@camstack/system 1.2.474 → 1.2.476

package/dist/builtins/composer/composer.addon.mjs

@@ -1,5 +1,5 @@
-import { $n as planComposition, $r as DeviceType, Gr as compositionItemFieldPath, Hr as composedDeviceRef, It as composerCapability, Jr as createStatefulExpressionMemory, Kr as compositionSliceKey, Lt as compositionFieldKey, N as DeclaredDevices, Oa as EventCategory, Ot as buildCapabilityLookup, Ur as composedDeviceStableId, Vr as cloneStatefulExpressionMemory, Wi as createEvent, Wr as compositionFeatureEnabled, Xr as toExpressionValue, Yr as disarmRoseMemory, a as BaseDevice, cn as evaluateCompositionField, d as COMPOSED_ITEM_FIXED_FIELDS, dn as expressionContainsBuiltinCall, ei as errMsg, qr as compositionSourceKey, r as ALL_CAPABILITY_DEFINITIONS, ti as BaseAddon, zr as COMPOSER_ADDON_ID } from "../../dist-BugavoVR.mjs";
-import { n as normalizedNativeOwner } from "../../composition-sources-CsBIIit3.mjs";
+import { $n as planComposition, $r as DeviceType, Gr as compositionItemFieldPath, Hr as composedDeviceRef, It as composerCapability, Jr as createStatefulExpressionMemory, Kr as compositionSliceKey, Lt as compositionFieldKey, N as DeclaredDevices, Oa as EventCategory, Ot as buildCapabilityLookup, Ur as composedDeviceStableId, Vr as cloneStatefulExpressionMemory, Wi as createEvent, Wr as compositionFeatureEnabled, Xr as toExpressionValue, Yr as disarmRoseMemory, a as BaseDevice, cn as evaluateCompositionField, d as COMPOSED_ITEM_FIXED_FIELDS, dn as expressionContainsBuiltinCall, ei as errMsg, qr as compositionSourceKey, r as ALL_CAPABILITY_DEFINITIONS, ti as BaseAddon, zr as COMPOSER_ADDON_ID } from "../../dist-B_V9r61Z.mjs";
+import { n as normalizedNativeOwner } from "../../composition-sources-B5nK7pHt.mjs";
 import { z } from "zod";
 //#region src/builtins/shared/device-state-changed.ts
 /** Structural narrowing helper for untrusted bus payloads. */
@@ -788,6 +788,41 @@ function wantedClaims(live, claimGate) {
 	for (const owner of held) wanted.push(...claimGate.claimsOf(owner));
 	return wanted;
 }
+/**
+* Claims an operator has already confirmed are no longer wanted: a deleted
+* block (`retiredBlockIds`), or a cap an edit dropped. Released on this apply,
+* not after a second one — a missing block in a single snapshot is still the
+* two-apply gate (`wantedClaims`). A disabled block is not here: its runtime
+* hands the fields back itself.
+*/
+function confirmedReleaseKeys(retiredBlockIds, planned, previous, claimGate) {
+	const retired = new Set(retiredBlockIds);
+	const seen = /* @__PURE__ */ new Set();
+	const keys = [];
+	const push = (key) => {
+		const id = claimKey(key);
+		if (seen.has(id)) return;
+		seen.add(id);
+		keys.push(key);
+	};
+	for (const owner of retired) for (const key of claimGate.claimsOf(owner)) push(key);
+	const plannedById = new Map(planned.map((block) => [block.block.id, block]));
+	for (const [blockId, entry] of previous) {
+		if (retired.has(blockId)) continue;
+		const next = plannedById.get(blockId);
+		if (next === void 0 || !next.block.enabled) continue;
+		if (entry.planned.block.updatedAt === next.block.updatedAt) continue;
+		for (const key of claimGate.claimsOf(blockId)) if (!planStillWantsClaim(next, key)) push(key);
+	}
+	return keys;
+}
+/** True when this plan still holds `key` — including while the plan cannot say, so a bad read releases nothing. */
+function planStillWantsClaim(planned, key) {
+	const target = planned.target;
+	if (target.kind !== "existing") return false;
+	if (target.waiting !== null || target.gone !== null || target.deviceId === null || planned.problems.length > 0) return true;
+	return target.deviceId === key.deviceId && target.features.some((feature) => feature.cap === key.capName);
+}
 //#endregion
 //#region src/builtins/composer/composition-declarations.ts
 /**
@@ -1713,6 +1748,13 @@ var CompositionRuntime = class {
 		this.stopped = true;
 		this.deps.timer.disarm();
 	}
+	/** `stop`, then wait until the target has sent nothing further. */
+	quiesce() {
+		this.stop();
+		const quiesce = this.deps.target.quiesce;
+		if (quiesce === void 0) return Promise.resolve();
+		return quiesce.call(this.deps.target);
+	}
 	state() {
 		return {
 			failure: this.failure,
@@ -2216,6 +2258,10 @@ var OwnedFieldsTarget = class {
 	listeners = [];
 	/** Per cap, bumped by every `withhold`: a claim that settles under another epoch claimed a stale field set and does not land (I-2). */
 	epoch = /* @__PURE__ */ new Map();
+	/** Set by `quiesce`: nothing further is sent. */
+	closed = false;
+	idle = Promise.resolve();
+	markIdle = null;
 	constructor(deps) {
 		this.deps = deps;
 		this.id = deps.deviceId;
@@ -2240,6 +2286,27 @@ var OwnedFieldsTarget = class {
 	}
 	/** `device-status` belongs to the native device; availability lives in the block report only. */
 	setAvailable(_available) {}
+	/**
+	* The block has stopped. Writes still queued are dropped; the call in flight
+	* is allowed to finish, and then nothing else is sent.
+	*/
+	quiesce() {
+		this.closed = true;
+		const dropped = [...this.pending.keys()];
+		this.pending = /* @__PURE__ */ new Map();
+		for (const cap of dropped) this.deps.logger.info("composed write dropped — the block stopped before it was sent", {
+			tags: { deviceId: this.deps.deviceId },
+			meta: {
+				cap,
+				owner: this.deps.owner
+			}
+		});
+		if (this.inFlight.size === 0) return Promise.resolve();
+		if (this.markIdle === null) this.idle = new Promise((resolve) => {
+			this.markIdle = resolve;
+		});
+		return this.idle;
+	}
 	onAsyncFailure(listener) {
 		this.listeners = [...this.listeners, listener];
 	}
@@ -2255,6 +2322,17 @@ var OwnedFieldsTarget = class {
 		return this.deps.fieldsOf(cap).filter((f) => held === void 0 || !held.has(f));
 	}
 	enqueue(cap, op) {
+		if (this.closed) {
+			this.deps.logger.info("composed write dropped — the block stopped before it was sent", {
+				tags: { deviceId: this.deps.deviceId },
+				meta: {
+					cap,
+					owner: this.deps.owner,
+					op: op.kind
+				}
+			});
+			return;
+		}
 		if (!this.inFlight.has(cap)) {
 			this.send(cap, op);
 			return;
@@ -2277,6 +2355,11 @@ var OwnedFieldsTarget = class {
 	}
 	settled(cap) {
 		this.inFlight = new Set([...this.inFlight].filter((c) => c !== cap));
+		if (this.closed) {
+			this.pending = /* @__PURE__ */ new Map();
+			if (this.inFlight.size === 0) this.markIdle?.();
+			return;
+		}
 		const next = this.pending.get(cap);
 		if (next === void 0) return;
 		this.pending = new Map([...this.pending].filter(([c]) => c !== cap));
@@ -2693,7 +2776,11 @@ function verdictOf(blockId, entry, unsynced, grafts = null) {
 * filter in `composer.addon.ts` stays load-bearing. Its fields are CLAIMED on
 * the hub under the block id (`OwnedFieldsTarget`), and released through the
 * `ClaimGate` — two applies must agree, seeded at boot from the claims index —
-* when the block is gone, disabled, or lost the feature. Its own replaced
+* when the block merely vanished from one snapshot. An operator delete
+* (`retiredBlockIds`) or an edit that drops a cap releases those claims on
+* THIS apply, after the old runtime has quiesced and before any replacement
+* claims; a release that does not land is logged with `tags: { deviceId }` and
+* returned on the apply. Its own replaced
 * fields are read in the NATIVE view (rule 6). Its target row gone on two
 * agreeing index reads fails the block by name and ungrafts what it added —
 * whether the loss was seen on `device.unregistered` or on a later plan; its
@@ -2841,12 +2928,16 @@ var Composer = class {
 			};
 		});
 		await this.composed.reconcile(gate.integrationId, declarations, planned);
+		const releasing = confirmedReleaseKeys(input.retiredBlockIds ?? [], planned, this.live, this.claimGate);
 		const rebuilt = await this.rebuildRuntimes(planned, declarations, restart, rebuildErrors);
+		await Promise.all(rebuilt.stopped.map((runtime) => runtime.quiesce()));
+		const unreleasedClaims = await this.releaseConfirmed(releasing);
 		await this.syncSources(rebuilt);
 		await this.reconcileClaims();
 		return {
 			blocks: planned.map((p) => this.verdict(p.block.id)),
-			acted: true
+			acted: true,
+			unreleasedClaims
 		};
 	}
 	plan(block, restart, claimsWait) {
@@ -2867,7 +2958,13 @@ var Composer = class {
 	async rebuildRuntimes(planned, declarations, restart, rebuildErrors) {
 		const reset = /* @__PURE__ */ new Set();
 		const fresh = /* @__PURE__ */ new Set();
+		const stopped = [];
 		const next = /* @__PURE__ */ new Map();
+		const halt = (runtime) => {
+			if (runtime === null) return;
+			runtime.stop();
+			stopped.push(runtime);
+		};
 		for (const p of planned) {
 			const previous = this.live.get(p.block.id);
 			const lost = lostTarget(p, previous?.planned);
@@ -2938,7 +3035,7 @@ var Composer = class {
 				enabled: p.block.enabled,
 				settled: p.problems.length === 0
 			});
-			previous?.runtime?.stop();
+			halt(previous?.runtime ?? null);
 			if (runtime !== null) fresh.add(runtime);
 			next.set(p.block.id, {
 				planned: p,
@@ -2953,12 +3050,15 @@ var Composer = class {
 		for (const [blockId, entry] of this.live) {
 			if (next.has(blockId)) continue;
 			if (held.has(composedDeviceStableId(blockId))) next.set(blockId, entry);
-			else entry.runtime?.stop();
+			else halt(entry.runtime);
 		}
 		this.live = next;
 		const liveRuntimes = new Set([...next.values()].map((e) => e.runtime));
 		this.unsynced = new Set([...[...this.unsynced].filter((r) => liveRuntimes.has(r)), ...fresh]);
-		return { reset };
+		return {
+			reset,
+			stopped
+		};
 	}
 	ungraftGone(blockId, target, deviceId) {
 		this.grafts.gone(deviceId);
@@ -3042,21 +3142,40 @@ var Composer = class {
 		if (!this.claimSeed.done) return;
 		for (const key of this.claimGate.filter(wantedClaims(this.live, this.claimGate))) await this.release(key);
 	}
+	/** Confirmed releases, awaited. A failure is the string the hub gave; the gate retries it later. */
+	async releaseConfirmed(keys) {
+		const unreleased = [];
+		for (const key of keys) {
+			const error = await this.release(key);
+			if (error === null) continue;
+			unreleased.push({
+				deviceId: key.deviceId,
+				capName: key.capName,
+				owner: key.owner,
+				error
+			});
+		}
+		return unreleased;
+	}
+	/** Null when the hub confirmed the release (or held nothing of ours). */
 	async release(key) {
 		let outcome;
 		try {
 			outcome = await this.deps.claims.releaseClaim(key);
 		} catch (err) {
-			this.claimGate.releaseFailed(key, errMsg(err));
-			return;
+			const error = errMsg(err);
+			this.claimGate.releaseFailed(key, error);
+			return error;
 		}
 		if (!outcome.ok && !RELEASE_SETTLED_CODES.has(outcome.code)) {
-			this.claimGate.releaseFailed(key, `${outcome.code}: ${outcome.message}`);
-			return;
+			const error = `${outcome.code}: ${outcome.message}`;
+			this.claimGate.releaseFailed(key, error);
+			return error;
 		}
 		this.claimGate.released(key, outcome.ok ? "released" : outcome.code);
 		await this.grafts.released(key.deviceId, key.capName);
 		await this.onClaimEvent(key.deviceId, key.capName, key.owner, "free");
+		return null;
 	}
 	/**
 	* Rule 5: a customization whose target row is gone — the tracker's two

package/dist/builtins/composer/composer.d.ts

@@ -19,7 +19,11 @@
 * filter in `composer.addon.ts` stays load-bearing. Its fields are CLAIMED on
 * the hub under the block id (`OwnedFieldsTarget`), and released through the
 * `ClaimGate` — two applies must agree, seeded at boot from the claims index —
-* when the block is gone, disabled, or lost the feature. Its own replaced
+* when the block merely vanished from one snapshot. An operator delete
+* (`retiredBlockIds`) or an edit that drops a cap releases those claims on
+* THIS apply, after the old runtime has quiesced and before any replacement
+* claims; a release that does not land is logged with `tags: { deviceId }` and
+* returned on the apply. Its own replaced
 * fields are read in the NATIVE view (rule 6). Its target row gone on two
 * agreeing index reads fails the block by name and ungrafts what it added —
 * whether the loss was seen on `device.unregistered` or on a later plan; its
@@ -139,6 +143,9 @@ export declare class Composer {
 	private syncTracker;
 	/** Rule 3: release what no live customization wants, once two applies agree (`wantedClaims`). */
 	private reconcileClaims;
+	/** Confirmed releases, awaited. A failure is the string the hub gave; the gate retries it later. */
+	private releaseConfirmed;
+	/** Null when the hub confirmed the release (or held nothing of ours). */
 	private release;
 	/**
 	* Rule 5: a customization whose target row is gone — the tracker's two

package/dist/builtins/composer/composition-runtime.d.ts

@@ -115,6 +115,8 @@ export declare class CompositionRuntime {
 	disable(reason: string): void;
 	/** Terminal: no write, no evaluation and no timer after this. */
 	stop(): void;
+	/** `stop`, then wait until the target has sent nothing further. */
+	quiesce(): Promise<void>;
 	state(): CompositionRuntimeState;
 	/**
 	* The target's enqueued write of `cap` did not land: the cap is write-pending

package/dist/builtins/composer/composition-target.d.ts

@@ -44,6 +44,12 @@ export interface ComposedWriteTarget {
 	* existing targets.
 	*/
 	withhold?(cap: string, fields: readonly string[]): WriteOutcome;
+	/**
+	* Drop writes not yet sent and resolve once the one in flight has settled.
+	* A stopped block calls this before its claims are released, so that claim
+	* cannot land afterwards.
+	*/
+	quiesce?(): Promise<void>;
 }
 export interface DeadlineTimer {
 	arm(at: number, fire: () => void): void;

package/dist/builtins/composer/owned-fields-target.d.ts

@@ -64,11 +64,20 @@ export declare class OwnedFieldsTarget implements ComposedWriteTarget {
 	private listeners;
 	/** Per cap, bumped by every `withhold`: a claim that settles under another epoch claimed a stale field set and does not land (I-2). */
 	private epoch;
+	/** Set by `quiesce`: nothing further is sent. */
+	private closed;
+	private idle;
+	private markIdle;
 	constructor(deps: OwnedFieldsTargetDeps);
 	seed(cap: string, slice: SlicePatch): WriteOutcome;
 	patch(cap: string, patch: SlicePatch): WriteOutcome;
 	/** `device-status` belongs to the native device; availability lives in the block report only. */
 	setAvailable(_available: boolean): void;
+	/**
+	* The block has stopped. Writes still queued are dropped; the call in flight
+	* is allowed to finish, and then nothing else is sent.
+	*/
+	quiesce(): Promise<void>;
 	onAsyncFailure(listener: AsyncFailureListener): void;
 	withhold(cap: string, fields: readonly string[]): WriteOutcome;
 	private claimableFields;

package/dist/builtins/console-logging/index.js

@@ -3,7 +3,7 @@ Object.defineProperties(exports, {
 	[Symbol.toStringTag]: { value: "Module" }
 });
 require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 const require_formatter = require("../../formatter-DqAKDlvN.js");
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/console-logging/index.mjs

@@ -1,4 +1,4 @@
-import { Ln as logDestinationCapability, ti as BaseAddon } from "../../dist-BugavoVR.mjs";
+import { Ln as logDestinationCapability, ti as BaseAddon } from "../../dist-B_V9r61Z.mjs";
 import { t as formatLogLine } from "../../formatter-B7qW8bPJ.mjs";
 //#region src/builtins/console-logging/console-destination.ts
 var LEVEL_RANK = {

package/dist/builtins/core-blocks/block-supervisor.d.ts

@@ -19,7 +19,7 @@
 * status the operator can see, with the reason attached. A block that is
 * silently absent is the failure mode this whole feature has to avoid.
 */
-import { type ComposerApplyInput, type ComposerApplyResult, type ComposerUnreadableBlock, type CoreBlock, type IScopedLogger } from "@camstack/types";
+import { type ComposerApplyInput, type ComposerApplyResult, type ComposerUnreadableBlock, type CoreBlock, type IScopedLogger, type UnreleasedClaim } from "@camstack/types";
 /** The runner lifecycle states `$process.list` reports. `stopping`/`stopped`
 *  are transient states of a runner on its way out and are treated as absent. */
 export type BlockRunnerState = "starting" | "running" | "stopping" | "stopped" | "crashed" | "failed";
@@ -107,6 +107,10 @@ export declare class BlockSupervisor {
 	private emptyAppliesOwed;
 	/** Consecutive applies that could not reach the composer: warned once per run. */
 	private failedApplies;
+	/** Composition ids the operator deleted. Passed until their claims are released. */
+	private retiredBlockIds;
+	/** What the last composition apply said about claim releases. */
+	private releaseReport;
 	constructor(deps: BlockSupervisorDeps);
 	/** Start the reconcile timer. The first pass runs immediately. */
 	start(intervalMs: number): void;
@@ -128,6 +132,17 @@ export declare class BlockSupervisor {
 	* timer tick could stop a runner the tick had just decided was healthy and
 	* then never re-launch it.
 	*/
+	/**
+	* The block row is already gone. The next apply names it retired so its
+	* claims are released before this resolves. A release that does not land is
+	* returned; the id stays retired so the following pass tries again.
+	*/
+	retireComposition(blockId: string): Promise<readonly UnreleasedClaim[]>;
+	/**
+	* One apply, awaited. Used when an edit replaced a block's caps: the
+	* composer releases what the new plan dropped before this resolves.
+	*/
+	convergeForClaims(): Promise<readonly UnreleasedClaim[]>;
 	restart(blockId: string): Promise<void>;
 	private runRestart;
 	private runPass;
@@ -139,6 +154,9 @@ export declare class BlockSupervisor {
 	* pass of this same converge is the retry — no timer of its own (D3).
 	*/
 	private convergeCompositions;
+	private claimsOf;
+	/** Remember which retired ids still hold a claim. An apply that did not act keeps every id. */
+	private noteRelease;
 	/** Compile, write the package, spawn. Each failure is reported ON the block
 	*  — the author asked for this to run, so they are owed the reason it does
 	*  not. */

package/dist/builtins/core-blocks/composition-api.d.ts

@@ -12,7 +12,7 @@
 * server derives it (`customizationBlockName`), refuses one the client sends,
 * and never lets it move to another device. One per device, by block id (S2).
 */
-import { type CapabilityDefinition, type CapabilityLookup, type CompositionBlockPatch, type CompositionBlockState, type CompositionSourceRef, type CoreBlock, type ICoreBlocksProvider, type IScopedLogger } from "@camstack/types";
+import { type CapabilityDefinition, type CapabilityLookup, type CompositionBlockPatch, type CompositionBlockState, type CompositionSourceRef, type CoreBlock, type ICoreBlocksProvider, type IScopedLogger, type UnreleasedClaim } from "@camstack/types";
 import type { NamedCompositionInput } from "./core-block-store.js";
 import type { CompositionDescriptions } from "./composition-sources.js";
 export interface CompositionStoreView {
@@ -30,6 +30,12 @@ export interface CompositionApiDeps {
 	readonly lookupCap: CapabilityLookup;
 	readonly composerStates: (blockIds: readonly string[]) => Promise<readonly CompositionBlockState[]>;
 	readonly convergeSoon: () => void;
+	/**
+	* One composer apply, awaited. An edit that replaces caps does not return
+	* until the caps it dropped have been released, or the release has failed
+	* and is in the list.
+	*/
+	readonly convergeForClaims: () => Promise<readonly UnreleasedClaim[]>;
 	readonly logger: IScopedLogger;
 	/** Every capability definition — the listing is derived from them, never from the registry's live state. */
 	readonly capabilityDefinitions: readonly CapabilityDefinition[];

package/dist/builtins/core-blocks/core-blocks.addon.js

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_chunk = require("../../chunk-Cek0wNdY.js");
-const require_dist = require("../../dist-Sn-HiZ4e.js");
+const require_dist = require("../../dist-CNU7cdFf.js");
 const require_read_all_rows$1 = require("../../read-all-rows-CVoO1ONM.js");
-const require_composition_sources = require("../../composition-sources-CJv3W669.js");
+const require_composition_sources = require("../../composition-sources-BNOP9mFp.js");
 const require_prefix_range = require("../../prefix-range-D_KueXbQ.js");
 const require_prefix_walk = require("../../prefix-walk-Dv6MLZlM.js");
 let zod = require("zod");
@@ -246,6 +246,13 @@ var BlockSupervisor = class {
 	emptyAppliesOwed = 2;
 	/** Consecutive applies that could not reach the composer: warned once per run. */
 	failedApplies = 0;
+	/** Composition ids the operator deleted. Passed until their claims are released. */
+	retiredBlockIds = /* @__PURE__ */ new Set();
+	/** What the last composition apply said about claim releases. */
+	releaseReport = {
+		error: null,
+		unreleased: []
+	};
 	constructor(deps) {
 		this.deps = deps;
 	}
@@ -281,6 +288,26 @@ var BlockSupervisor = class {
 	* timer tick could stop a runner the tick had just decided was healthy and
 	* then never re-launch it.
 	*/
+	/**
+	* The block row is already gone. The next apply names it retired so its
+	* claims are released before this resolves. A release that does not land is
+	* returned; the id stays retired so the following pass tries again.
+	*/
+	retireComposition(blockId) {
+		this.retiredBlockIds = new Set([...this.retiredBlockIds, blockId]);
+		return this.converge().then(() => this.claimsOf(blockId));
+	}
+	/**
+	* One apply, awaited. Used when an edit replaced a block's caps: the
+	* composer releases what the new plan dropped before this resolves.
+	*/
+	convergeForClaims() {
+		if (this.deps.composer === null) return Promise.reject(/* @__PURE__ */ new Error("core-blocks: no composer is available — a replaced claim cannot be released"));
+		return this.converge().then(() => {
+			if (this.releaseReport.error !== null) throw new Error(`core-blocks: a replaced claim was not released — ${this.releaseReport.error}`);
+			return this.releaseReport.unreleased;
+		});
+	}
 	restart(blockId) {
 		const block = this.deps.store.get(blockId);
 		if (block !== null && require_dist.coreBlockSourceKind(block) === "composition") {
@@ -369,9 +396,13 @@ var BlockSupervisor = class {
 		});
 		const unreadable = this.deps.store.unreadableCompositions();
 		const nothingToSay = compositions.length === 0 && unreadable.length === 0;
-		if (nothingToSay && this.emptyAppliesOwed === 0) return;
+		if (nothingToSay && this.emptyAppliesOwed === 0 && this.retiredBlockIds.size === 0) return;
 		const composer = this.deps.composer;
 		if (composer === null) {
+			if (this.retiredBlockIds.size > 0) this.releaseReport = {
+				error: "no composer is available on this node — claims cannot be released",
+				unreleased: []
+			};
 			for (const { block } of compositions) await this.report(block.id, "failed", "no composer is available on this node — a composition cannot run here");
 			return;
 		}
@@ -394,7 +425,8 @@ var BlockSupervisor = class {
 					composition
 				})),
 				restartBlockIds: [...restart],
-				unreadableBlocks: [...unreadable]
+				unreadableBlocks: [...unreadable],
+				retiredBlockIds: [...this.retiredBlockIds]
 			});
 			if (this.failedApplies > 0) {
 				this.deps.logger.info("the composer answered again", { meta: { failedApplies: this.failedApplies } });
@@ -402,6 +434,7 @@ var BlockSupervisor = class {
 			}
 			this.pendingCompositionRestarts = new Set([...this.pendingCompositionRestarts].filter((id) => !restart.has(id)));
 			this.emptyAppliesOwed = !nothingToSay || !result.acted ? 2 : Math.max(0, this.emptyAppliesOwed - 1);
+			this.noteRelease(result);
 			const verdicts = new Map(result.blocks.map((v) => [v.blockId, v]));
 			for (const { block } of compositions) {
 				const verdict = verdicts.get(block.id);
@@ -409,13 +442,39 @@ var BlockSupervisor = class {
 				else await this.report(block.id, verdict.status, verdict.reason);
 			}
 		} catch (err) {
+			const error = require_dist.errMsg(err);
+			this.releaseReport = {
+				error,
+				unreleased: []
+			};
 			this.failedApplies += 1;
 			if (this.failedApplies === 1) this.deps.logger.warn("the composer could not be reached — compositions keep their last status", { meta: {
-				error: require_dist.errMsg(err),
+				error,
 				compositions: compositions.length
 			} });
-			for (const { block } of compositions) if (block.status === "stopped" && block.enabled) await this.report(block.id, "starting", `the composer is not reachable yet: ${require_dist.errMsg(err)}`);
+			for (const { block } of compositions) if (block.status === "stopped" && block.enabled) await this.report(block.id, "starting", `the composer is not reachable yet: ${error}`);
+		}
+	}
+	claimsOf(blockId) {
+		if (this.releaseReport.error !== null) throw new Error(`core-blocks: claims of "${blockId}" were not released — ${this.releaseReport.error}`);
+		return this.releaseReport.unreleased.filter((claim) => claim.owner === blockId);
+	}
+	/** Remember which retired ids still hold a claim. An apply that did not act keeps every id. */
+	noteRelease(result) {
+		const unreleased = result.unreleasedClaims ?? [];
+		if (!result.acted) {
+			this.releaseReport = {
+				error: "the composer did not apply — claims stay until it does",
+				unreleased
+			};
+			return;
 		}
+		this.releaseReport = {
+			error: null,
+			unreleased
+		};
+		const failed = new Set(unreleased.map((claim) => claim.owner));
+		this.retiredBlockIds = new Set([...this.retiredBlockIds].filter((id) => failed.has(id)));
 	}
 	/** Compile, write the package, spawn. Each failure is reported ON the block
 	*  — the author asked for this to run, so they are owed the reason it does
@@ -2082,7 +2141,21 @@ function buildCompositionApi(deps) {
 				blockId,
 				by: caller.userId
 			} });
-			deps.convergeSoon();
+			if (block.composition !== void 0) {
+				const unreleased = (await deps.convergeForClaims()).filter((claim) => claim.owner === blockId);
+				if (unreleased.length > 0) {
+					for (const claim of unreleased) deps.logger.error("composition saved but a replaced claim was not released", {
+						tags: { deviceId: claim.deviceId },
+						meta: {
+							blockId,
+							cap: claim.capName,
+							error: claim.error
+						}
+					});
+					const detail = unreleased.map((claim) => `${claim.capName} on device ${claim.deviceId}: ${claim.error}`).join("; ");
+					throw new Error(`core-blocks: "${blockId}" was saved but a replaced claim was not released — ${detail}`);
+				}
+			} else deps.convergeSoon();
 			return { block: updated };
 		}),
 		getComposition: async ({ blockId }) => {
@@ -2458,9 +2531,30 @@ var CoreBlocksAddon = class extends require_dist.BaseAddon {
 				return { block: updated };
 			},
 			delete: async ({ blockId }) => {
+				const existing = this.requireStore().get(blockId);
+				const composition = existing !== null && require_dist.coreBlockComposition(existing) !== null;
 				await this.requireStore().delete(blockId);
 				await this.requirePrefs().delete(blockId);
-				this.convergeSoon();
+				if (composition && this.supervisor === null) {
+					this.ctx.logger.error("composition deleted but no supervisor can release its claims", { meta: { blockId } });
+					throw new Error(`core-blocks: "${blockId}" was deleted but no supervisor runs here — its claims were not released`);
+				}
+				if (composition && this.supervisor !== null) {
+					const unreleased = await this.supervisor.retireComposition(blockId);
+					if (unreleased.length > 0) {
+						for (const claim of unreleased) this.ctx.logger.error("composition deleted but its claim was not released", {
+							tags: { deviceId: claim.deviceId },
+							meta: {
+								blockId,
+								cap: claim.capName,
+								owner: claim.owner,
+								error: claim.error
+							}
+						});
+						const detail = unreleased.map((claim) => `${claim.capName} on device ${claim.deviceId}: ${claim.error}`).join("; ");
+						throw new Error(`core-blocks: "${blockId}" was deleted but its claims were not released — ${detail}`);
+					}
+				} else this.convergeSoon();
 				return { success: true };
 			},
 			setEnabled: async ({ blockId, enabled }) => {
@@ -2469,9 +2563,9 @@ var CoreBlocksAddon = class extends require_dist.BaseAddon {
 				return { block: updated };
 			},
 			/**
-			* Awaited, unlike every other write here.
+			* Awaited, like a composition delete.
 			*
-			* `create`/`update` deliberately do not wait — the write is already
+			* `create`/`update` of a code block deliberately do not wait — the write is already
 			* durable and converging forks a process. A restart has no durable half:
 			* the whole thing IS the converge, so returning before it ran would hand
 			* the operator the old status and read as "nothing happened".
@@ -2552,6 +2646,10 @@ var CoreBlocksAddon = class extends require_dist.BaseAddon {
 			lookupCap: require_dist.buildCapabilityLookup(require_dist.ALL_CAPABILITY_DEFINITIONS),
 			composerStates: async (blockIds) => (await requireApi().composer.getStates.query({ blockIds: [...blockIds] })).states,
 			convergeSoon: () => this.convergeSoon(),
+			convergeForClaims: () => {
+				if (this.supervisor === null) return Promise.reject(/* @__PURE__ */ new Error("core-blocks: no block supervisor runs on this node — claims cannot be released"));
+				return this.supervisor.convergeForClaims();
+			},
 			logger: this.ctx.logger.child("compositions"),
 			capabilityDefinitions: require_dist.ALL_CAPABILITY_DEFINITIONS
 		});