@cotal-ai/lang 0.24.0 → 0.25.0

package/dist/engine/worker-entry.js

@@ -0,0 +1,175 @@
+/**
+ * Inside the thread: lockdown, one Compartment, and the run.
+ *
+ * THIS FILE IS THE CONFINEMENT. `lockdown()` runs ONCE, here, at module load and before anything of
+ * the run exists - it is irreversible and realm-wide, so it belongs at the top of a realm nobody
+ * else owns. Each run then gets a Compartment with ZERO ENDOWMENTS and the transform's module is
+ * evaluated in it; the context is the CALL ARGUMENT, not a global, so the program's
+ * `globalThis` is empty and the seam is a value it was handed rather than a name it can reach.
+ *
+ * MEASURED HERE, at ses@2.3.0 on node v26.7.0, rather than assumed:
+ *   inside a Compartment      `Date.now()` and `Math.random()` THROW in secure mode; `process` is
+ *                             undefined; `globalThis` has 0 own keys; and
+ *                             `(function(){}).constructor("return typeof process")()` throws
+ *                             "Function.prototype.constructor is not a valid constructor"
+ *   confinement, not hiding   `({}).constructor === Object` is still true, deliberately: the program
+ *                             shares the realm's intrinsics, it just cannot reach out of it
+ *   the START compartment     KEEPS Date.now, Math.random and process - which is what lets the host
+ *                             half of this thread (the journal, the effect path, the handler) work
+ *                             normally around a program that cannot touch any of them
+ *
+ * WHAT IS NOT HERE, on purpose: no wall-clock timeout, no `terminate()` on a deadline. A thread
+ * killed mid-effect leaves a journal saying a step is pending and nothing that can settle it. The
+ * step budget (L4013) and the shared stop flag are the only two things that end a run.
+ */
+import { parentPort, workerData } from "node:worker_threads";
+import "ses";
+import { Journal } from "../journal.js";
+import { RuntimeFault } from "../errors.js";
+import { assertCrossable } from "../values.js";
+import { EffectError } from "../effects.js";
+import { bridgedSeam } from "./bridge.js";
+import { runOnEngine } from "./host.js";
+// ONCE PER THREAD, and before the run exists.
+lockdown();
+if (parentPort === null)
+    throw new Error("cotal-lang engine worker: no parent port; this module is a worker entry, not a library");
+const port = parentPort;
+const { request, stop, bridge } = workerData;
+/**
+ * The run's cancellation, read where it has always been read.
+ *
+ * Synchronous by necessity - the effect path asks between effects - which is why it is shared memory
+ * rather than a message. The length is loaded atomically because the writer publishes it last.
+ */
+const stopLength = new Int32Array(stop, 0, 1);
+const stopBytes = new Uint8Array(stop, 4);
+const shouldStop = () => {
+    const n = Atomics.load(stopLength, 0);
+    // `.slice` copies out of shared memory: a decoder is not handed a buffer that can change under it.
+    return n > 0 ? new TextDecoder().decode(stopBytes.slice(0, n)) : undefined;
+};
+/**
+ * The confined evaluator: a Compartment per run, with nothing in it.
+ *
+ * `runOnEngine` takes this rather than defaulting to one, and that is the security posture rather
+ * than an inconvenience - turning a module string into a function is exactly where confinement is
+ * applied or lost, so the caller says which it is and a reviewer can see it.
+ */
+const confined = (module) => {
+    const compartment = new Compartment();
+    const factory = compartment.evaluate(module);
+    if (typeof factory !== "function") {
+        throw new RuntimeFault("L1000", `the transformed module must evaluate to a function taking the context, and this one evaluated to ${typeof factory}`);
+    }
+    return factory;
+};
+/**
+ * The seam this run performs against, by the route the request chose.
+ *
+ * `"bridged"`: the handler and the durable store live in the HOST, and both halves ride the port
+ * this thread was handed (`bridge.ts`); the journal is built HERE, over the recorded entries and
+ * that store, so every append is durable in the host before the effect it precedes fires. A
+ * module-named handler keeps its whole path in the thread, journal and all, as it always has.
+ */
+async function buildSeam() {
+    if (request.handler === "bridged") {
+        if (bridge === undefined) {
+            throw new RuntimeFault("L1000", `request ${request.runId} names the bridged handler route but the thread was started without a bridge port; runInWorker is the caller that wires one`);
+        }
+        const seam = bridgedSeam(bridge.port, bridge.clock);
+        return {
+            handler: seam.handler,
+            journal: new Journal({ run: request.runId, entries: request.entries ?? [], store: seam.store }),
+        };
+    }
+    return {
+        handler: await buildHandler(request.handler.module, request.handler.export, request.handler.config),
+        // Exactly the shape this route always had: a journal only when there are entries to resume,
+        // and the fresh case left to the engine's own default.
+        ...(request.entries !== undefined ? { journal: new Journal({ run: request.runId, entries: request.entries }) } : {}),
+    };
+}
+async function buildHandler(module, exportName, config) {
+    const mod = (await import(module));
+    const name = exportName ?? "createHandler";
+    const make = mod[name];
+    if (typeof make !== "function") {
+        throw new RuntimeFault("L1000", `${module} has no \`${name}\` export that is a function. A handler is not serialisable - it holds sockets, a client and a clock - so the request names a module and the thread builds it: that export takes the config and answers an EffectHandler.`);
+    }
+    return make(config);
+}
+async function run() {
+    const seam = await buildSeam();
+    const result = await runOnEngine(request.source, request.module, {
+        runId: request.runId,
+        handler: seam.handler,
+        evaluate: confined,
+        shouldStop,
+        ...(request.file !== undefined ? { file: request.file } : {}),
+        ...(request.pins !== undefined ? { pins: request.pins } : {}),
+        ...(seam.journal !== undefined ? { journal: seam.journal } : {}),
+        ...(request.seed !== undefined ? { seed: request.seed } : {}),
+        ...(request.effectCeiling !== undefined ? { effectCeiling: request.effectCeiling } : {}),
+        ...(request.stepBudget !== undefined ? { stepBudget: request.stepBudget } : {}),
+        onLog: (line) => port.postMessage({ kind: "log", line: { scope: line.scope, values: [...line.values] } }),
+    });
+    // THE RUN'S VALUE CROSSES A BOUNDARY, so it answers to the language's own crossing rule rather
+    // than to the structured-clone algorithm's. A function reaching this line would otherwise fail as
+    // a DataCloneError naming a host algorithm, when what happened is that a run tried to return
+    // something that cannot be recorded.
+    //
+    // ABSENCE IS NOT A VALUE and is not put through a rule about values: a program whose last line is
+    // a statement ends with no value at all, and the walker reports exactly that, so asserting here
+    // would refuse the ordinary case. Measured: the first worker cell written refused its own fixture
+    // with `undefined ... Use null when you mean "no value"` before this line said so.
+    if (result.value !== undefined)
+        assertCrossable(result.value, "the value this run returned");
+    return {
+        ok: true,
+        value: result.value,
+        entries: result.journal.entries(),
+        pins: result.pins,
+        programHash: result.programHash,
+        steps: result.steps,
+    };
+}
+/** The answer a thread owes when it cannot give the one it was asked for. */
+const answerWith = (e) => {
+    const err = e;
+    port.postMessage({
+        kind: "result",
+        result: {
+            ok: false,
+            ...(typeof err?.code === "string" ? { code: err.code } : {}),
+            name: typeof err?.name === "string" ? err.name : "Error",
+            message: typeof err?.message === "string" ? err.message : String(e),
+            // A release's reason is a field on the class (L5012), and an EffectError's kind and detail
+            // are its domain; each crosses as the field it is. See WorkerRunFailed.
+            ...(typeof err?.reason === "string" ? { reason: err.reason } : {}),
+            ...(typeof err?.kind === "string" ? { kind: err.kind } : {}),
+            ...(err?.detail !== undefined && e instanceof EffectError ? { detail: err.detail } : {}),
+        },
+    });
+};
+// `.catch` AFTER `.then(f, g)`, AND THAT IS THE WHOLE POINT: `g` is `f`'s SIBLING, not its handler,
+// so a throw inside `f` was not caught by it. The result post is the throw that matters, because it
+// structured-clones the whole journal, and when it threw, this thread died on an unhandled
+// rejection and exited 0 without answering. The host could then say only "exited before the run
+// answered", which is the wrong cause every time, and MEASURED: a handler binding a function
+// produced exactly that, a DataCloneError naming a host algorithm reported as a silent exit.
+//
+// A BACKSTOP, NOT A DEAD BRANCH, and the difference is worth stating because this comment once
+// claimed the stronger thing. Every value that crosses back is fenced at its own write site:
+// `value` by `assertCrossable` above, `external` and a failure's `detail` by the guards in
+// perform.ts, an effect's `result` at its settle, and a SCOPE's settled value at its own settle.
+// `pins`, `programHash` and `steps` are primitives.
+//
+// THAT LIST IS AN ENUMERATION, so it is true of the fields it names and silent about any other. It
+// was WRONG once, and not hypothetically: this comment claimed the route was unreachable while a
+// scope's settled value crossed unfenced, so a legal program whose branch returned a closure
+// completed on the walker and answered a DataCloneError through a thread. The fence for that landed
+// with the cell that measures it. What survives is the honest reading: this line names no known
+// route at this sha, and it is what makes the day a new field is added LOUD instead of silent.
+run().then((result) => port.postMessage({ kind: "result", result }), answerWith).catch(answerWith);
+//# sourceMappingURL=worker-entry.js.map

package/dist/engine/worker-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker-entry.js","sourceRoot":"","sources":["../../src/engine/worker-entry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAoB,MAAM,qBAAqB,CAAC;AAC/E,OAAO,KAAK,CAAC;AACb,OAAO,EAAE,OAAO,EAAqB,MAAM,eAAe,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAsB,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAIxC,8CAA8C;AAC9C,QAAQ,EAAE,CAAC;AAEX,IAAI,UAAU,KAAK,IAAI;IAAE,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;AACnI,MAAM,IAAI,GAAG,UAAU,CAAC;AAExB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,UAIjC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9C,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC1C,MAAM,UAAU,GAAG,GAAuB,EAAE;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IACtC,mGAAmG;IACnG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAgD,EAAE;IAChF,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAY,CAAC;IACxD,IAAI,OAAO,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,IAAI,YAAY,CACpB,OAAO,EACP,oGAAoG,OAAO,OAAO,EAAE,CACrH,CAAC;IACJ,CAAC;IACD,OAAO,OAAqD,CAAC;AAC/D,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,KAAK,UAAU,SAAS;IACtB,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,YAAY,CACpB,OAAO,EACP,WAAW,OAAO,CAAC,KAAK,6HAA6H,CACtJ,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACpD,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;SAChG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QACnG,4FAA4F;QAC5F,uDAAuD;QACvD,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrH,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,UAA8B,EAAE,MAAe;IACzF,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAA4B,CAAC;IAC9D,MAAM,IAAI,GAAG,UAAU,IAAI,eAAe,CAAC;IAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,OAAO,IAAI,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,YAAY,CACpB,OAAO,EACP,GAAG,MAAM,aAAa,IAAI,2NAA2N,CACtP,CAAC;IACJ,CAAC;IACD,OAAQ,IAA2C,CAAC,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,GAAG;IAChB,MAAM,IAAI,GAAG,MAAM,SAAS,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;QAC/D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,QAAQ,EAAE,QAAQ;QAClB,UAAU;QACV,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;KAC1G,CAAC,CAAC;IACH,+FAA+F;IAC/F,kGAAkG;IAClG,6FAA6F;IAC7F,qCAAqC;IACrC,EAAE;IACF,kGAAkG;IAClG,gGAAgG;IAChG,kGAAkG;IAClG,mFAAmF;IACnF,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IAC7F,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE;QACjC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,GAAG,CAAC,CAAU,EAAQ,EAAE;IACtC,MAAM,GAAG,GAAG,CAAmI,CAAC;IAChJ,IAAI,CAAC,WAAW,CAAC;QACf,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE;YACN,EAAE,EAAE,KAAK;YACT,GAAG,CAAC,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,IAAI,EAAE,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;YACxD,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YACnE,2FAA2F;YAC3F,wEAAwE;YACxE,GAAG,CAAC,OAAO,GAAG,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,GAAG,CAAC,OAAO,GAAG,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC,YAAY,WAAW,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D;KAC5B,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,oGAAoG;AACpG,oGAAoG;AACpG,2FAA2F;AAC3F,gGAAgG;AAChG,6FAA6F;AAC7F,6FAA6F;AAC7F,EAAE;AACF,+FAA+F;AAC/F,6FAA6F;AAC7F,2FAA2F;AAC3F,iGAAiG;AACjG,oDAAoD;AACpD,EAAE;AACF,mGAAmG;AACnG,iGAAiG;AACjG,6FAA6F;AAC7F,oGAAoG;AACpG,gGAAgG;AAChG,+FAA+F;AAC/F,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC"}

package/dist/engine/worker.d.ts

@@ -0,0 +1,156 @@
+/**
+ * One worker thread per run, and the boundary a run's request and answer cross.
+ *
+ * WHY A THREAD AT ALL. `lockdown()` is irreversible and realm-wide: it hardens the intrinsics of the
+ * whole isolate, and a host process that also serves a mesh client, a journal store and a CLI cannot
+ * accept that on its own behalf. A worker gives the run its own realm to harden, and gives the host
+ * an isolate whose intrinsics it still owns.
+ *
+ * WHAT ACTUALLY CROSSES. The run happens INSIDE the thread - the seam, the journal and the effect
+ * host - and the request comes in, the result goes out, with log lines streamed between. The
+ * HANDLER has two routes, chosen by what the handler is. One that can be built from cloneable
+ * config is named BY MODULE and constructed in the thread, whole. One that cannot - a live object
+ * holding sockets, a mesh client, a lease-bound appender - STAYS IN THE HOST, and the thread
+ * forwards the effect seam over a MessagePort (`bridge.ts`): every `EffectHandler` member except
+ * `now()` is async, and the journal's durable half (`JournalStore.append`) is a Promise the
+ * journal awaits before any effect fires, so both survive a port hop with the awaits lining up
+ * exactly as they line up over a PubAck. What is genuinely synchronous is `now()` and the stop
+ * flag, and both go over shared memory. An earlier form of this header ruled the bridge out by
+ * claiming "every journal.* call in the effect path" is synchronous; the durable append never was,
+ * and the in-memory reads that are never leave the thread.
+ *
+ * CANCELLATION IS THE ONE EXCEPTION, and it is why there is a SharedArrayBuffer here. `shouldStop`
+ * is read synchronously, between effects, so it cannot be a message either. The host writes a reason
+ * into shared memory and the run reads it where it always read it. There is NO wall-clock timeout
+ * and no `terminate()` on a deadline: a thread killed mid-effect leaves the journal saying a step is
+ * pending forever, and the step budget plus this flag are the only two things that end a run.
+ *
+ * Measured on this floor (node v26.7.0, ses@2.3.0): lockdown 4.5ms, ONCE per thread; a Compartment
+ * after it 0.03ms, so the per-run cost is the thread, not the confinement; cold start to first
+ * message, lockdown included, 22.8-26.4ms over three spawns.
+ */
+import type { EffectHandler } from "../effects.js";
+import type { JournalEntry, JournalStore } from "./../journal.js";
+import type { RunPins } from "../pins.js";
+export interface WorkerHandlerSpec {
+    /**
+     * The module to import INSIDE the thread. An absolute `file:` URL or a bare package specifier.
+     *
+     * A handler is not serialisable and must not be: it holds sockets, a mesh client and a clock. What
+     * crosses is its NAME.
+     */
+    readonly module: string;
+    /** The export to call. It takes `config` and answers an `EffectHandler`. */
+    readonly export?: string;
+    /** Handed to that export, verbatim. Must be structured-cloneable, being all that crosses. */
+    readonly config?: unknown;
+}
+export interface WorkerRunRequest {
+    readonly source: string;
+    readonly module: string;
+    readonly runId: string;
+    /**
+     * `"bridged"` keeps the handler in the host: the thread forwards the effect seam over a
+     * MessagePort instead of constructing a handler, and the caller supplies the live handler and
+     * store via {@link WorkerRunOptions.bridge}. Exactly one of the two must be chosen — a request
+     * naming both routes, or neither, is a caller that has not decided where its effects run.
+     */
+    readonly handler: WorkerHandlerSpec | "bridged";
+    readonly pins?: RunPins;
+    /** A resume: the recorded entries, rebuilt into the run's journal inside the thread. */
+    readonly entries?: readonly JournalEntry[];
+    readonly file?: string;
+    /**
+     * The caller's loose limits and seed, forwarded so the thread's `bindPins` performs the same
+     * agreement check (L5009) the in-process engines perform: with pins present these must agree or
+     * be absent, and dropping them at this boundary would silently skip that refusal.
+     */
+    readonly seed?: string;
+    readonly effectCeiling?: number;
+    readonly stepBudget?: number;
+}
+export interface WorkerRunOk {
+    readonly ok: true;
+    readonly value: unknown;
+    readonly entries: readonly JournalEntry[];
+    readonly pins: RunPins;
+    readonly programHash: string;
+    readonly steps: number;
+}
+export interface WorkerRunFailed {
+    readonly ok: false;
+    /** The language code where there is one (`L4013`, `L5011`), so a caller can branch as it always has. */
+    readonly code?: string;
+    readonly name: string;
+    readonly message: string;
+    /**
+     * `RunReleased.reason` (L5012), carried as the field it is so a host rebuilding the class does
+     * not have to parse its own sentence back out of the message.
+     */
+    readonly reason?: string;
+    /**
+     * An `EffectError`'s domain fields, carried so a host can rebuild the class whole: `kind` is what
+     * failure handling branches on and `detail` is a recorded value, already fenced at its throw
+     * site. Present together with `code` exactly when the run failed as an effect failure.
+     */
+    readonly kind?: string;
+    readonly detail?: Readonly<Record<string, unknown>>;
+}
+export type WorkerRunResult = WorkerRunOk | WorkerRunFailed;
+export interface WorkerRun {
+    /** The run's answer. It rejects only for a worker that died without one. */
+    readonly done: Promise<WorkerRunResult>;
+    /**
+     * Ask the run to stop, with a reason.
+     *
+     * It is a request, not a kill: the run reads it between effects and at a fuel yield, finishes what
+     * is already in flight, and ends through its own cancellation path with the journal consistent.
+     */
+    stop(reason: string): void;
+}
+/**
+ * THE WORKER ENTRY IS AN INPUT, not something this module derives.
+ *
+ * A thread's entry is a FILE ON DISK, and which file that is depends on how the caller was built and
+ * installed - not on anything this module can see about itself. From the compiled package it is
+ * `new URL("./worker-entry.js", import.meta.url)` resolved in the compiled module; a suite that
+ * wants to grade the SHIPPED artifact names that artifact; a bundler that rewrote the layout names
+ * what it produced. So the composition root passes it, and this module makes no guess.
+ *
+ * It was derived here, and the derivation was measurably wrong. Running from TypeScript sources,
+ * node 22 does not apply the parent's ESM loader hooks to a worker thread: a `.js` entry is
+ * ERR_MODULE_NOT_FOUND, and the `.ts` entry gets exactly one step further before dying on its own
+ * `../journal.js`. Inherited execArgv already carries tsx's `--import` into the thread and an
+ * explicit `execArgv: ["--import", "tsx"]` adds it again; neither changes the answer. No spelling
+ * this module could pick makes a `.ts` tree runnable in a thread on that node - the answer is to run
+ * the BUILD, which is a fact about the caller. Making the entry an argument is what lets the caller
+ * say so, and it is why nothing here is version-conditional.
+ */
+export interface WorkerRunOptions {
+    /**
+     * The module the thread starts at: `engine/worker-entry`, in whatever build the caller is running.
+     * A `file:` URL or an absolute path.
+     */
+    readonly entry: URL | string;
+    /** Called for each `log` the run emits, as it emits it. */
+    readonly onLog?: (line: {
+        scope: string;
+        values: readonly unknown[];
+    }) => void;
+    /**
+     * The live seam a `"bridged"` request runs against: the host's handler and its durable store.
+     * Required exactly when the request says `"bridged"`; see {@link WorkerRunRequest.handler}.
+     */
+    readonly bridge?: {
+        readonly handler: EffectHandler;
+        readonly store: JournalStore;
+    };
+}
+/**
+ * Run a transformed program in its own locked-down thread.
+ *
+ * The worker is terminated when the run answers, however it answers: one thread per run is the whole
+ * point, and a thread that outlives its run is a realm holding a journal nobody is reading.
+ */
+export declare function runInWorker(request: WorkerRunRequest, options: WorkerRunOptions): WorkerRun;
+//# sourceMappingURL=worker.d.ts.map

package/dist/engine/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/engine/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAQ1C,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,wFAAwF;IACxF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,wGAAwG;IACxG,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACrD;AAED,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,eAAe,CAAC;AAE5D,MAAM,WAAW,SAAS;IACxB,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACxC;;;;;OAKG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AA2BD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,GAAG,GAAG,MAAM,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,OAAO,EAAE,CAAA;KAAE,KAAK,IAAI,CAAC;IAC/E;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAA;KAAE,CAAC;CACrF;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,GAAG,SAAS,CA2D3F"}

package/dist/engine/worker.js

@@ -0,0 +1,123 @@
+/**
+ * One worker thread per run, and the boundary a run's request and answer cross.
+ *
+ * WHY A THREAD AT ALL. `lockdown()` is irreversible and realm-wide: it hardens the intrinsics of the
+ * whole isolate, and a host process that also serves a mesh client, a journal store and a CLI cannot
+ * accept that on its own behalf. A worker gives the run its own realm to harden, and gives the host
+ * an isolate whose intrinsics it still owns.
+ *
+ * WHAT ACTUALLY CROSSES. The run happens INSIDE the thread - the seam, the journal and the effect
+ * host - and the request comes in, the result goes out, with log lines streamed between. The
+ * HANDLER has two routes, chosen by what the handler is. One that can be built from cloneable
+ * config is named BY MODULE and constructed in the thread, whole. One that cannot - a live object
+ * holding sockets, a mesh client, a lease-bound appender - STAYS IN THE HOST, and the thread
+ * forwards the effect seam over a MessagePort (`bridge.ts`): every `EffectHandler` member except
+ * `now()` is async, and the journal's durable half (`JournalStore.append`) is a Promise the
+ * journal awaits before any effect fires, so both survive a port hop with the awaits lining up
+ * exactly as they line up over a PubAck. What is genuinely synchronous is `now()` and the stop
+ * flag, and both go over shared memory. An earlier form of this header ruled the bridge out by
+ * claiming "every journal.* call in the effect path" is synchronous; the durable append never was,
+ * and the in-memory reads that are never leave the thread.
+ *
+ * CANCELLATION IS THE ONE EXCEPTION, and it is why there is a SharedArrayBuffer here. `shouldStop`
+ * is read synchronously, between effects, so it cannot be a message either. The host writes a reason
+ * into shared memory and the run reads it where it always read it. There is NO wall-clock timeout
+ * and no `terminate()` on a deadline: a thread killed mid-effect leaves the journal saying a step is
+ * pending forever, and the step budget plus this flag are the only two things that end a run.
+ *
+ * Measured on this floor (node v26.7.0, ses@2.3.0): lockdown 4.5ms, ONCE per thread; a Compartment
+ * after it 0.03ms, so the per-run cost is the thread, not the confinement; cold start to first
+ * message, lockdown included, 22.8-26.4ms over three spawns.
+ */
+import { MessageChannel, Worker } from "node:worker_threads";
+import { serviceBridge } from "./bridge.js";
+/** Where the reason's byte length lives in the shared stop buffer; the bytes follow it. */
+const STOP_HEADER = 4;
+/** Room for the reason. A reason is a sentence, and one that does not fit is truncated, not dropped. */
+const STOP_CAPACITY = 512;
+/**
+ * What a stop with nothing to say arrives as.
+ *
+ * The length is the publish signal, so a zero-length reason would be no stop at all; the previous
+ * spelling floored it at 1 and the run read the one byte that happened to be there. MEASURED through
+ * the real thread: `stop("")` ended the run with a sentence whose last character was a NUL. A stop is
+ * an operator's act and it may not arrive as a control character, so a reason with no bytes is given
+ * this one - a sentence, and true.
+ */
+const NO_REASON = "the operator asked this run to stop and gave no reason";
+/** Write a stop reason into shared memory: the bytes first, then the length that publishes them. */
+function publishStop(buffer, reason) {
+    // `encodeInto`, NOT encode-then-slice: it fills the room with WHOLE code points and reports how
+    // many bytes that took, so a reason too long for the buffer is cut BETWEEN characters instead of
+    // through one. Measured through the real thread before the change: a three-byte character
+    // straddling the last byte of the buffer reached the run as U+FFFD, the replacement character, on
+    // the end of the operator's own sentence.
+    const room = new Uint8Array(buffer, STOP_HEADER, STOP_CAPACITY);
+    const { written } = new TextEncoder().encodeInto(reason === "" ? NO_REASON : reason, room);
+    // LENGTH LAST, and with Atomics: it is what makes the bytes visible, so a reader can never see a
+    // length that promises bytes the writer has not finished writing.
+    Atomics.store(new Int32Array(buffer, 0, 1), 0, written);
+}
+/**
+ * Run a transformed program in its own locked-down thread.
+ *
+ * The worker is terminated when the run answers, however it answers: one thread per run is the whole
+ * point, and a thread that outlives its run is a realm holding a journal nobody is reading.
+ */
+export function runInWorker(request, options) {
+    // ONE ROUTE, DECIDED, before a thread exists to be wrong in. A bridged request with no seam has
+    // nowhere to run its effects; a module-named handler beside a live seam is two answers to where
+    // the effects live, and picking one silently would be this module deciding the caller's
+    // confinement posture for it.
+    if ((request.handler === "bridged") !== (options.bridge !== undefined)) {
+        throw new Error(request.handler === "bridged"
+            ? `request ${request.runId} names the bridged handler route but no bridge seam was supplied; pass options.bridge with the live handler and store`
+            : `request ${request.runId} names a module handler and a bridge seam at once; a run's effects live in the thread or in the host, not both`);
+    }
+    const stop = new SharedArrayBuffer(STOP_HEADER + STOP_CAPACITY);
+    let host;
+    let bridge;
+    if (options.bridge !== undefined) {
+        const channel = new MessageChannel();
+        host = serviceBridge(channel.port1, options.bridge);
+        bridge = { port: channel.port2, clock: host.clock };
+    }
+    // Two literal spellings rather than one spread, so the crossing audit in the engine suite reads
+    // exactly what the thread is handed in each route off this source.
+    const worker = bridge !== undefined
+        ? new Worker(options.entry, { workerData: { request, stop, bridge }, transferList: [bridge.port] })
+        : new Worker(options.entry, { workerData: { request, stop } });
+    const done = new Promise((resolve, reject) => {
+        let answered = false;
+        worker.on("message", (m) => {
+            if (m.kind === "log") {
+                options.onLog?.(m.line);
+                return;
+            }
+            // AN UNKNOWN KIND IS A DISAGREEMENT ABOUT THE PROTOCOL, and it is refused rather than read as
+            // an answer. This branch used to be `else`, so a thread posting anything unexpected resolved
+            // the run with `undefined` and the real result arrived after nobody was listening - a run
+            // reporting success with no value, from a boundary that had already gone wrong.
+            if (m.kind !== "result") {
+                answered = true;
+                reject(new Error(`cotal-lang engine worker sent a message kind this host does not know (${String(m.kind)}); the thread and the host disagree about the boundary`));
+                return;
+            }
+            answered = true;
+            resolve(m.result);
+        });
+        worker.on("error", (e) => reject(e));
+        worker.on("exit", (code) => {
+            // A worker that exits without answering has taken the run's outcome with it, and saying so is
+            // the only honest thing left: the journal may hold a pending step and only the store knows.
+            if (!answered)
+                reject(new Error(`cotal-lang engine worker exited with code ${code} before the run answered`));
+        });
+    }).finally(() => {
+        // The seam closes AFTER the thread is gone, so no in-flight effect answers into a closed port;
+        // terminate() returns a promise and the close rides its settlement.
+        void worker.terminate().finally(() => host?.close());
+    });
+    return { done, stop: (reason) => publishStop(stop, reason) };
+}
+//# sourceMappingURL=worker.js.map

package/dist/engine/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../src/engine/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAI/E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,2FAA2F;AAC3F,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,wGAAwG;AACxG,MAAM,aAAa,GAAG,GAAG,CAAC;AAoF1B;;;;;;;;GAQG;AACH,MAAM,SAAS,GAAG,wDAAwD,CAAC;AAE3E,oGAAoG;AACpG,SAAS,WAAW,CAAC,MAAyB,EAAE,MAAc;IAC5D,gGAAgG;IAChG,iGAAiG;IACjG,0FAA0F;IAC1F,kGAAkG;IAClG,0CAA0C;IAC1C,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;IAChE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC3F,iGAAiG;IACjG,kEAAkE;IAClE,OAAO,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAmCD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,OAAyB,EAAE,OAAyB;IAC9E,gGAAgG;IAChG,gGAAgG;IAChG,wFAAwF;IACxF,8BAA8B;IAC9B,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,OAAO,CAAC,OAAO,KAAK,SAAS;YAC3B,CAAC,CAAC,WAAW,OAAO,CAAC,KAAK,uHAAuH;YACjJ,CAAC,CAAC,WAAW,OAAO,CAAC,KAAK,gHAAgH,CAC7I,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,iBAAiB,CAAC,WAAW,GAAG,aAAa,CAAC,CAAC;IAChE,IAAI,IAAsE,CAAC;IAC3E,IAAI,MAAmE,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;QACrC,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACtD,CAAC;IACD,gGAAgG;IAChG,mEAAmE;IACnE,MAAM,MAAM,GACV,MAAM,KAAK,SAAS;QAClB,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACnG,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAEnE,MAAM,IAAI,GAAG,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC5D,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAqH,EAAE,EAAE;YAC7I,IAAI,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBACrB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YACD,8FAA8F;YAC9F,6FAA6F;YAC7F,0FAA0F;YAC1F,gFAAgF;YAChF,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxB,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,CAAC,IAAI,KAAK,CAAC,yEAAyE,MAAM,CAAE,CAAwB,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC,CAAC;gBAC3L,OAAO;YACT,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACzB,8FAA8F;YAC9F,4FAA4F;YAC5F,IAAI,CAAC,QAAQ;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,6CAA6C,IAAI,0BAA0B,CAAC,CAAC,CAAC;QAChH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACd,+FAA+F;QAC/F,oEAAoE;QACpE,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;AAC/D,CAAC"}

package/dist/errors.d.ts

@@ -81,6 +81,7 @@ export declare const CATALOG: {
     readonly L4018: "No implicit conversion";
     readonly L4019: "Array write past the end";
     readonly L4020: "A method is not a value";
+    readonly L4021: "A callable `then` is not a record member";
     readonly L5001: "Run divergence";
     readonly L5002: "Program hash not available";
     readonly L5003: "Orphaned `spawn` on migrate";
@@ -103,6 +104,8 @@ export declare const CATALOG: {
     readonly L5019: "Fork cannot honour `onFork` on this host";
     readonly L5021: "Resume over a journal without the run's pins";
     readonly L5022: "A recorded branch is not in the migrated source";
+    readonly L5023: "No engine in this build serves this record's language version";
+    readonly L5024: "A recorded value has no canonical form";
     readonly L6001: "Unscripted effect in simulation";
     readonly L6002: "Simulation script entry unused";
 };
@@ -184,4 +187,45 @@ export declare class RuntimeFault extends Error {
     readonly code: string;
     constructor(code: string, message: string);
 }
+/** The message off anything a foreign body throws, read defensively: other people's code may throw a primitive. */
+export declare function messageOf(v: unknown): string;
+/** A recorded step's inputs changed, so its recorded result may no longer be the truth. */
+export declare class RunDivergence extends Error {
+    readonly stepKey: string;
+    readonly recordedHash: string;
+    readonly programHash: string;
+    constructor(stepKey: string, recordedHash: string, programHash: string);
+}
+/**
+ * A migration's walk reached a settled scope it cannot enter.
+ *
+ * A `conclave` is the case that exists today: its channel handle is HANDLER-DERIVED, the mint
+ * returns it and nothing journals it, so a walk cannot re-enter the body without inventing a
+ * handle, and an invented one would re-hash every step inside that used the channel into a
+ * divergence the run never had. Refusing is the honest exit. Consuming the subtree instead would
+ * hide exactly the orphans a migration exists to find, which is a silent wrong answer in place of
+ * a loud refusal.
+ */
+export declare class UnwalkableScope extends Error {
+    readonly scopeKey: string;
+    readonly why: string;
+    constructor(scopeKey: string, why: string);
+}
+/**
+ * A migration's walk was sent into a recorded branch the new source does not have.
+ *
+ * Its own code rather than `RunDivergence`, for the reason the L5005/L5006/L5007 collision in the
+ * orphan table bought: `RunDivergence` is a HASH comparison and says so in both its fields and its
+ * message, and putting branch NAMES in fields called `recordedHash`/`programHash` would be a lie in
+ * the payload a repair loop reads. The author's repair differs too: this one is fixed by looking at
+ * an arm's NAME, not at its body.
+ */
+export declare class ScopeBranchMissing extends Error {
+    readonly scopeKey: string;
+    readonly scope: string;
+    readonly missing: readonly string[];
+    readonly recorded: readonly string[];
+    readonly source: readonly string[];
+    constructor(scopeKey: string, scope: string, missing: readonly string[], recorded: readonly string[], source: readonly string[]);
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,wFAAwF;AACxF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkJV,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,OAAO,CAAC;AAEjD,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,oFAAoF;AACpF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,eAAe;IACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,eAAe;IACf,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,CASlE;AAED,oFAAoF;AACpF,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;gBAEhB,IAAI,EAAE,aAAa;IAW/B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa;IAWrC,uFAAuF;IACvF,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;CAe/B;AAED;;;GAGG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,SAAS,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM;IAOxD,MAAM,IAAI,SAAS,aAAa,EAAE;IAIlC,MAAM,IAAI,MAAM;CAGjB;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAEnC,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAKlB"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,wFAAwF;AACxF,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiKV,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,OAAO,CAAC;AAEjD,iFAAiF;AACjF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,oFAAoF;AACpF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,eAAe;IACf,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,eAAe;IACf,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,CASlE;AAED,oFAAoF;AACpF,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;gBAEhB,IAAI,EAAE,aAAa;IAW/B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa;IAWrC,uFAAuF;IACvF,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;CAe/B;AAED;;;GAGG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,MAAM,EAAE,SAAS,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM;IAOxD,MAAM,IAAI,SAAS,aAAa,EAAE;IAIlC,MAAM,IAAI,MAAM;CAGjB;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,SAAQ,KAAK;IAEnC,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAKlB;AAED,mHAAmH;AACnH,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,CAI5C;AAED,2FAA2F;AAC3F,qBAAa,aAAc,SAAQ,KAAK;IAEpC,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM;gBAFnB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,WAAW,EAAE,MAAM;CAO/B;AAED;;;;;;;;;GASG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IAEtC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM;gBADX,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM;CAOvB;AAED;;;;;;;;GAQG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE;IACnC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE;gBAJzB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,QAAQ,EAAE,SAAS,MAAM,EAAE,EAC3B,MAAM,EAAE,SAAS,MAAM,EAAE;CAuBrC"}