});
 	}
-	/** Where a block's runtime writes: its composed device, or a claim-backed target on the existing device. */
-	writerFor(p, device) {
-		const target = p.target;
-		if (target.kind !== "existing") return device;
-		if (target.deviceId === null || target.waiting !== null || target.gone !== null) return null;
-		const deviceId = target.deviceId;
-		const owner = p.block.id;
-		return new OwnedFieldsTarget({
-			deviceId,
-			owner,
-			modeOf: (cap) => claimModeOf(target.features, cap),
-			fieldsOf: (cap) => claimFieldsOf(p.fields, cap),
-			api: this.deps.claims,
-			logger: this.deps.logger.child("owned"),
-			onClaim: (cap, event) => void this.onClaimEvent(deviceId, cap, owner, event)
-		});
-	}
 	/** C-1/N-1: the tracker follows the block's OWN claim as the hub answers it; every answer re-reads the native once. */
 	async onClaimEvent(deviceId, cap, owner, event) {
 		try {
@@ -2761,26 +2921,6 @@ var Composer = class {
 		if (previous.runtime === null) return previous.heldFields;
 		return heldFieldsOf(previous.runtime.state().fields, `the composition no longer plans — the field keeps its last value on the device: ${p.problems.join("; ")}`);
 	}
-	newRuntime(p, target, seed) {
-		const self = p.target.kind === "existing" ? selfReadCaps(p.fields, p.target.ref, p.target.features) : null;
-		const targetKey = p.target.kind === "existing" ? compositionSourceKey(p.target.ref) : null;
-		const nativeCaps = new Set(self?.native ?? []);
-		const ownKey = targetKey ?? compositionSourceKey(composedDeviceRef(p.block.id));
-		return new CompositionRuntime({
-			blockId: p.block.id,
-			fields: p.fields,
-			eventPlans: p.events,
-			events: this.deps.events,
-			target,
-			lookupCap: this.deps.lookupCap,
-			...seed === void 0 ? {} : { initialByCap: seed.byCap },
-			read: (read) => this.deps.tracker.read(read, compositionSourceKey(read.source) === targetKey && nativeCaps.has(read.cap) ? "native" : "effective"),
-			isOwnRead: (read) => compositionSourceKey(read.source) === ownKey && !nativeCaps.has(read.cap),
-			now: this.deps.now,
-			timer: this.deps.newTimer(),
-			logger: this.deps.logger.child("runtime")
-		});
-	}
 	async applyName(device, name, applied) {
 		if ((applied ?? device.name) === name) return name;
 		try {
@@ -2802,27 +2942,7 @@ var Composer = class {
 		}
 	}
 	async syncSources(rebuilt) {
-		const requests = [];
-		for (const e of this.live.values()) {
-			const target = e.planned.target;
-			const running = e.runtime !== null && e.planned.block.enabled;
-			let targetKey = null;
-			if (target.kind === "existing") {
-				targetKey = compositionSourceKey(target.ref);
-				const self = running ? selfReadCaps(e.planned.fields, target.ref, target.features) : null;
-				requests.push({
-					ref: target.ref,
-					caps: self?.effective ?? [],
-					nativeCaps: self?.native ?? [],
-					nativeOwner: e.planned.block.id
-				});
-			}
-			if (!running) continue;
-			for (const f of e.planned.fields) for (const r of f.reads) if (compositionSourceKey(r.source) !== targetKey) requests.push({
-				ref: r.source,
-				caps: [r.cap]
-			});
-		}
+		const requests = trackedSourceRequests(this.live.values());
 		const changed = await this.syncTracker(requests, rebuilt.reset);
 		for (const entry of this.live.values()) {
 			const runtime = entry.runtime;
@@ -2846,34 +2966,10 @@ var Composer = class {
 			return /* @__PURE__ */ new Set();
 		}
 	}
-	/**
-	* Rule 3: the claims every live customization WANTS this apply; everything
-	* else the gate knows is a release candidate, handed back once two applies
-	* agree. A block that cannot plan — waiting, unreadable, failed, or with its
-	* target gone — HOLDS its claims (rule 4, rule 5): they are wanted as they
-	* are. A disabled block wants none (rule 7).
-	*/
+	/** Rule 3: release what no live customization wants, once two applies agree (`wantedClaims`). */
 	async reconcileClaims() {
 		if (!this.claimSeed.done) return;
-		const wanted = [];
-		const held = [];
-		for (const [blockId, entry] of this.live) {
-			const target = entry.planned.target;
-			if (target.kind === "new") continue;
-			if (target.kind === "unreadable" || entry.planned.problems.length > 0 || target.waiting !== null || target.gone !== null || target.deviceId === null) {
-				held.push(blockId);
-				continue;
-			}
-			if (!entry.planned.block.enabled) continue;
-			const deviceId = target.deviceId;
-			for (const f of target.features) wanted.push({
-				deviceId,
-				capName: f.cap,
-				owner: blockId
-			});
-		}
-		for (const owner of held) wanted.push(...this.claimGate.claimsOf(owner));
-		for (const key of this.claimGate.filter(wanted)) await this.release(key);
+		for (const key of this.claimGate.filter(wantedClaims(this.live, this.claimGate))) await this.release(key);
 	}
 	async release(key) {
 		let outcome;