@cotal-ai/lang 0.23.0 → 0.25.0

package/dist/interpret.js

@@ -15,13 +15,37 @@
  *    serialized.
  */
 import { validate } from "./grammar.js";
-import { LangError, LangErrors } from "./errors.js";
-import { KeyScope, digest, requestId, scopePathString, stepKeyString } from "./keys.js";
-import { Journal, RunClock } from "./journal.js";
-import { Prng, assertCrossable, deepFreeze } from "./values.js";
+import { LangError, LangErrors, RunDivergence, RuntimeFault, ScopeBranchMissing, UnwalkableScope, messageOf, } from "./errors.js";
+export { RunDivergence, RuntimeFault, ScopeBranchMissing, UnwalkableScope } from "./errors.js";
+import { KeyScope, digest, programHashOf, requestId, scopePathString, stepKeyString } from "./keys.js";
+import { Journal, JournalAppendRejected, RunClock } from "./journal.js";
+import { NotCrossable, Prng, assertCrossable, birthDepth, born, deepFreeze, setOwn } from "./values.js";
 import { parseDuration } from "./duration.js";
-import { PRIMITIVES } from "./primitives.js";
-import { Cancelled, EffectError, applyCheckpointPolicy, } from "./effects.js";
+import { PRIMITIVES, VALUE_NAMES } from "./primitives.js";
+import { arrayMethods, builtins, numberMethods, stringMethods } from "./library.js";
+import { notifyFactViolation } from "./notify-fact.js";
+import { bindPins, resolvePins, WALKER_LANGUAGE_VERSION } from "./pins.js";
+import { dispatchPrimitive, freeConstructors, option, performEffect, performScope, runScope, } from "./perform.js";
+import { Cancelled, RunReleased, EffectError, applyCheckpointPolicy, } from "./effects.js";
+/**
+ * Every write of a RECORD member goes through here, whatever spelled it: a literal, a spread, a
+ * rest pattern, or `o.a = v`. The one member the language refuses is a callable `then`.
+ *
+ * The host's promise machinery adopts any object that carries one: resolving a promise with such a
+ * record calls the record's own `then` with the machinery's continuations instead of delivering the
+ * value. Inside this interpreter every function is async, so a program-authored `then` that throws
+ * turns that throw into a rejection of a promise nobody owns, which escapes the run as an
+ * unhandled rejection and kills the host, while the await that adopted the record never settles
+ * and the run hangs behind it (measured: a record returned from a program function did exactly
+ * this, host process and all). Refusing the member is refusing the adoption: the language carries
+ * no thenable values, the same way it carries no sparse arrays and no `__proto__` fields.
+ */
+function setRecordMember(target, key, value) {
+    if (key === "then" && typeof value === "function") {
+        throw new RuntimeFault("L4021", "`then` cannot name a function here. To the host's promise machinery any object with a callable `then` is a promise waiting to be adopted, so the record would never arrive as the value this program built: its `then` runs with the machinery's own continuations, a `then` that throws or rejects escapes the run as an unhandled rejection with no owner and kills the host, and the await that adopted it never settles. Name the member something else.");
+    }
+    setOwn(target, key, value);
+}
 // ---- environments ------------------------------------------------------------------------------
 class Binding {
     value;
@@ -31,15 +55,49 @@ class Binding {
         this.mutable = mutable;
     }
 }
+/**
+ * The value a `let`/`const` binding holds between the top of its block and its declaration: the
+ * temporal dead zone, materialized. The validator refuses every straight-line reference into it
+ * (L2004), so the only way here at run time is a function called before the declaration executed —
+ * which JavaScript answers with a ReferenceError, and this language answers with the same code the
+ * static refusal carries.
+ */
+const TDZ = Symbol("cotal-lang temporal dead zone");
 class Env {
     parent;
+    depth;
     names = new Map();
-    constructor(parent) {
+    /**
+     * How many CONCURRENT scopes deep this environment was created.
+     *
+     * L2032's runtime half rests on this. The static rule follows named and inline branches, but a
+     * branch the validator cannot resolve to a function node — one that arrives through a parameter
+     * or a computed record — is not proven, and banning that shape outright would cost more than the
+     * hazard. So the depth travels with the binding: a write from inside a concurrent branch to a
+     * binding declared OUTSIDE it is refused where it happens. `conclave` does not raise the depth,
+     * because its single body has nothing to race.
+     */
+    constructor(parent, depth = parent?.depth ?? 0) {
         this.parent = parent;
+        this.depth = depth;
     }
     declare(name, value, mutable) {
         this.names.set(name, new Binding(value, mutable));
     }
+    /**
+     * A fresh environment holding copies of `names` at their current values: JavaScript's
+     * per-iteration bindings for a `for (let ...)` loop, so a closure made in one iteration keeps
+     * that iteration's value rather than watching the counter move.
+     */
+    perIteration(names) {
+        const next = new Env(this.parent, this.depth);
+        for (const n of names) {
+            const b = this.names.get(n);
+            if (b !== undefined)
+                next.declare(n, b.value, b.mutable);
+        }
+        return next;
+    }
     find(name) {
         for (let e = this; e !== null; e = e.parent) {
             const b = e.names.get(name);
@@ -48,56 +106,101 @@ class Env {
         }
         return undefined;
     }
+    owner(name) {
+        for (let e = this; e !== null; e = e.parent) {
+            if (e.names.has(name))
+                return e;
+        }
+        return undefined;
+    }
     get(name) {
         const b = this.find(name);
         if (b === undefined)
             throw new RuntimeFault("L2001", `${name} is not defined`);
+        if (b.value === TDZ) {
+            throw new RuntimeFault("L2004", `${name} is used before its declaration was reached: the binding exists for the whole block, but it holds no value until the \`let\`/\`const\` line runs. Call this function after the declaration, or move the declaration up.`);
+        }
         return b.value;
     }
     has(name) {
         return this.find(name) !== undefined;
     }
-    set(name, value) {
-        const b = this.find(name);
-        if (b === undefined)
+    set(name, value, atDepth) {
+        const owner = this.owner(name);
+        if (owner === undefined)
             throw new RuntimeFault("L2001", `${name} is not defined`);
+        const b = owner.names.get(name);
+        if (b.value === TDZ) {
+            throw new RuntimeFault("L2004", `${name} is assigned before its declaration was reached: the binding exists for the whole block, but it holds no value until the \`let\`/\`const\` line runs.`);
+        }
         if (!b.mutable)
             throw new RuntimeFault("L2003", `${name} is declared const`);
+        if (owner.depth < atDepth) {
+            throw new RuntimeFault("L2032", `${name} is declared outside this concurrent branch and written inside it. Live, the branches write in completion order; on resume the recorded effects return instantly and they write in launch order, so ${name} holds a different value and the run takes a path it never recorded, with no divergence raised. Return the value from the branch and read it out of the combinator's result, or use race, which yields its winner.`);
+        }
         b.value = value;
     }
 }
-/** A fault the interpreter itself raises, as opposed to one an effect handler reported. */
-export class RuntimeFault extends Error {
-    code;
-    constructor(code, message) {
-        super(`${code} ${message}`);
-        this.code = code;
-        this.name = "RuntimeFault";
+/**
+ * The message of an arbitrary thrown value.
+ *
+ * Reading `.message` off `null` throws, and a thrown primitive is legal in a language with `throw`,
+ * so every place that has to describe a failure it did not construct goes through here. A recorded
+ * entry saying "Cannot read properties of null" describes the recorder, not the run.
+ */
+/** An AST subtree with its source offsets removed: what the code IS, not where it sits. */
+export function stripPositions(node) {
+    if (Array.isArray(node))
+        return node.map(stripPositions);
+    if (node === null || typeof node !== "object")
+        return node;
+    const out = {};
+    for (const [k, v] of Object.entries(node)) {
+        if (k === "start" || k === "end" || k === "loc" || k === "range")
+            continue;
+        out[k] = stripPositions(v);
     }
+    return out;
 }
 const NORMAL = { type: "normal" };
 // ---- per-branch execution state ---------------------------------------------------------------------
+/**
+ * A branch's cancellation, in two degrees.
+ *
+ * `cancelled` is the cancellation LAW: a cancelled branch performs no new effect, and every effect
+ * boundary refuses it. `cutPure` is the stronger cut a scope applies to an arm that CANNOT WIN any
+ * more: its pure work is also abandoned, at the next yield. An arm that could still win keeps
+ * running its pure work to a settle, because cutting it there would let the scheduler, and through
+ * it the `yieldEvery` pin, decide a race the recorded clocks should decide (see `runScope`).
+ * Both degrees flow to child signals, and a signal already cancelled softly can be escalated.
+ */
 class Signal {
     cancelled = false;
+    cutPure = false;
     reason;
     listeners = [];
     onCancel(fn) {
         this.listeners.push(fn);
     }
-    cancel(reason) {
-        if (this.cancelled)
-            return;
-        this.cancelled = true;
-        this.reason = reason;
-        for (const l of this.listeners)
-            l(reason);
+    cancel(reason, opts) {
+        const cut = opts?.cutPure ?? true;
+        const first = !this.cancelled;
+        if (first) {
+            this.cancelled = true;
+            this.reason = reason;
+        }
+        const escalated = cut && !this.cutPure;
+        if (escalated)
+            this.cutPure = true;
+        if (first || escalated)
+            for (const l of this.listeners)
+                l(reason, this.cutPure);
     }
     child() {
         const s = new Signal();
         if (this.cancelled)
-            s.cancel(this.reason ?? "parent cancelled");
-        else
-            this.onCancel((r) => s.cancel(r));
+            s.cancel(this.reason ?? "parent cancelled", { cutPure: this.cutPure });
+        this.onCancel((r, cut) => s.cancel(r, { cutPure: cut }));
         return s;
     }
 }
@@ -111,50 +214,197 @@ class Frame {
     keys;
     clock;
     signal;
-    constructor(keys, clock, signal) {
+    depth;
+    constructor(keys, clock, signal, 
+    /** How many CONCURRENT scopes deep. See {@link Env.depth}: this is L2032's runtime half. */
+    depth = 0) {
         this.keys = keys;
         this.clock = clock;
         this.signal = signal;
+        this.depth = depth;
     }
     branch(kind, name, occurrence, branchKey) {
-        return new Frame(this.keys.branch(kind, name, occurrence, branchKey), this.clock.fork(), this.signal.child());
-    }
-}
-/** A recorded step's inputs changed, so its recorded result may no longer be the truth. */
-export class RunDivergence extends Error {
-    stepKey;
-    recordedHash;
-    programHash;
-    constructor(stepKey, recordedHash, programHash) {
-        super(`L5001 Run divergence\n\n  step  ${stepKey}   INPUT CHANGED\n        recorded  ${recordedHash}\n        program   ${programHash}\n\nThe recorded result was produced from different inputs, so replaying it would hand the program an answer to a question it is no longer asking.\n\nOptions\n  fork(run, "${stepKey}")   re-run from this step, keeping everything before it\n  revert the inputs         keep the recorded result`);
-        this.stepKey = stepKey;
-        this.recordedHash = recordedHash;
-        this.programHash = programHash;
-        this.name = "RunDivergence";
+        return new Frame(this.keys.branch(kind, name, occurrence, branchKey), this.clock.fork(), this.signal.child(), 
+        // `conclave` opens a scope but not a RACE: one body, nothing running beside it, so a write
+        // from inside it is as ordered as a write anywhere else and the depth does not move.
+        kind === "conclave" ? this.depth : this.depth + 1);
     }
 }
 class Interpreter {
     ast;
     options;
     programHash;
+    pins;
     journal;
     prng;
-    effectCount = 0;
-    ceiling;
+    effects;
     steps = 0;
     nextYield;
     stepBudget;
     yieldEvery;
-    constructor(ast, options, programHash) {
+    /** The curated method tables (library.ts). Built once: they close over this interpreter's write check. */
+    methods;
+    constructor(ast, options, programHash, pins) {
         this.ast = ast;
         this.options = options;
         this.programHash = programHash;
+        this.pins = pins;
+        // The journal and the run must be the same run. Request ids derive from `options.runId` while
+        // recorded results come from the journal, so a mismatch would submit work under one identity and
+        // resolve it against another's history.
+        if (options.journal !== undefined && options.journal.run !== options.runId)
+            throw new RuntimeFault("L5011", `this run is ${options.runId} but it was handed the journal of run ${options.journal.run}; a run resumes only from its own journal`);
         this.journal = options.journal ?? new Journal({ run: options.runId });
-        this.prng = new Prng(options.seed ?? options.runId);
-        this.ceiling = options.effectCeiling ?? 10_000;
-        this.stepBudget = options.stepBudget ?? 1_000_000;
-        this.yieldEvery = options.yieldEvery ?? 1_024;
+        // EVERY limit comes from the pins, never from a default applied here. A default resolved a
+        // second time is a default resolved by whichever interpreter happens to be resuming, which is
+        // exactly what pinning exists to stop.
+        // THE CEILING IS A RUN BOUND, SO THE COUNT STARTS WHERE THE RUN LEFT OFF. L4009 is named "Run
+        // effect ceiling reached" and the run record pins the ceiling — a pin is only worth
+        // refusing a mismatch on (L5009) if the thing it pins is enforced. Starting at 0 gave every
+        // activation a full allowance, so a runaway loop of effects that crashed or was released
+        // periodically never reached the ceiling however much it performed against the world, and the
+        // fault text claimed a run-scoped fact from an activation-scoped counter.
+        this.prng = new Prng(pins.seed);
+        this.effects = { journal: this.journal, options, ceiling: pins.effectCeiling, effectCount: this.journal.dispatchedEffects() };
+        this.stepBudget = pins.stepBudget;
+        this.yieldEvery = pins.yieldEvery;
         this.nextYield = this.yieldEvery;
+        this.methods = {
+            array: arrayMethods(this.libraryContext()),
+            string: stringMethods(),
+            number: numberMethods(),
+        };
+    }
+    /** What the library sees of this interpreter. */
+    libraryContext() {
+        return {
+            runId: this.options.runId,
+            programHash: this.programHash,
+            startedAt: this.pins.startedAt,
+            prng: this.prng,
+            ...(this.options.onLog !== undefined ? { onLog: this.options.onLog } : {}),
+            assertWritable: (target, frame) => this.assertWritable(target, frame),
+        };
+    }
+    // ---- values: reads and writes ---------------------------------------------------------------
+    /**
+     * May this frame write into this container? Two refusals, and they are the whole of the value
+     * half of freeze-on-share (design D4, §3.4 rule 4):
+     *
+     * - a FROZEN value crossed an effect boundary, and what crossed is what was recorded (L2031);
+     * - a value born OUTSIDE this concurrent branch and written inside it is L2032's defect reached
+     *   through a value instead of a binding, and just as silent on resume.
+     */
+    assertWritable(target, frame) {
+        if (Object.isFrozen(target)) {
+            throw new RuntimeFault("L2031", "this value crossed an effect boundary and is frozen: what crossed is what the journal recorded, so it cannot change afterwards. Build a new value instead: `{ ...record, field: value }` or `[...list, item]`.");
+        }
+        if (birthDepth(target) < frame.depth) {
+            throw new RuntimeFault("L2032", "this value was built outside this concurrent branch and is written inside it. Two branches writing one value is nondeterministic, and it is silent: live they write in completion order, on resume the recorded effects return instantly and they write in launch order, so the value differs and the run takes a path it never recorded. Build the value inside the branch and return it, and read it out of the combinator's result.");
+        }
+    }
+    /** The property key a member expression names, as JavaScript would spell it. A computed key is
+     *  held to the same no-implicit-conversion law as every other coercion site (L4018): `String(k)`
+     *  on a record would enter the host's ToPrimitive, which calls the value's own `toString` — a
+     *  program closure invoked without a Frame. Measured before the refusal: the closure's rejection
+     *  escaped as an unhandled host TypeError AFTER the run returned, and `o[{}] = 1` silently minted
+     *  the own field `"[object Object]"`. Primitives keep JavaScript's spelling (`o[1]`, `o[true]`). */
+    async memberKey(node, env, frame) {
+        if (node.computed !== true)
+            return node.property.name;
+        const k = await this.evaluate(node.property, env, frame);
+        if (typeof k === "string")
+            return k;
+        refuseCoercion("[...]", k);
+        return String(k);
+    }
+    /**
+     * Read a member. Records answer their own fields and `undefined` for anything else, so a host
+     * prototype is never reached (`o.constructor`, `o.toString` are `undefined`); strings, arrays and
+     * numbers answer `length`, an index, or an entry of their method table, and refuse anything else
+     * (L4014). Functions and booleans have no members.
+     */
+    memberOf(obj, prop, asCallee = false) {
+        switch (typeof obj) {
+            case "string": {
+                if (prop === "length")
+                    return obj.length;
+                const i = arrayIndex(prop);
+                if (i !== undefined)
+                    return obj[i];
+                return this.method(this.methods.string, obj, prop, "a string", asCallee);
+            }
+            case "number":
+                return this.method(this.methods.number, obj, prop, "a number", asCallee);
+            case "object": {
+                if (obj === null)
+                    throw new RuntimeFault("L4010", `cannot read \`${prop}\` of null`);
+                if (Array.isArray(obj)) {
+                    if (prop === "length")
+                        return obj.length;
+                    const i = arrayIndex(prop);
+                    if (i !== undefined)
+                        return obj[i];
+                    return this.method(this.methods.array, obj, prop, "an array", asCallee);
+                }
+                return Object.prototype.hasOwnProperty.call(obj, prop) ? obj[prop] : undefined;
+            }
+            case "undefined":
+                throw new RuntimeFault("L4010", `cannot read \`${prop}\` of undefined`);
+            default:
+                throw new RuntimeFault("L4014", `\`${prop}\` is not a member: a ${typeof obj} has no members`);
+        }
+    }
+    method(table, receiver, prop, kind, asCallee) {
+        const m = table[prop];
+        if (m === undefined) {
+            throw new RuntimeFault("L4014", `\`${prop}\` is not a member of ${kind}. The members are: length, an index, ${Object.keys(table).join(", ")}.`);
+        }
+        // A method is looked up at the call and exists nowhere else — a declared difference from
+        // JavaScript, where `xs.map` is a value. Handing one out produced everything a bound-function
+        // factory produces (measured): `xs.map === xs.map` was false where JavaScript says true, and
+        // an extracted `push` wrote to its receiver where strict JavaScript throws. Refusing the read
+        // is honest on both counts.
+        if (!asCallee) {
+            throw new RuntimeFault("L4020", `\`${prop}\` is a method of ${kind}, and a method is not a value here: it is looked up at the call, so it cannot be extracted, compared, or passed. Call it — \`.${prop}(...)\` — or wrap it: \`(...args) => value.${prop}(...args)\`.`);
+        }
+        return async (frame, args) => await m(frame, receiver, args);
+    }
+    /** Write a member: `o.a = v`, `xs[i] = v`. Records take any own field; arrays take an index or `length`. */
+    writeMember(obj, prop, value, frame) {
+        if (obj === null || obj === undefined || typeof obj !== "object") {
+            throw new RuntimeFault("L4010", `cannot write \`${prop}\` of ${obj === null ? "null" : typeof obj === "undefined" ? "undefined" : `a ${typeof obj}`}`);
+        }
+        this.assertWritable(obj, frame);
+        if (Array.isArray(obj)) {
+            if (prop === "length") {
+                // `xs.length = n` truncates, as in JavaScript. A LONGER length is refused: JavaScript would
+                // fill the gap with holes, and a hole is a value class this language does not have (its
+                // methods do not skip holes, so a program with holes would read differently here and on a
+                // real engine). Push what you need instead. `length` is not an own data property that
+                // `setOwn` can define, so the write goes to the array itself.
+                if (typeof value !== "number" || !Number.isInteger(value) || value < 0 || value > obj.length) {
+                    throw new RuntimeFault("L4017", `\`length\` can only be set to an integer between 0 and the array's current length (${obj.length}), got ${typeof value === "number" ? value : typeof value}: a longer length would create holes, which this language does not have; push the elements instead`);
+                }
+                obj.length = value;
+                return;
+            }
+            const i = arrayIndex(prop);
+            if (i === undefined) {
+                throw new RuntimeFault("L4014", `\`${prop}\` is not a member of an array: an array takes an index or \`length\``);
+            }
+            // Contiguous or refused: JavaScript would fill the gap with holes, and a hole is a value
+            // class this language does not have (measured before the refusal: `xs[2] = 1` on an empty
+            // array built a sparse array whose holes then crossed an effect boundary as silent nulls).
+            // Writing AT the length appends, which is `push` by another spelling and makes no hole.
+            if (i > obj.length) {
+                throw new RuntimeFault("L4019", `index ${i} is past the end of this array (length ${obj.length}), and JavaScript would fill the gap with holes, which this language does not have. Write at an existing index, at the length to append, or use \`push\`.`);
+            }
+        }
+        else if (prop === "__proto__") {
+            throw new RuntimeFault("L4014", "`__proto__` names an object's prototype, and there are no prototypes here");
+        }
+        setRecordMember(obj, prop, value);
     }
     // ---- the fuel ceiling -----------------------------------------------------------------------
     /**
@@ -167,131 +417,44 @@ class Interpreter {
     tick(frame) {
         this.steps += 1;
         if (this.steps > this.stepBudget) {
-            throw new RuntimeFault("L4013", `this run has taken more than ${this.stepBudget} interpreter steps without finishing, which means a loop that performs no effect is not terminating. The effect ceiling cannot see such a loop, because it performs nothing to count. Add an exit condition, or raise stepBudget if the program legitimately does this much work.`);
+            throw new RuntimeFault("L4013", `this walk has taken more than ${this.stepBudget} interpreter steps without finishing, which means a loop that performs no effect is not terminating. The effect ceiling cannot see such a loop, because it performs nothing to count. Add an exit condition, or raise stepBudget if the program legitimately does this much work. (stepBudget bounds ONE WALK, not the run: steps are not recorded, so a resume cannot recover a count the way the effect ceiling can.)`);
         }
         if (this.steps < this.nextYield)
             return null;
         this.nextYield = this.steps + this.yieldEvery;
         return this.breathe(frame);
     }
-    /**
-     * Hand the macrotask queue back, then notice if this branch was cancelled while we were away.
-     *
-     * The cancellation check is deliberately HERE and not on every dispatch. Cancellation is
-     * otherwise observed only at effect boundaries (see {@link Interpreter.performEffect}), so a race
-     * loser that spins without performing an effect never learns it lost and spins forever. Checking
-     * at the yield boundary reaches exactly that case and no other: a branch that runs fewer than
-     * `yieldEvery` dispatches between two effects never crosses this line, so the cancellation law
-     * for ordinary programs is unchanged.
-     */
     get stepCount() {
         return this.steps;
     }
+    /**
+     * Hand the macrotask queue back, then abandon this branch's pure work IF IT CAN NO LONGER MATTER.
+     *
+     * Cancellation is otherwise observed only at effect boundaries (see {@link Interpreter.performEffect}).
+     * This line used to cut every cancelled branch, so a `race` loser in a pure tail was abandoned at
+     * its next yield, and whether an arm that had already performed its last effect got to settle
+     * depended on how many dispatches its tail took against `yieldEvery`: the winner of a live race
+     * was a function of a host tuning knob (design §3.4, measured). The cut is now the scope's call
+     * (`Signal.cutPure`): an arm that cannot win any more is abandoned here, and an arm that could
+     * still win runs its pure work to a settle, so the winner is the recorded clocks and declaration
+     * order and nothing else (see `runScope`). An arm that could still win and spins forever is a
+     * pure infinite loop, and it ends the way every pure infinite loop ends: on the step budget
+     * (L4013), loudly, which is the run's answer rather than the scheduler's.
+     */
     async breathe(frame) {
         await new Promise((resolve) => {
             setTimeout(resolve, 0);
         });
-        if (frame.signal.cancelled)
+        if (frame.signal.cutPure)
             throw new Cancelled(frame.signal.reason ?? "cancelled");
     }
     // ---- the effect seam ------------------------------------------------------------------------
     /**
-     * Perform one effect, or replay it.
-     *
-     * Everything durable happens here. A handler is called only in the `miss` and `pending` cases,
-     * and in `pending` it is told to re-bind rather than re-issue.
+     * Perform one effect, or replay it. The machinery is {@link performEffect} in `perform.ts`,
+     * shared with the v2 engine host; this method binds it to this run.
      */
     async performEffect(kind, name, hashedInput, perform, frame) {
-        const key = frame.keys.nextEffect(kind, name);
-        const inputHash = digest(hashedInput ?? null);
-        const verdict = this.journal.lookup(key, inputHash);
-        switch (verdict.verdict) {
-            case "replay":
-                if (verdict.entry.endedAt !== undefined)
-                    frame.clock.advance(verdict.entry.endedAt);
-                return verdict.entry.result;
-            case "replay-failed": {
-                if (verdict.entry.endedAt !== undefined)
-                    frame.clock.advance(verdict.entry.endedAt);
-                const e = verdict.entry.error;
-                throw new EffectError(e.code, e.kind, e.message, e.detail);
-            }
-            case "replay-cancelled":
-                throw new Cancelled("this branch was cancelled on the recorded run");
-            case "diverged":
-                throw new RunDivergence(stepKeyString(key), verdict.recordedHash, verdict.programHash);
-            case "pending":
-            case "miss":
-                break;
-        }
-        // A cancelled branch performs no NEW effects. That is the whole of the cancellation law on
-        // this side: work already in flight is another matter, and the handler owns it.
-        if (frame.signal.cancelled) {
-            throw new Cancelled(frame.signal.reason ?? "cancelled");
-        }
-        this.effectCount += 1;
-        if (this.effectCount > this.ceiling) {
-            throw new RuntimeFault("L4009", `this run has performed more than ${this.ceiling} effects, which means a loop is not terminating. Add an exit condition or a permit.`);
-        }
-        const resume = verdict.verdict === "pending" ? verdict.entry.external : undefined;
-        // RECOVERY SUBMITS UNDER THE RECORDED IDENTITY. Re-deriving happens to agree whenever nothing
-        // moved, which is exactly why it read as correct: the whole point of writing the id down is
-        // the case where it does NOT agree, and a resumed run that re-derives is reissuing under an
-        // identity the far side may never have seen. An entry with no recorded id predates this rule.
-        const recorded = verdict.verdict === "pending" && verdict.entry.requestId !== undefined ? verdict.entry : undefined;
-        const reqId = recorded?.requestId ?? requestId(this.options.runId, key, inputHash);
-        // WHICH attempt is open, not merely which id. An id alone cannot say how much of an escalation
-        // chain is already spent, and a recovery that cannot tell replays the hop: it mints again under
-        // the id the far side already holds and reads that mint's cached expiry back as a fresh
-        // observation. An entry written before the index existed reads as attempt 0, which is what it
-        // is for every effect that never hops.
-        const attempt = recorded?.attempt ?? 0;
-        if (verdict.verdict === "miss") {
-            this.journal.begin(key, inputHash, this.options.handler.now(), reqId);
-        }
-        const ctx = {
-            key,
-            signal: frame.signal,
-            // Derived from the run, the step, the inputs and the attempt, and written on the pending
-            // entry by `begin` above BEFORE the handler runs. A handler submits under it idempotently,
-            // so a resumed run reissues the same id rather than creating a second goal.
-            requestId: reqId,
-            attempt,
-            ...(resume !== undefined ? { resume } : {}),
-            bind: async (external) => {
-                this.journal.bind(key, external);
-            },
-        };
-        try {
-            const result = await perform(ctx, inputHash);
-            assertCrossable(result, `the result of ${stepKeyString(key)}`);
-            const endedAt = this.options.handler.now();
-            this.journal.settle(key, { status: "ok", result: deepFreeze(result) }, endedAt);
-            frame.clock.advance(endedAt);
-            return result;
-        }
-        catch (e) {
-            const endedAt = this.options.handler.now();
-            if (e instanceof Cancelled) {
-                this.journal.settle(key, { status: "cancelled" }, endedAt);
-                throw e;
-            }
-            // A handler may raise a language code directly, and it survives. The simulator's "unscripted
-            // effect" is L6001, and flattening that to a generic handler fault would tell a caller acting
-            // on `code` that the handler broke, when what actually happened is that their script is
-            // incomplete. Only the L-code shape is honoured: anything else a thrown object happens to
-            // call `code` (an errno, an HTTP status) is a handler fault and is recorded as one.
-            const raised = e.code;
-            const carried = typeof raised === "string" && /^L\d{4}$/.test(raised) ? raised : null;
-            const error = e instanceof EffectError
-                ? { code: e.code, kind: e.kind, message: e.message, ...(e.detail !== undefined ? { detail: e.detail } : {}) }
-                : carried !== null
-                    ? { code: carried, kind: "handler-fault", message: e.message }
-                    : { code: "L4000", kind: "handler-fault", message: e.message };
-            this.journal.settle(key, { status: "failed", error }, endedAt);
-            frame.clock.advance(endedAt);
-            throw e instanceof EffectError ? e : new EffectError(error.code, error.kind, error.message);
-        }
+        return await performEffect(this.effects, kind, name, hashedInput, perform, frame);
     }
     // ---- expressions ------------------------------------------------------------------------------
     async evaluate(node, env, frame) {
@@ -309,48 +472,64 @@ class Interpreter {
                 let out = "";
                 for (let i = 0; i < quasis.length; i += 1) {
                     out += quasis[i].value.cooked;
-                    if (i < exprs.length)
-                        out += String(await this.evaluate(exprs[i], env, frame));
+                    if (i < exprs.length) {
+                        // Primitives interpolate as JavaScript interpolates them; a container or a function is
+                        // refused (L4018). Measured before the refusal: `${o}` on a record with its own
+                        // `toString` crashed in the host's ToPrimitive, and `${f}` on a function PRINTED THE
+                        // INTERPRETER'S OWN COMPILED CLOSURE — an implementation detail leaking into a value.
+                        const v = await this.evaluate(exprs[i], env, frame);
+                        refuseCoercion("${...}", v);
+                        out += String(v);
+                    }
                 }
                 return out;
             }
             case "ArrayExpression": {
                 const out = [];
                 for (const el of node.elements ?? []) {
-                    if (el.type === "SpreadElement") {
-                        const spread = await this.evaluate(el.argument, env, frame);
-                        out.push(...spread);
-                    }
-                    else {
+                    if (el.type === "SpreadElement")
+                        out.push(...this.spreadable(await this.evaluate(el.argument, env, frame)));
+                    else
                         out.push(await this.evaluate(el, env, frame));
-                    }
                 }
-                return out;
+                return born(out, frame.depth);
             }
             case "ObjectExpression": {
                 const out = {};
                 for (const p of node.properties ?? []) {
                     if (p.type === "SpreadElement") {
-                        Object.assign(out, await this.evaluate(p.argument, env, frame));
+                        const src = await this.evaluate(p.argument, env, frame);
+                        if (src !== null && src !== undefined) {
+                            for (const [k, v] of Object.entries(src))
+                                setRecordMember(out, k, v);
+                        }
                         continue;
                     }
                     const key = p.key;
                     const name = key.type === "Identifier" ? key.name : String(key.value);
-                    out[name] = await this.evaluate(p.value, env, frame);
+                    setRecordMember(out, name, await this.evaluate(p.value, env, frame));
                 }
-                return out;
+                return born(out, frame.depth);
             }
             case "MemberExpression": {
                 const obj = await this.evaluate(node.object, env, frame);
-                if (obj === null || obj === undefined) {
-                    if (node.optional === true)
+                if ((obj === null || obj === undefined) && node.optional === true)
+                    throw SHORT_CIRCUIT;
+                return this.memberOf(obj, await this.memberKey(node, env, frame));
+            }
+            case "ChainExpression": {
+                // `a?.b.c(d)`: a nullish `a` ends the WHOLE chain with `undefined`, and nothing after the
+                // `?.` is evaluated. The short-circuit travels as a private sentinel that only this case
+                // catches; a program's `try` cannot see it, because a chain is an expression and a `try`
+                // wraps statements.
+                try {
+                    return await this.evaluate(node.expression, env, frame);
+                }
+                catch (e) {
+                    if (e === SHORT_CIRCUIT)
                         return undefined;
-                    throw new RuntimeFault("L4010", `cannot read a field of ${String(obj)}`);
+                    throw e;
                 }
-                const prop = node.computed === true
-                    ? String(await this.evaluate(node.property, env, frame))
-                    : node.property.name;
-                return obj[prop];
             }
             case "UnaryExpression": {
                 const v = await this.evaluate(node.argument, env, frame);
@@ -358,15 +537,40 @@ class Interpreter {
                     case "!":
                         return !v;
                     case "-":
+                        refuseCoercion("-", v);
                         return -v;
                     case "+":
+                        refuseCoercion("+", v);
                         return +v;
+                    case "~":
+                        refuseCoercion("~", v);
+                        return ~v;
                     case "typeof":
                         return typeof v;
                     default:
                         throw new RuntimeFault("L1000", `unsupported unary operator ${String(node.operator)}`);
                 }
             }
+            case "UpdateExpression": {
+                // `x++`, `--o.count`: JavaScript's meaning, with the write going through the same two doors
+                // as an assignment (a binding's depth, a value's writability).
+                const delta = node.operator === "++" ? 1 : -1;
+                const prefix = node.prefix === true;
+                const arg = node.argument;
+                if (arg.type === "Identifier") {
+                    const name = arg.name;
+                    const old = Number(env.get(name));
+                    const next = old + delta;
+                    env.set(name, next, frame.depth);
+                    return prefix ? next : old;
+                }
+                const obj = await this.evaluate(arg.object, env, frame);
+                const key = await this.memberKey(arg, env, frame);
+                const old = Number(this.memberOf(obj, key));
+                const next = old + delta;
+                this.writeMember(obj, key, next, frame);
+                return prefix ? next : old;
+            }
             case "BinaryExpression": {
                 const l = await this.evaluate(node.left, env, frame);
                 const r = await this.evaluate(node.right, env, frame);
@@ -393,15 +597,8 @@ class Interpreter {
                 return (await this.evaluate(node.test, env, frame))
                     ? await this.evaluate(node.consequent, env, frame)
                     : await this.evaluate(node.alternate, env, frame);
-            case "AssignmentExpression": {
-                const value = await this.evaluate(node.right, env, frame);
-                const left = node.left;
-                if (left.type !== "Identifier") {
-                    throw new RuntimeFault("L2031", "only a plain binding can be assigned to");
-                }
-                env.set(left.name, value);
-                return value;
-            }
+            case "AssignmentExpression":
+                return await this.assign(node, env, frame);
             case "AwaitExpression":
                 return await this.evaluate(node.argument, env, frame);
             case "ArrowFunctionExpression":
@@ -413,60 +610,139 @@ class Interpreter {
                 throw new RuntimeFault("L1000", `unsupported expression ${node.type}`);
         }
     }
+    /**
+     * Every assignment operator, on a binding or a member: `x = v`, `x += v`, `o.a ??= v`,
+     * `[a, b] = [b, a]`. The operator's meaning is JavaScript's; the write goes through the binding's
+     * depth check ({@link Env.set}) or the value's writability check ({@link Interpreter.writeMember}).
+     */
+    async assign(node, env, frame) {
+        const op = node.operator;
+        const left = node.left;
+        if (left.type === "ObjectPattern" || left.type === "ArrayPattern") {
+            const value = await this.evaluate(node.right, env, frame);
+            await this.bindPattern(left, value, env, frame, "assign");
+            return value;
+        }
+        const read = left.type === "Identifier"
+            ? { get: () => env.get(left.name), set: (v) => env.set(left.name, v, frame.depth) }
+            : await (async () => {
+                const obj = await this.evaluate(left.object, env, frame);
+                const key = await this.memberKey(left, env, frame);
+                return { get: () => this.memberOf(obj, key), set: (v) => this.writeMember(obj, key, v, frame) };
+            })();
+        if (op === "=") {
+            const v = await this.evaluate(node.right, env, frame);
+            read.set(v);
+            return v;
+        }
+        if (op === "&&=" || op === "||=" || op === "??=") {
+            const cur = read.get();
+            const proceed = op === "&&=" ? Boolean(cur) : op === "||=" ? !cur : cur === null || cur === undefined;
+            if (!proceed)
+                return cur;
+            const v = await this.evaluate(node.right, env, frame);
+            read.set(v);
+            return v;
+        }
+        const cur = read.get();
+        const r = await this.evaluate(node.right, env, frame);
+        const v = applyBinary(op.slice(0, -1), cur, r);
+        read.set(v);
+        return v;
+    }
+    /** What `...x` and `for (const v of x)` may iterate: an array or a string, and nothing else (L4015). */
+    spreadable(v) {
+        if (Array.isArray(v))
+            return v;
+        if (typeof v === "string")
+            return [...v];
+        throw new RuntimeFault("L4015", `${v === null ? "null" : typeof v === "object" ? "a record" : typeof v} is not iterable: only arrays and strings can be spread or looped over. For a record, iterate \`keys(record)\` or \`entries(record)\`.`);
+    }
     makeFunction(node, closure) {
         const params = node.params ?? [];
         const body = node.body;
         const isExpressionBody = body.type !== "BlockStatement";
-        return async (frame, args) => {
-            const env = new Env(closure);
+        const self = async (frame, args) => {
+            // The calling FRAME decides the depth, not the closure: a helper declared at the top level
+            // and called from inside a branch is executing concurrently, whatever scope it was written in.
+            const env = new Env(closure, frame.depth);
+            // A named function expression sees its own name: `const f = function walk(n) { ... walk() }`.
+            if (node.type === "FunctionExpression" && node.id !== null && node.id !== undefined) {
+                env.declare(node.id.name, self, false);
+            }
             for (let i = 0; i < params.length; i += 1) {
-                await this.bindPattern(params[i], args[i], env, frame, true);
+                const param = params[i];
+                if (param.type === "RestElement") {
+                    await this.bindPattern(param.argument, born(args.slice(i), frame.depth), env, frame, "let");
+                    break;
+                }
+                await this.bindPattern(param, args[i], env, frame, "let");
             }
             if (isExpressionBody)
                 return await this.evaluate(body, env, frame);
             const c = await this.executeBlock(body, env, frame);
             return c.type === "return" ? c.value : undefined;
         };
+        return self;
     }
-    async bindPattern(pattern, value, env, frame, mutable) {
+    /**
+     * Bind a pattern: declare its names (`const`/`let`, including parameters, which are `let`) or
+     * assign to bindings that already exist (`assign`, for `[a, b] = [b, a]`).
+     */
+    async bindPattern(pattern, value, env, frame, mode) {
         switch (pattern.type) {
             case "Identifier":
-                env.declare(pattern.name, value, mutable);
+                if (mode === "assign")
+                    env.set(pattern.name, value, frame.depth);
+                else
+                    env.declare(pattern.name, value, mode === "let");
+                return;
+            case "MemberExpression": {
+                // Only reachable in `assign` mode: `[o.a, o.b] = pair`.
+                const obj = await this.evaluate(pattern.object, env, frame);
+                this.writeMember(obj, await this.memberKey(pattern, env, frame), value, frame);
                 return;
+            }
             case "AssignmentPattern":
-                await this.bindPattern(pattern.left, value === undefined ? await this.evaluate(pattern.right, env, frame) : value, env, frame, mutable);
+                await this.bindPattern(pattern.left, value === undefined ? await this.evaluate(pattern.right, env, frame) : value, env, frame, mode);
                 return;
             case "ObjectPattern": {
-                const src = (value ?? {});
+                if (value === null || value === undefined) {
+                    throw new RuntimeFault("L4010", `cannot destructure ${String(value)}: there are no fields to take`);
+                }
+                const src = value;
                 const taken = [];
                 for (const p of pattern.properties) {
                     if (p.type === "RestElement") {
                         const rest = {};
                         for (const [k, v] of Object.entries(src))
                             if (!taken.includes(k))
-                                rest[k] = v;
-                        await this.bindPattern(p.argument, rest, env, frame, mutable);
+                                setRecordMember(rest, k, v);
+                        await this.bindPattern(p.argument, born(rest, frame.depth), env, frame, mode);
                         continue;
                     }
                     const key = p.key;
                     const name = key.type === "Identifier" ? key.name : String(key.value);
                     taken.push(name);
-                    await this.bindPattern(p.value, src[name], env, frame, mutable);
+                    await this.bindPattern(p.value, this.memberOf(src, name), env, frame, mode);
                 }
                 return;
             }
             case "ArrayPattern": {
-                const src = (value ?? []);
+                if (value === null || value === undefined) {
+                    throw new RuntimeFault("L4010", `cannot destructure ${String(value)}: there are no elements to take`);
+                }
+                const src = this.spreadable(value);
                 const els = pattern.elements;
                 for (let i = 0; i < els.length; i += 1) {
                     const el = els[i];
                     if (el === null || el === undefined)
                         continue;
                     if (el.type === "RestElement") {
-                        await this.bindPattern(el.argument, src.slice(i), env, frame, mutable);
+                        await this.bindPattern(el.argument, born(src.slice(i), frame.depth), env, frame, mode);
                         break;
                     }
-                    await this.bindPattern(el, src[i], env, frame, mutable);
+                    await this.bindPattern(el, src[i], env, frame, mode);
                 }
                 return;
             }
@@ -484,11 +760,24 @@ class Interpreter {
         if (callee.type === "Identifier" && PRIMITIVES[callee.name] !== undefined && !env.has(callee.name)) {
             return await this.callPrimitive(callee.name, argNodes, env, frame);
         }
-        const fn = await this.evaluate(callee, env, frame);
+        let fn;
+        if (callee.type === "MemberExpression") {
+            // The one place a method NAME may appear: as the callee. Resolving it here, with the flag,
+            // is what lets `memberOf` refuse the same name everywhere else (L4020).
+            const obj = await this.evaluate(callee.object, env, frame);
+            if ((obj === null || obj === undefined) && callee.optional === true)
+                throw SHORT_CIRCUIT;
+            fn = this.memberOf(obj, await this.memberKey(callee, env, frame), true);
+        }
+        else {
+            fn = await this.evaluate(callee, env, frame);
+        }
+        if ((fn === null || fn === undefined) && node.optional === true)
+            throw SHORT_CIRCUIT;
         const args = [];
         for (const a of argNodes) {
             if (a.type === "SpreadElement")
-                args.push(...(await this.evaluate(a.argument, env, frame)));
+                args.push(...this.spreadable(await this.evaluate(a.argument, env, frame)));
             else
                 args.push(await this.evaluate(a, env, frame));
         }
@@ -497,9 +786,6 @@ class Interpreter {
         }
         return await fn(frame, args);
     }
-    option(bag, key) {
-        return bag === null || typeof bag !== "object" ? undefined : bag[key];
-    }
     async callPrimitive(name, argNodes, env, frame) {
         const spec = PRIMITIVES[name];
         if (spec === undefined)
@@ -511,198 +797,36 @@ class Interpreter {
         const args = [];
         for (const a of argNodes)
             args.push(await this.evaluate(a, env, frame));
-        const bag = args[spec.optionsAt];
-        const stepName = (name === "checkpoint" ? args[0] : this.option(bag, "name"));
-        const handler = this.options.handler;
-        switch (name) {
-            case "spawn": {
-                // The first argument is a persona name, or a record carrying the persona WITH its model
-                // and variant. Only the persona was ever read, so the object form silently dropped model
-                // and variant from both the request and the hash: editing a model did not diverge, and the
-                // handler was never told which model to run. This was missed by an audit that exercised
-                // only the string form, which is the same defect one level up.
-                const spawnSubject = args[0];
-                const persona = typeof spawnSubject === "string" ? spawnSubject : String(this.option(spawnSubject, "persona"));
-                const model = typeof spawnSubject === "string" ? undefined : this.option(spawnSubject, "model");
-                const variant = typeof spawnSubject === "string" ? undefined : this.option(spawnSubject, "variant");
-                // Every accepted option is forwarded, including the three that are policy rather than
-                // identity. Dropping them here would be silent: the validator accepts `permits`, so an
-                // author who writes a budget gets no error and no budget. They are deliberately absent
-                // from `hashedOptions` (§5.12) because they decide the INTERPRETATION of a result, not the
-                // recorded fact, so they are reapplied from current source on resume rather than hashed.
-                const req = {
-                    persona,
-                    ...(model !== undefined ? { model } : {}),
-                    ...(variant !== undefined ? { variant } : {}),
-                    ...(this.option(bag, "worktree") !== undefined ? { worktree: this.option(bag, "worktree") } : {}),
-                    ...(this.option(bag, "role") !== undefined ? { role: this.option(bag, "role") } : {}),
-                    ...(this.option(bag, "join") !== undefined ? { join: this.option(bag, "join") } : {}),
-                    ...(this.option(bag, "permits") !== undefined
-                        ? { permits: this.option(bag, "permits") }
-                        : {}),
-                    ...(this.option(bag, "supervise") !== undefined
-                        ? { supervise: this.option(bag, "supervise") }
-                        : {}),
-                    ...(this.option(bag, "onFork") !== undefined ? { onFork: this.option(bag, "onFork") } : {}),
-                };
-                return await this.performEffect("spawn", stepName ?? persona, 
-                // Model and variant are part of the IDENTITY being spawned, so they are hashed with the
-                // persona (design 5.12). A run that swapped the model under a recorded agent would be
-                // replaying a fact about a different agent.
-                {
-                    persona,
-                    model: model ?? null,
-                    variant: variant ?? null,
-                    worktree: req.worktree ?? null,
-                    role: req.role ?? null,
-                    join: (req.join ?? []).map((c) => c.channel),
-                }, (ctx) => handler.spawn(req, ctx), frame);
-            }
-            case "turn": {
-                const agent = deepFreeze(args[0]);
-                // The deadline STOPS OBSERVATION (design 5.12), so it belongs in the projection: a turn
-                // recorded under a 1m deadline cannot answer what a 10m turn would have produced, and a
-                // resumed run under the edited deadline replaying the old result is the silent-wrong-path
-                // class. Closing that for `checkpoint` and leaving it open on the siblings closed nothing.
-                const deadline = this.option(bag, "deadline");
-                return await this.performEffect("turn", stepName, { agent: agent.agent, deadline: deadline ?? null }, (ctx) => handler.turn({ agent, ...(deadline !== undefined ? { deadline } : {}) }, ctx), frame);
-            }
-            case "ask": {
-                const agent = deepFreeze(args[0]);
-                const schema = this.option(bag, "schema");
-                // Both of these END THE ASKING: `deadline` is the cutoff and `attempts` is how many
-                // schema-failed replies are tolerated before it gives up. A record made under one attempt
-                // is not an answer to what five attempts would have produced.
-                const deadline = this.option(bag, "deadline");
-                const attempts = this.option(bag, "attempts");
-                return await this.performEffect("ask", stepName, { agent: agent.agent, schema: schema ?? null, deadline: deadline ?? null, attempts: attempts ?? null }, (ctx) => handler.ask({
-                    agent,
-                    schema,
-                    ...(deadline !== undefined ? { deadline } : {}),
-                    ...(attempts !== undefined ? { attempts } : {}),
-                }, ctx), frame);
-            }
-            case "checkpoint": {
-                const prompt = args[1];
-                // The disposition is computed from TODAY's source, after the journal is consulted, on the
-                // live path and the replay path alike. performEffect returns the RAW outcome, which is
-                // what the journal holds; the policy sandwich closes here so a resumed run under an edited
-                // onExpiry throws even though nothing about the recorded expiry changed.
-                const onExpiry = this.option(bag, "onExpiry");
-                const schema = this.option(bag, "schema");
-                // The SAME projection the entry is keyed by, so an attempt's identity is a function of the
-                // step it belongs to rather than of anything the escalation invents.
-                // Design 5.12, and every field here earns its place. `timeout` STOPS OBSERVATION, so a
-                // record made under 1m cannot answer what a 3m wait would have seen. `escalate` and its
-                // `to` CREATE AN EFFECT rather than choosing a disposition, so editing them must diverge
-                // rather than be reapplied. `fail` versus `proceed` is the one genuine reapply and stays
-                // out. Hashing only prompt and schema left a timeout edit replaying clean, which is the
-                // silent-wrong-path class this projection exists to close.
-                const cpTimeout = this.option(bag, "timeout");
-                const cpTo = this.option(bag, "to");
-                const cpInput = {
-                    prompt,
-                    schema: schema ?? null,
-                    timeout: cpTimeout ?? null,
-                    ...(onExpiry === "escalate" ? { onExpiry, to: cpTo ?? null } : {}),
-                };
-                return applyCheckpointPolicy((await this.performEffect("checkpoint", stepName, cpInput, async (ctx, inputHash) => {
-                    // ONE hash value, threaded from what the entry is actually keyed by rather than
-                    // re-digested from the projection here. The two agreed, which is exactly the problem:
-                    // a second derivation that happens to match is a coincidence maintained by hand, and
-                    // the first edit to the projection would desync attempt 1's identity from its own
-                    // step with no type error and no failing test.
-                    const attemptId = (n) => requestId(this.options.runId, ctx.key, inputHash, n);
-                    const req = {
-                        prompt,
-                        ...(schema !== undefined ? { schema } : {}),
-                        ...(cpTimeout !== undefined ? { timeout: cpTimeout } : {}),
-                        ...(onExpiry !== undefined ? { onExpiry } : {}),
-                        ...(cpTo !== undefined ? { to: cpTo } : {}),
-                    };
-                    // THE FINAL MINT DOES NOT ASK FOR AN ESCALATION. The interpreter owns the one-hop stop
-                    // rule, and it can only own it if the far side is not simultaneously told to hop: a
-                    // handler that honours `onExpiry` on the wire would mint a third attempt under an
-                    // identity this journal never allocated, and nothing here would ever learn of it.
-                    const finalReq = onExpiry === "escalate" ? { ...req, onExpiry: "proceed" } : req;
-                    // RECOVERY COMPLETES THE OPEN ATTEMPT. IT DOES NOT REPLAY THE CHAIN.
-                    //
-                    // Arriving here with a non-zero attempt means the hop was issued before the crash, so
-                    // the far side is already holding work under this very id. Re-running the live body
-                    // from the top would call the handler again under it and take that call's cached
-                    // expiry for a second observation: the stop rule would be satisfied on paper while the
-                    // run had in fact observed one attempt twice. The chain's shape is recoverable without
-                    // re-running it, because attempt 0's identity is derivable and its outcome is implied:
-                    // the only path that opens attempt 1 is attempt 0 expiring.
-                    if (ctx.attempt > 0) {
-                        const raw = await handler.checkpoint(finalReq, ctx);
-                        return {
-                            ...raw,
-                            attempts: [
-                                { attempt: 0, requestId: attemptId(0), settled: "expired" },
-                                { attempt: ctx.attempt, requestId: ctx.requestId, to: cpTo ?? null, settled: raw.outcome },
-                            ],
-                        };
-                    }
-                    const first = await handler.checkpoint(req, ctx);
-                    if (first.outcome !== "expired" || onExpiry !== "escalate") {
-                        // `ctx.attempt`, not a literal 0. Writing the literal made every recovery relabel the
-                        // open attempt as the first one, which erased the hop from the journal and left the
-                        // record claiming the escalated mint was the original.
-                        return { ...first, attempts: [{ attempt: ctx.attempt, requestId: ctx.requestId, settled: first.outcome }] };
-                    }
-                    // ESCALATION STAYS INSIDE THIS ENTRY. The program made one call, and the interpreter
-                    // owns key allocation, so a second mint must not become a second occurrence. What it
-                    // does need is a second IDENTITY, derived from attempt 1 before the mint happens, or a
-                    // crash between minting and recording leaves live work nothing in the journal names.
-                    //
-                    // Name the open attempt on the pending row BEFORE issuing it, index and all.
-                    const nextId = attemptId(1);
-                    this.journal.reissueAs(ctx.key, nextId, 1);
-                    const second = await handler.checkpoint(finalReq, { ...ctx, requestId: nextId, attempt: 1 });
-                    // ONE HOP. An escalation that can escalate again never terminates, so a second expiry
-                    // settles as expired and the program decides, exactly as `proceed` would.
-                    return {
-                        ...second,
-                        attempts: [
-                            { attempt: 0, requestId: ctx.requestId, settled: "expired" },
-                            { attempt: 1, requestId: nextId, to: cpTo ?? null, settled: second.outcome },
-                        ],
-                    };
-                }, frame)), onExpiry);
-            }
-            case "sleep": {
-                const duration = args[0];
-                parseDuration(duration); // fail at the call, not inside the handler
-                // The duration IS hashed (design 5.12). It determines the recorded fact: a resumed run
-                // reads the elapsed time back through the run clock, so editing 1h to 1m must diverge
-                // rather than silently keep the path the old duration chose. This hashed `null` until
-                // critic2 executed it, and the rule it violates is one this lane wrote and then only
-                // ever applied to the document.
-                return await this.performEffect("sleep", stepName ?? "", { duration }, (ctx) => handler.sleep({ duration }, ctx), frame);
-            }
-            case "wait": {
-                const event = deepFreeze(args[0]);
-                const timeout = this.option(bag, "timeout");
-                // A `wait` that resolved null did not observe "the event never happens": it observed "the
-                // event did not happen WITHIN THIS TIMEOUT". Editing the timeout therefore asks a different
-                // question, and replaying the recorded null answers the old one. This is the same hole the
-                // checkpoint projection closed, and leaving it open here left `?? recovery` steering off a
-                // stale cutoff.
-                return await this.performEffect("wait", stepName ?? "", { event, timeout: timeout ?? null }, (ctx) => handler.wait({ event, ...(timeout !== undefined ? { timeout } : {}) }, ctx), frame);
-            }
-            case "notify": {
-                const agents = deepFreeze(args[0]);
-                const fact = deepFreeze(args[1]);
-                return await this.performEffect("notify", stepName ?? "", { agents: agents.map((a) => a.agent), fact }, (ctx) => handler.notify({ agents, fact }, ctx), frame);
-            }
-            case "monitor": {
-                const agent = deepFreeze(args[0]);
-                return await this.performEffect("monitor", stepName ?? "", { agent: agent.agent }, (ctx) => handler.monitor({ agent }, ctx), frame);
-            }
-            default:
-                throw new RuntimeFault("L1000", `${name} is not implemented in this interpreter`);
+        return await dispatchPrimitive(this.effects, name, args, frame);
+    }
+    /**
+     * The `branchDigest`, over the arms a settled `race` will never be walked into.
+     *
+     * STRUCTURE, NOT TEXT AND NOT POSITION. Acorn nodes carry `start`/`end`, and an edit anywhere
+     * earlier in the file moves every offset after it — a digest over those would diverge on a run
+     * whose race nobody touched, which is the false positive that teaches people to bypass a check.
+     * Digesting the source SLICE instead would diverge on reindentation for the same reason. What is
+     * hashed is the branch body's shape with positions stripped, so a reformat is silent and an edit
+     * is not.
+     *
+     * Only the LOSERS, because only they are unwalked. The winner's arm is walked entry by entry and
+     * an edit inside it already diverges on the ordinary hash check with the step it broke named —
+     * a strictly better error than "some branch changed". Digesting the winner too would replace that
+     * error with this one, so it does not.
+     */
+    branchDigester(branchesNode) {
+        if (branchesNode?.type !== "ObjectExpression")
+            return undefined;
+        const bodies = new Map();
+        for (const p of branchesNode.properties ?? []) {
+            const key = p.key;
+            const named = key?.name ?? key?.value;
+            if (named !== undefined)
+                bodies.set(named, stripPositions(p.value));
         }
+        return (losers) => digest([...losers]
+            .sort()
+            .map((n) => [n, bodies.has(n) ? bodies.get(n) : null]));
     }
     /**
      * The concurrency combinators.
@@ -712,6 +836,10 @@ class Interpreter {
      * the same named effect cannot race for a counter, and replay reproduces both regardless of
      * which one finished first.
      */
+    /** An options-bag field, read the way the shared scope machinery reads one. */
+    option(bag, key) {
+        return option(bag, key);
+    }
     async callScope(name, argNodes, env, frame) {
         const spec = PRIMITIVES[name];
         if (spec === undefined)
@@ -722,66 +850,24 @@ class Interpreter {
         const bag = bagNode === undefined ? undefined : await this.evaluate(bagNode, env, frame);
         const scopeName = this.option(bag, "name") ?? null;
         const occurrence = frame.keys.nextScope(scopeKind, scopeName);
-        if (name === "parallel" || name === "race") {
-            const entries = Array.isArray(first)
-                ? first.map((fn, i) => [String(i), fn])
-                : Object.entries(first);
-            const frames = entries.map(([k]) => frame.branch(scopeKind, scopeName, occurrence, k));
-            const running = entries.map(([, fn], i) => fn(frames[i], []));
-            if (name === "parallel") {
-                try {
-                    const results = await Promise.all(running);
-                    frame.clock.join(frames.map((f) => f.clock));
-                    return Array.isArray(first)
-                        ? results
-                        : Object.fromEntries(entries.map(([k], i) => [k, results[i]]));
-                }
-                catch (e) {
-                    // The first rejection cancels the rest, then rethrows.
-                    for (const f of frames)
-                        f.signal.cancel("a sibling branch failed");
-                    await Promise.allSettled(running);
-                    frame.clock.join(frames.map((f) => f.clock));
-                    throw e;
-                }
-            }
-            // race: first to settle wins, and the losers are cancelled BY SEMANTICS, not by an API the
-            // program calls. A cancelled branch performs no new effects; an agent reply already in
-            // flight completes and is ignored, which is the documented answer rather than an accident.
-            const winner = await Promise.race(running.map((p, i) => p.then((value) => ({ index: entries[i]?.[0], value }))));
-            for (const f of frames)
-                f.signal.cancel("a sibling branch won the race");
-            await Promise.allSettled(running);
-            frame.clock.join(frames.map((f) => f.clock));
-            return winner;
-        }
-        if (name === "fanOut") {
-            const items = first;
-            const fn = (await this.evaluate(argNodes[1], env, frame));
-            const keyFn = this.option(bag, "key");
-            const branchKeys = [];
-            for (let i = 0; i < items.length; i += 1) {
-                const item = items[i];
-                let k;
-                if (keyFn !== undefined)
-                    k = await keyFn(frame, [item]);
-                else if (item !== null && typeof item === "object" && typeof item.id === "string") {
-                    k = item.id;
-                }
-                else {
-                    throw new RuntimeFault("L3021", `fanOut needs a stable key: without one, a reordered or filtered list silently reshuffles every journal key underneath it. Pass { key: (item) => ... }, or give items a string id.`);
-                }
-                branchKeys.push(String(k));
+        const scopeKey = frame.keys.scopeKey(scopeKind, scopeName, occurrence);
+        // `conclave` is the one scope whose identity includes a SUBJECT (`hashesSubject`): the
+        // members are what the sub-team IS, so editing the member list has to diverge rather than
+        // resume into a different room. The other three are identified by kind, name and occurrence.
+        const subject = spec.hashesSubject
+            ? {
+                members: first.map((m) => m.agent),
+                channel: this.option(bag, "channel") ?? null,
             }
-            if (new Set(branchKeys).size !== branchKeys.length) {
-                throw new RuntimeFault("L3024", `fanOut produced duplicate branch keys (${branchKeys.join(", ")}), so two branches would share one journal namespace and allocate the same step key with different inputs. Nothing has run yet: the keys are all evaluated before any branch launches, because rejecting after launch would be too late by exactly the side effects the check exists to prevent.`);
-            }
-            const frames = branchKeys.map((k) => frame.branch(scopeKind, scopeName, occurrence, k));
-            const results = await Promise.all(items.map((item, i) => fn(frames[i], [item, i])));
-            frame.clock.join(frames.map((f) => f.clock));
-            return results;
-        }
-        throw new RuntimeFault("L1000", `${name} is not implemented in this interpreter`);
+            : undefined;
+        return await performScope(this.effects, scopeKey, frame, async (ctx, only) => await runScope(this.effects, name, scopeKind, scopeName, occurrence, first, 
+        // Deferred, so the body is evaluated where it was evaluated before: after the scope's
+        // entry has begun, not at this call. `parallel` and `race` never ask for it.
+        async () => await this.evaluate(argNodes[1], env, frame), bag, frame, ctx, only), subject, 
+        // `race` alone. `parallel` and `fanOut` have no losers — every branch is a winner and the
+        // walk enters all of them — and a `conclave` cannot be walked into at all, so a digest there
+        // would bind arms nothing was ever going to miss.
+        name === "race" ? this.branchDigester(argNodes[0]) : undefined);
     }
     // ---- statements --------------------------------------------------------------------------------
     async executeBlock(block, env, frame) {
@@ -792,6 +878,17 @@ class Interpreter {
                 inner.declare(s.id.name, this.makeFunction(s, inner), false);
             }
         }
+        // `let`/`const` bind the whole block, holding the dead-zone marker until their line runs, so a
+        // closure called early finds "declared, not yet initialized" (L2004) rather than an outer
+        // binding of the same name — which is what JavaScript does, minus the host error class.
+        for (const s of body) {
+            if (s.type !== "VariableDeclaration")
+                continue;
+            for (const d of s.declarations ?? []) {
+                for (const n of declaredNames(d.id))
+                    inner.declare(n, TDZ, s.kind === "let");
+            }
+        }
         for (const s of body) {
             const c = await this.execute(s, inner, frame);
             if (c.type !== "normal")
@@ -808,10 +905,10 @@ class Interpreter {
                 await this.evaluate(node.expression, env, frame);
                 return NORMAL;
             case "VariableDeclaration": {
-                const mutable = node.kind === "let";
+                const mode = node.kind === "let" ? "let" : "const";
                 for (const d of node.declarations) {
                     const init = d.init === null || d.init === undefined ? undefined : await this.evaluate(d.init, env, frame);
-                    await this.bindPattern(d.id, init, env, frame, mutable);
+                    await this.bindPattern(d.id, init, env, frame, mode);
                 }
                 return NORMAL;
             }
@@ -837,9 +934,22 @@ class Interpreter {
                         return c;
                 }
             case "ForStatement": {
-                const loopEnv = new Env(env);
-                if (node.init !== null && node.init !== undefined)
-                    await this.execute(node.init, loopEnv, frame);
+                let loopEnv = new Env(env);
+                const init = node.init;
+                if (init !== null && init !== undefined) {
+                    if (init.type === "VariableDeclaration")
+                        await this.execute(init, loopEnv, frame);
+                    else
+                        await this.evaluate(init, loopEnv, frame);
+                }
+                // `for (let i ...)` gives EACH ITERATION its own `i`, as JavaScript does: a closure made in
+                // one iteration keeps that iteration's value. The copy happens after the body and before the
+                // update, which is where the specification puts it.
+                const perIteration = [];
+                if (init?.type === "VariableDeclaration" && init.kind === "let") {
+                    for (const d of init.declarations)
+                        collectNames(d.id, perIteration);
+                }
                 for (;;) {
                     if (node.test !== null && node.test !== undefined && !(await this.evaluate(node.test, loopEnv, frame))) {
                         return NORMAL;
@@ -849,17 +959,24 @@ class Interpreter {
                         return NORMAL;
                     if (c.type === "return")
                         return c;
+                    if (perIteration.length > 0)
+                        loopEnv = loopEnv.perIteration(perIteration);
                     if (node.update !== null && node.update !== undefined)
                         await this.evaluate(node.update, loopEnv, frame);
                 }
             }
             case "ForOfStatement": {
-                const iterable = (await this.evaluate(node.right, env, frame));
+                const iterable = this.spreadable(await this.evaluate(node.right, env, frame));
+                const decl = node.left;
                 for (const item of iterable) {
                     const loopEnv = new Env(env);
-                    const decl = node.left;
-                    const target = decl.type === "VariableDeclaration" ? decl.declarations[0].id : decl;
-                    await this.bindPattern(target, item, loopEnv, frame, decl.kind === "let");
+                    if (decl.type === "VariableDeclaration") {
+                        const target = decl.declarations[0].id;
+                        await this.bindPattern(target, item, loopEnv, frame, decl.kind === "let" ? "let" : "const");
+                    }
+                    else {
+                        await this.bindPattern(decl, item, loopEnv, frame, "assign");
+                    }
                     const c = await this.execute(node.body, loopEnv, frame);
                     if (c.type === "break")
                         return NORMAL;
@@ -880,49 +997,108 @@ class Interpreter {
             case "ThrowStatement":
                 throw await this.evaluate(node.argument, env, frame);
             case "TryStatement": {
+                // What a `catch` may not have: none of these is a program error, and none is this
+                // program's to handle. Three kinds, six classes.
+                //
+                // A cancellation is the scope being unwound, and swallowing it would keep a branch
+                // working after it lost a race.
+                //
+                // A durability failure is the JOURNAL refusing to record: the run losing its ability to
+                // have a result at all. A program that catches one goes on performing effects against the
+                // world with nothing recorded from the refusal onward, so those effects exist only in the
+                // world and a resume performs them again. An unrecordable run must stop, and no `catch`
+                // may decide otherwise.
+                //
+                // And a DIVERGENCE, or a migration walk's refusal to enter a scope, is the journal saying
+                // this program is not the one that wrote it. Measured before this line existed: a resume
+                // whose edited `sleep` diverged inside a `try` caught `{ code: "L4000", kind: "host" }`,
+                // logged past it, and performed a NEW effect against the journal it had just diverged
+                // from; a migration's dry walk would have reported the same program clean.
+                //
+                // AND `finally` IS BOUND BY THE SAME LAW. A finalizer runs on the way out, so an
+                // unconditional one handed the program a landing past every class above: measured, a
+                // `finally` performed a NEW effect after a RunReleased and after a store rejection, and a
+                // `finally { throw ... }` REPLACED a divergence, which an outer catch then swallowed as an
+                // ordinary error. An uncatchable fault now unwinds past the finalizer too: the run's
+                // continuation is forfeit, and that includes its cleanup — the world-side recovery belongs
+                // to the driver and the journal, not to the program that just lost the right to run.
+                const uncatchable = (e) => e instanceof Cancelled ||
+                    e instanceof JournalAppendRejected ||
+                    e instanceof RunReleased ||
+                    e instanceof RunDivergence ||
+                    e instanceof ScopeBranchMissing ||
+                    e instanceof UnwalkableScope;
+                // JavaScript's completion semantics, which the one-`try` shape this replaced could not
+                // express (measured: `try { return 1; } finally { return 2; }` returned 1): the finalizer
+                // always runs for ordinary completions, and an ABRUPT finalizer completion — a return, a
+                // break, a throw — replaces whatever the try or catch had decided.
+                let completion = NORMAL;
+                let pendingThrow;
+                let hasThrow = false;
                 try {
-                    const c = await this.execute(node.block, env, frame);
-                    if (c.type !== "normal")
-                        return c;
+                    completion = await this.execute(node.block, env, frame);
                 }
                 catch (e) {
-                    // A cancellation is not a program error: it is the scope being unwound, and a catch
-                    // block must not be able to swallow it and keep working in a branch that lost a race.
-                    if (e instanceof Cancelled)
+                    if (uncatchable(e))
                         throw e;
                     const handlerNode = node.handler;
-                    if (handlerNode === null || handlerNode === undefined)
-                        throw e;
-                    const catchEnv = new Env(env);
-                    if (handlerNode.param !== null && handlerNode.param !== undefined) {
-                        await this.bindPattern(handlerNode.param, toProgramError(e), catchEnv, frame, false);
+                    if (handlerNode === null || handlerNode === undefined) {
+                        hasThrow = true;
+                        pendingThrow = e;
                     }
-                    const c = await this.executeBlock(handlerNode.body, catchEnv, frame);
-                    if (c.type !== "normal")
-                        return c;
-                }
-                finally {
-                    if (node.finalizer !== null && node.finalizer !== undefined) {
-                        await this.execute(node.finalizer, env, frame);
+                    else {
+                        try {
+                            const catchEnv = new Env(env);
+                            if (handlerNode.param !== null && handlerNode.param !== undefined) {
+                                await this.bindPattern(handlerNode.param, toProgramError(e), catchEnv, frame, "const");
+                            }
+                            completion = await this.executeBlock(handlerNode.body, catchEnv, frame);
+                        }
+                        catch (ce) {
+                            if (uncatchable(ce))
+                                throw ce;
+                            hasThrow = true;
+                            pendingThrow = ce;
+                        }
                     }
                 }
-                return NORMAL;
+                if (node.finalizer !== null && node.finalizer !== undefined) {
+                    // A throw inside the finalizer — its own, or an uncatchable — propagates from here,
+                    // replacing any pending completion, exactly as JavaScript replaces it.
+                    const f = await this.execute(node.finalizer, env, frame);
+                    if (f.type !== "normal")
+                        return f;
+                }
+                if (hasThrow)
+                    throw pendingThrow;
+                return completion;
             }
             case "SwitchStatement": {
+                // JavaScript's selection: the case tests are tried in source order, the `default` clause's
+                // position is skipped during matching, and `default` is entered only when NO case matched.
+                // The one-pass walk this replaced treated `default` as an immediate match, so a `default`
+                // written above a matching case shadowed it (measured: `default` ran, `case 2` did not).
+                // Execution then falls through from the selected clause in source order, `default`
+                // included, exactly as JavaScript falls.
                 const disc = await this.evaluate(node.discriminant, env, frame);
                 const cases = node.cases;
                 const switchEnv = new Env(env);
-                let matched = false;
-                for (const c of cases) {
-                    if (!matched) {
-                        if (c.test === null || c.test === undefined)
-                            matched = true;
-                        else if (Object.is(await this.evaluate(c.test, switchEnv, frame), disc))
-                            matched = true;
-                    }
-                    if (!matched)
+                let start = -1;
+                for (let i = 0; i < cases.length; i += 1) {
+                    const c = cases[i];
+                    if (c.test === null || c.test === undefined)
                         continue;
-                    for (const s of c.consequent ?? []) {
+                    if ((await this.evaluate(c.test, switchEnv, frame)) === disc) {
+                        start = i;
+                        break;
+                    }
+                }
+                if (start === -1)
+                    start = cases.findIndex((c) => c.test === null || c.test === undefined);
+                if (start === -1)
+                    return NORMAL;
+                for (let i = start; i < cases.length; i += 1) {
+                    for (const s of cases[i].consequent ?? []) {
                         const comp = await this.execute(s, switchEnv, frame);
                         if (comp.type === "break")
                             return NORMAL;
@@ -940,46 +1116,154 @@ class Interpreter {
     }
 }
 // ---- helpers -------------------------------------------------------------------------------------
+/** The names a declaration's pattern introduces, for the dead-zone pre-pass. */
+function declaredNames(pattern) {
+    const out = [];
+    const walk = (n) => {
+        if (n === null || n === undefined)
+            return;
+        switch (n.type) {
+            case "Identifier":
+                out.push(n.name);
+                return;
+            case "ObjectPattern":
+                for (const p of n.properties ?? [])
+                    walk((p.type === "RestElement" ? p.argument : p.value));
+                return;
+            case "ArrayPattern":
+                for (const el of n.elements ?? [])
+                    walk(el);
+                return;
+            case "AssignmentPattern":
+                walk(n.left);
+                return;
+            case "RestElement":
+                walk(n.argument);
+                return;
+            default:
+                return;
+        }
+    };
+    walk(pattern);
+    return out;
+}
+/**
+ * The binary operators, with JavaScript's meaning ON PRIMITIVES. `"a" + 1`, `true + 1` and
+ * `null + 1` mean here exactly what they mean in JavaScript — primitive coercion is pure and
+ * deterministic. A record, an array or a function operand is refused (L4018), a declared
+ * difference: JavaScript would reach for the host's ToPrimitive machinery, which reads `valueOf`/
+ * `toString` off the value — own fields a program can set to its OWN closures. Measured before the
+ * refusal: `o + 1` invoked such a closure without an interpreter frame and crashed with a raw host
+ * TypeError, and without one it silently produced `"[object Object]1"`. `==` and `!=` never reach
+ * this function: the validator refuses them (L1025). `===`/`!==` compare identity and take any
+ * operands.
+ */
+/** Refuse a container or function where a primitive is needed: there is no implicit conversion. */
+function refuseCoercion(where, v) {
+    if (v !== null && (typeof v === "object" || typeof v === "function")) {
+        const kind = typeof v === "function" ? "a function" : Array.isArray(v) ? "an array" : "a record";
+        throw new RuntimeFault("L4018", `\`${where}\` cannot take ${kind}: there is no implicit conversion here, because converting would read \`valueOf\`/\`toString\` off the value — host machinery this language does not have. Convert explicitly: \`json.stringify(value)\` for text, or read the field you mean.`);
+    }
+}
 function applyBinary(op, l, r) {
+    const a = l;
+    const b = r;
     switch (op) {
         case "===":
-            return Object.is(l, r) || l === r;
+            return l === r;
         case "!==":
-            return !(l === r);
+            return l !== r;
+        default:
+            break;
+    }
+    refuseCoercion(op, l);
+    refuseCoercion(op, r);
+    switch (op) {
         case "<":
-            return l < r;
+            return a < b;
         case "<=":
-            return l <= r;
+            return a <= b;
         case ">":
-            return l > r;
+            return a > b;
         case ">=":
-            return l >= r;
+            return a >= b;
         case "+":
-            return typeof l === "string" || typeof r === "string"
-                ? String(l) + String(r)
-                : l + r;
+            return a + b;
         case "-":
-            return l - r;
+            return a - b;
         case "*":
-            return l * r;
+            return a * b;
         case "/":
-            return l / r;
+            return a / b;
         case "%":
-            return l % r;
+            return a % b;
+        case "**":
+            return a ** b;
+        case "&":
+            return a & b;
+        case "|":
+            return a | b;
+        case "^":
+            return a ^ b;
+        case "<<":
+            return a << b;
+        case ">>":
+            return a >> b;
+        case ">>>":
+            return a >>> b;
         default:
             throw new RuntimeFault("L1000", `unsupported operator ${op}`);
     }
 }
-/** What a `catch` block sees: a plain record, because programs branch on data, not on classes. */
+/** A canonical array index (`"0"`, `"12"`), as a number, or nothing. */
+function arrayIndex(prop) {
+    if (!/^(0|[1-9][0-9]*)$/.test(prop))
+        return undefined;
+    const n = Number(prop);
+    return n <= 4294967294 ? n : undefined;
+}
+/** The names a binding pattern introduces. */
+function collectNames(pattern, out) {
+    switch (pattern.type) {
+        case "Identifier":
+            out.push(pattern.name);
+            return;
+        case "AssignmentPattern":
+            collectNames(pattern.left, out);
+            return;
+        case "RestElement":
+            collectNames(pattern.argument, out);
+            return;
+        case "ObjectPattern":
+            for (const p of pattern.properties)
+                collectNames((p.type === "RestElement" ? p.argument : p.value), out);
+            return;
+        case "ArrayPattern":
+            for (const el of pattern.elements)
+                if (el !== null && el !== undefined)
+                    collectNames(el, out);
+            return;
+        default:
+            return;
+    }
+}
+/** The optional-chain short-circuit. Private to `evaluate`; see the `ChainExpression` case. */
+const SHORT_CIRCUIT = Symbol("cotal-lang short circuit");
+/**
+ * What a `catch` block sees. A failure the RUNTIME raised (an effect's error, an interpreter fault)
+ * arrives as a plain record carrying its code, because programs branch on data, not on classes; a
+ * value the PROGRAM threw arrives as itself, whatever it is, exactly as JavaScript delivers it. A
+ * program cannot construct an `Error`, so anything that is one came from the runtime or the host.
+ */
 function toProgramError(e) {
     if (e instanceof EffectError) {
         return deepFreeze({ code: e.code, kind: e.kind, message: e.message, ...(e.detail !== undefined ? { detail: e.detail } : {}) });
     }
     if (e instanceof RuntimeFault)
         return deepFreeze({ code: e.code, kind: "runtime", message: e.message });
-    if (e !== null && typeof e === "object")
-        return e;
-    return deepFreeze({ code: "L4000", kind: "thrown", message: String(e) });
+    if (e instanceof Error)
+        return deepFreeze({ code: "L4000", kind: "host", message: e.message });
+    return e;
 }
 // ---- the public entry point -------------------------------------------------------------------------
 /**
@@ -990,16 +1274,41 @@ function toProgramError(e) {
  */
 export async function run(source, options) {
     const { ast } = validate(source, options.file);
-    const programHash = digest({ source });
-    const interp = new Interpreter(ast, options, programHash);
-    const frame = new Frame(new KeyScope(), new RunClock(options.handler.now()), new Signal());
+    const programHash = programHashOf(source);
+    // A resume is handed the pins the run STARTED under and binds to them; a fresh run resolves them
+    // once, here, and hands them back for the run record.
+    //
+    // AND A RESUME MAY NOT DECLINE TO SAY WHICH RUN IT IS RESUMING. Re-resolving the pins for a run
+    // handed history but none is not a smaller version of the right behaviour: it is a different run
+    // wearing the same journal. The clock moves to the RESUMING host and the seed falls back to the
+    // runId default, so both the logical epoch and every pure draw change, and nothing refuses,
+    // because nothing can. Pure draws are not journalled and the epoch is not a recorded fact, so
+    // there is no divergence for the replay to catch.
+    //
+    // A journal with NO entries is a different thing and stays allowed: that is a FRESH run being
+    // handed a journal for its store, not a resume.
+    if (options.pins === undefined && options.journal !== undefined && options.journal.entries().length > 0) {
+        throw new RuntimeFault("L5021", `run ${options.runId} was handed a journal with ${options.journal.entries().length} recorded step(s) but no pins. The pins are what decide `
+            + `the run's logical epoch and its seed, so resolving them again here would make this a different run against a journal that was not `
+            + `written for it — silently, because neither the clock nor a pure draw is a recorded fact the replay could diverge on.\n\n`
+            + `Options\n  pass the pins from the run record\n  start a fresh run instead of resuming this journal`);
+    }
+    const pins = options.pins !== undefined
+        ? bindPins(options.pins, options, WALKER_LANGUAGE_VERSION)
+        : resolvePins(options, options.handler.now(), WALKER_LANGUAGE_VERSION);
+    const interp = new Interpreter(ast, options, programHash, pins);
+    // The run clock starts at the run's LOGICAL epoch, not at this host's clock: a run resumed on
+    // another machine hours later must see the same `now()` before its first effect as the run that
+    // wrote the journal, or the branch it takes is a property of when it was resumed.
+    const frame = new Frame(new KeyScope(), new RunClock(pins.startedAt), new Signal());
     const env = new Env(null);
-    installGlobals(env, interp, frame);
+    installGlobals(env, interp);
     const completion = await interp.executeBlock(ast, env, frame);
     return {
         value: completion.type === "return" ? completion.value : undefined,
         journal: interp.journal,
         programHash,
+        pins,
         steps: interp.stepCount,
     };
 }
@@ -1008,110 +1317,19 @@ export async function resume(source, journal, options) {
     journal.resetConsumed();
     return await run(source, { ...options, journal });
 }
-function installGlobals(env, interp, rootFrame) {
+function installGlobals(env, interp) {
     const fn = (impl) => async (frame, args) => impl(frame, args);
-    // Pure primitives: a channel name is a name, so naming one costs nothing and journals nothing.
-    env.declare("channel", fn((_f, a) => ({ channel: a[0] })), false);
-    env.declare("run", fn(() => ({ id: interp.options.runId, programHash: interp.programHash })), false);
-    // Event constructors are pure descriptors; awaiting them is `wait`.
-    env.declare("replied", fn((_f, a) => ({ event: "replied", agent: a[0].agent })), false);
-    env.declare("message", fn((_f, a) => {
-        const ch = a[0].channel;
-        const opts = (a[1] ?? {});
-        return {
-            event: "message",
-            channel: ch,
-            ...(opts.from !== undefined ? { from: opts.from.agent } : {}),
-            ...(opts.matches !== undefined ? { matches: opts.matches } : {}),
-        };
-    }), false);
-    env.declare("idle", fn((_f, a) => ({ event: "idle", channel: a[0].channel, duration: a[1] })), false);
-    env.declare("down", fn((_f, a) => ({ event: "down", agent: a[0].agent })), false);
-    // Time and randomness, tamed. `now()` reads the branch's own run clock, which is the maximum
-    // endedAt over the effects this point actually awaited: time advances at effect boundaries as a
-    // property of the design rather than a rule anyone has to follow.
-    env.declare("now", fn((frame) => frame.clock.now()), false);
-    env.declare("random", fn((frame) => interp.prng.next(frame.keys.path)), false);
-    env.declare("randomInt", fn((frame, a) => Math.floor(interp.prng.next(frame.keys.path) * a[0])), false);
-    env.declare("pick", fn((frame, a) => {
-        const list = a[0];
-        return list[Math.floor(interp.prng.next(frame.keys.path) * list.length)];
-    }), false);
-    env.declare("duration", fn((_f, a) => parseDuration(a[0])), false);
-    // Records and arrays. Iteration order is insertion order, which is deterministic; sorting for
-    // a hash is a separate concern and happens in canonicalization, not here.
-    env.declare("keys", fn((_f, a) => Object.keys(a[0])), false);
-    env.declare("values", fn((_f, a) => Object.values(a[0])), false);
-    env.declare("entries", fn((_f, a) => Object.entries(a[0])), false);
-    env.declare("has", fn((_f, a) => Object.prototype.hasOwnProperty.call(a[0], a[1])), false);
-    env.declare("merge", fn((_f, a) => ({ ...a[0], ...a[1] })), false);
-    env.declare("len", fn((_f, a) => a[0].length), false);
-    env.declare("range", fn((_f, a) => Array.from({ length: a[0] }, (_, i) => i)), false);
-    env.declare("sum", fn((_f, a) => a[0].reduce((x, y) => x + y, 0)), false);
-    env.declare("concat", fn((_f, a) => a[0].concat(a[1])), false);
-    env.declare("slice", fn((_f, a) => a[0].slice(a[1], a[2])), false);
-    env.declare("reverse", fn((_f, a) => [...a[0]].reverse()), false);
-    env.declare("unique", fn((_f, a) => [...new Set(a[0])]), false);
-    env.declare("join", fn((_f, a) => a[0].join(a[1])), false);
-    // Higher-order builtins take an interpreter function, so they have to await it.
-    const higher = (impl) => async (frame, args) => await impl(frame, args[0], args[1]);
-    env.declare("map", higher(async (frame, list, f) => {
-        const out = [];
-        for (let i = 0; i < list.length; i += 1)
-            out.push(await f(frame, [list[i], i]));
-        return out;
-    }), false);
-    env.declare("filter", higher(async (frame, list, f) => {
-        const out = [];
-        for (let i = 0; i < list.length; i += 1)
-            if (await f(frame, [list[i], i]))
-                out.push(list[i]);
-        return out;
-    }), false);
-    env.declare("find", higher(async (frame, list, f) => {
-        for (let i = 0; i < list.length; i += 1)
-            if (await f(frame, [list[i], i]))
-                return list[i];
-        return null;
-    }), false);
-    env.declare("some", higher(async (frame, list, f) => {
-        for (let i = 0; i < list.length; i += 1)
-            if (await f(frame, [list[i], i]))
-                return true;
-        return false;
-    }), false);
-    env.declare("every", higher(async (frame, list, f) => {
-        for (let i = 0; i < list.length; i += 1)
-            if (!(await f(frame, [list[i], i])))
-                return false;
-        return true;
-    }), false);
-    // Strings and numbers.
-    env.declare("split", fn((_f, a) => a[0].split(a[1])), false);
-    env.declare("trim", fn((_f, a) => a[0].trim()), false);
-    env.declare("lower", fn((_f, a) => a[0].toLowerCase()), false);
-    env.declare("upper", fn((_f, a) => a[0].toUpperCase()), false);
-    env.declare("startsWith", fn((_f, a) => a[0].startsWith(a[1])), false);
-    env.declare("endsWith", fn((_f, a) => a[0].endsWith(a[1])), false);
-    env.declare("contains", fn((_f, a) => a[0].includes(a[1])), false);
-    env.declare("replace", fn((_f, a) => a[0].split(a[1]).join(a[2])), false);
-    env.declare("min", fn((_f, a) => Math.min(...a)), false);
-    env.declare("max", fn((_f, a) => Math.max(...a)), false);
-    env.declare("abs", fn((_f, a) => Math.abs(a[0])), false);
-    env.declare("floor", fn((_f, a) => Math.floor(a[0])), false);
-    env.declare("ceil", fn((_f, a) => Math.ceil(a[0])), false);
-    env.declare("round", fn((_f, a) => Math.round(a[0])), false);
-    env.declare("parseNumber", fn((_f, a) => Number(a[0])), false);
-    env.declare("assert", fn((_f, a) => {
-        if (!a[0])
-            throw new RuntimeFault("L4012", String(a[1] ?? "assertion failed"));
-        return null;
-    }), false);
-    env.declare("log", fn((frame, a) => {
-        interp.options.onLog?.({ scope: scopePathString(frame.keys.path), values: a });
-        return null;
-    }), false);
-    void rootFrame;
+    // The value names. `undefined` is a value the runtime produces, so a program can name it.
+    for (const name of VALUE_NAMES)
+        env.declare(name, undefined, false);
+    // Pure primitives and event constructors: ONE shared table (perform.ts), wrapped into the
+    // walker's calling convention here. Handles are opaque frozen records the runtime mints
+    // (design §4); event constructors are pure descriptors, and awaiting one is `wait`.
+    for (const [name, impl] of freeConstructors({ runId: interp.options.runId, programHash: interp.programHash, startedAt: interp.pins.startedAt }))
+        env.declare(name, fn((_f, a) => impl(a)), false);
+    // The builtin library (design §4), one table in library.ts.
+    for (const [name, value] of builtins(interp.libraryContext()))
+        env.declare(name, value, false);
 }
 export { LangError, LangErrors };
 //# sourceMappingURL=interpret.js.map