@dougongjs/core 0.3.0 → 0.5.0

package/dist/index.js

@@ -1,65 +1,136 @@
-function rt(r, t) {
+function Ot(r, t) {
   if (typeof t != "string" || !t.trim())
     throw new TypeError(`${r} id must be a non-empty string`);
   if (t !== t.trim())
     throw new TypeError(`${r} id cannot start or end with whitespace`);
 }
-function V(r, t) {
-  return rt("Contract", t), Object.freeze({ id: t, kind: r });
+function Q(r, t) {
+  return Ot("Contract", t), Object.freeze({ id: t, kind: r });
 }
-function v(r, t) {
+function E(r, t) {
   if (!r || typeof r != "object") return !1;
   const e = r;
   return typeof e.id == "string" && e.id.length > 0 && e.id === e.id.trim() && (e.kind === "service" || e.kind === "extensionPoint" || e.kind === "event") && (t === void 0 || e.kind === t);
 }
-function b(r, t) {
-  if (!v(r, t))
-    throw new TypeError(t ? `Expected ${nt(t)}` : "Invalid contract");
+function A(r, t) {
+  if (!E(r, t))
+    throw new TypeError(t ? `Expected ${At(t)}` : "Invalid contract");
 }
-function nt(r) {
+function At(r) {
   return r === "extensionPoint" ? "an ExtensionPoint" : r === "event" ? "an Event" : "a Service";
 }
-function de(r) {
-  return V("service", r);
+function It(r) {
+  return Q("service", r);
 }
-function le(r) {
-  return V("event", r);
+function Le(r) {
+  return Q("event", r);
 }
-function ue(r) {
-  return V("extensionPoint", r);
+function ze(r) {
+  return Q("extensionPoint", r);
 }
-function fe(r) {
-  if (!v(r, "service"))
+function Re(r) {
+  if (!E(r, "service"))
     throw new TypeError("optional() expects a Service");
-  return Object.freeze({ kind: "optional", service: r });
+  return Object.freeze({ kind: "optional", service: It(r.id) });
 }
-function ot(r) {
+function jt(r) {
   if (!r || typeof r != "object") return !1;
   const t = r;
-  return t.kind === "optional" && v(t.service, "service");
+  return t.kind === "optional" && E(t.service, "service");
 }
 class u extends Error {
+  name = "DougongError";
+  code;
   constructor(t, e, i) {
+    if (typeof t != "string" || t.trim() !== t || t.length === 0)
+      throw new TypeError("DougongError code must be a non-empty trimmed string");
+    if (typeof e != "string") throw new TypeError("DougongError message must be a string");
     super(e, i), this.code = t;
   }
+}
+class J extends Error {
+  name = "RecordedFailure";
   code;
-  name = "DougongError";
+  snapshot;
+  constructor(t) {
+    if (!(t instanceof Error)) throw new TypeError("RecordedFailure expects an Error");
+    const e = t instanceof J ? t.snapshot : kt(t);
+    super(e.message), this.code = e.code, this.snapshot = e, e.stack !== void 0 && (this.stack = e.stack), Object.freeze(this);
+  }
+}
+function kt(r) {
+  const t = /* @__PURE__ */ new Set();
+  let e = 32;
+  const i = (s, n) => {
+    if (n > 4 || e-- <= 0 || t.has(s))
+      return Object.freeze({
+        name: "TruncatedError",
+        message: "Error chain truncated",
+        truncated: !0
+      });
+    if (!(s instanceof Error)) {
+      const p = s === null || ["string", "number", "boolean", "undefined", "bigint", "symbol"].includes(typeof s) ? String(s).slice(0, 4096) : "Non-Error object omitted";
+      return Object.freeze({ name: "NonError", message: p });
+    }
+    t.add(s);
+    let o = !1;
+    const a = (p, w) => (p.length > w && (o = !0), p.slice(0, w)), h = (p, w) => {
+      const b = m(s, p);
+      return typeof b == "string" ? a(b, w) : void 0;
+    }, c = (p) => {
+      const w = m(s, p);
+      if (Array.isArray(w))
+        return w.length > 8 && (o = !0), Array.from(
+          { length: Math.min(w.length, 8) },
+          (b, j) => m(w, j)
+        );
+    }, d = h("name", 256) ?? "Error", l = h("message", 4096) ?? "", f = h("stack", 16384), g = h("code", 256), I = m(s, "cause"), et = c("errors"), it = h("manifestName", 256), st = c("denied")?.filter((p) => typeof p == "string").map((p) => a(p, 256)), rt = c("issues")?.map((p) => {
+      const w = m(p, "message"), b = m(p, "path"), j = Array.isArray(b) ? Array.from({ length: Math.min(b.length, 16) }, (Pe, St) => {
+        const k = m(b, St), S = k && typeof k == "object" ? m(k, "key") : k;
+        return typeof S == "number" ? S : typeof S == "string" || typeof S == "symbol" ? a(String(S), 256) : "[omitted]";
+      }) : void 0;
+      return Array.isArray(b) && b.length > 16 && (o = !0), Object.freeze({
+        message: typeof w == "string" ? a(w, 4096) : "",
+        ...j ? { path: Object.freeze(j) } : {}
+      });
+    });
+    return Object.freeze({
+      name: d,
+      message: l,
+      ...g === void 0 ? {} : { code: g },
+      ...f === void 0 ? {} : { stack: f },
+      ...I === void 0 ? {} : { cause: i(I, n + 1) },
+      ...et === void 0 ? {} : { errors: Object.freeze(et.map((p) => i(p, n + 1))) },
+      ...it === void 0 ? {} : { manifestName: it },
+      ...st === void 0 ? {} : { denied: Object.freeze(st) },
+      ...rt === void 0 ? {} : { issues: Object.freeze(rt) },
+      ...o ? { truncated: !0 } : {}
+    });
+  };
+  return i(r, 0);
 }
-class P extends u {
+function m(r, t) {
+  try {
+    return r && typeof r == "object" ? r[t] : void 0;
+  } catch {
+    return;
+  }
 }
-function $(r, t, e) {
-  return r instanceof P ? r.code === t ? r : new P(t, e, { cause: r.cause }) : r instanceof Error ? r : new P(t, e, { cause: r });
+class G extends u {
 }
-function J(r, t) {
+function V(r, t, e) {
+  return r instanceof G ? r.code === t ? r : new G(t, e, { cause: r.cause }) : r instanceof Error ? r : new G(t, e, { cause: r });
+}
+function wt(r, t) {
   if (!r || typeof r != "object" || typeof r.aborted != "boolean" || typeof r.addEventListener != "function" || typeof r.removeEventListener != "function" || typeof r.throwIfAborted != "function")
     throw new TypeError("Cancellation classifier expects an AbortSignal");
   return r.aborted ? Object.is(t, r.reason) ? !0 : t instanceof Error && t.name === "AbortError" : !1;
 }
-class at extends u {
+class $t extends u {
   name = "ConfigValidationError";
   issues;
   constructor(t) {
-    const e = ct(t);
+    const e = Tt(t);
     super(
       "CONFIG_INVALID",
       `Invalid Plugin config:
@@ -68,7 +139,7 @@ ${e.map((i) => `  - ${i.message}`).join(`
     ), this.issues = e;
   }
 }
-function ct(r) {
+function Tt(r) {
   if (!Array.isArray(r))
     throw new TypeError("Config validation issues must be an array");
   return Object.freeze(
@@ -80,23 +151,23 @@ function ct(r) {
         throw new TypeError(`Config validation issue at index ${e} message must be a string`);
       return Object.freeze({
         message: i.message,
-        ...i.path === void 0 ? {} : { path: ht(i.path, e) }
+        ...i.path === void 0 ? {} : { path: Pt(i.path, e) }
       });
     })
   );
 }
-function ht(r, t) {
+function Pt(r, t) {
   if (!Array.isArray(r))
     throw new TypeError(`Config validation issue at index ${t} path must be an array`);
   return Object.freeze(
     Array.from(r, (e, i) => {
-      if (G(e)) return e;
+      if (nt(e)) return e;
       if (!e || typeof e != "object")
         throw new TypeError(
           `Config validation issue at index ${t} path segment ${i} must be a property key`
         );
       const s = e.key;
-      if (!G(s))
+      if (!nt(s))
         throw new TypeError(
           `Config validation issue at index ${t} path segment ${i} must contain a property key`
         );
@@ -104,10 +175,10 @@ function ht(r, t) {
     })
   );
 }
-function G(r) {
+function nt(r) {
   return typeof r == "string" || typeof r == "number" || typeof r == "symbol";
 }
-async function X(r, t, e) {
+async function Lt(r, t, e) {
   if (!r) return t;
   const i = await r["~standard"].validate(t);
   if (!i || typeof i != "object")
@@ -116,7 +187,7 @@ async function X(r, t, e) {
     );
   const s = Object.hasOwn(i, "issues") ? i.issues : void 0;
   if (s !== void 0)
-    throw Array.isArray(s) ? new at(s) : new TypeError(
+    throw Array.isArray(s) ? new $t(s) : new TypeError(
       `Installation '${e}' config validator returned non-array issues`
     );
   if (!Object.hasOwn(i, "value"))
@@ -125,29 +196,29 @@ async function X(r, t, e) {
     );
   return i.value;
 }
-class dt {
+class zt {
   #t = /* @__PURE__ */ new Map();
   get kinds() {
     return this.#t;
   }
   assertCompatible(t) {
-    Z(this.#t, t);
+    bt(this.#t, t);
   }
   remember(t) {
-    T(this.#t, t);
+    q(this.#t, t);
   }
-  draft(t) {
-    return new lt(this, t);
+  writer(t) {
+    return new Rt(this, t);
   }
   commit(t) {
     for (const [e, i] of t) this.assertCompatible({ id: e, kind: i });
     for (const [e, i] of t) this.#t.set(e, i);
   }
 }
-class lt {
+class Rt {
   #t;
   constructor(t, e) {
-    this.#t = { phase: "open", registry: t, pending: /* @__PURE__ */ new Map() };
+    this.#t = { phase: "staged", registry: t, pending: /* @__PURE__ */ new Map() };
     for (const [i, s] of e) this.remember({ id: i, kind: s });
   }
   remember(t) {
@@ -157,21 +228,21 @@ class lt {
       return;
     }
     if (e.phase === "discarded")
-      throw new Error("Contract registry draft has been discarded");
-    e.registry.assertCompatible(t), !e.registry.kinds.has(t.id) && T(e.pending, t);
+      throw new Error("Contract registry writer has been discarded");
+    e.registry.assertCompatible(t), !e.registry.kinds.has(t.id) && q(e.pending, t);
   }
   commit() {
     const t = this.#t;
-    t.phase === "open" && (t.registry.commit(t.pending), this.#t = { phase: "committed", registry: t.registry });
+    t.phase === "staged" && (t.registry.commit(t.pending), this.#t = { phase: "committed", registry: t.registry });
   }
   discard() {
-    this.#t.phase === "open" && (this.#t = { phase: "discarded" });
+    this.#t.phase === "staged" && (this.#t = { phase: "discarded" });
   }
 }
-function T(r, t) {
-  Z(r, t), r.set(t.id, t.kind);
+function q(r, t) {
+  bt(r, t), r.set(t.id, t.kind);
 }
-function Z(r, t) {
+function bt(r, t) {
   const e = r.get(t.id);
   if (e && e !== t.kind)
     throw new u(
@@ -179,9 +250,9 @@ function Z(r, t) {
       `Contract '${t.id}' is used as both '${e}' and '${t.kind}'`
     );
 }
-class M {
-  constructor(t, e, i, s, n, o) {
-    this.order = t, this.layers = e, this.providers = i, this.dependents = s, this.contractKinds = n, this.#t = o;
+class X {
+  constructor(t, e, i, s, n, o, a) {
+    this.order = e, this.layers = i, this.providers = s, this.dependents = n, this.contractKinds = o, this.#t = t, this.#e = a;
   }
   order;
   layers;
@@ -189,13 +260,15 @@ class M {
   dependents;
   contractKinds;
   #t;
+  #e;
   static build(t, e) {
-    const i = [...t].sort((c, d) => c.index - d.index), s = new Map(e), n = ut(i, s), o = ft(i, n, s), { order: a, layers: h } = pt(
+    const i = [...t].sort((c, d) => c.index - d.index), s = new Map(e), n = Nt(i, s), o = xt(i, n, s), { order: a, layers: h } = Mt(
       i,
       o.dependents,
       o.indegree
     );
-    return new M(
+    return new X(
+      new Map(i.map((c) => [c, c.declaration])),
       Object.freeze(a),
       Object.freeze(h.map((c) => Object.freeze(c))),
       n,
@@ -204,17 +277,28 @@ class M {
       o.resolvedProviders
     );
   }
+  declarationFor(t) {
+    const e = this.#t.get(t);
+    if (!e) throw new Error(`Installation '${t.id}' is not in this plan`);
+    return e;
+  }
   providerFor(t, e) {
-    return this.#t.get(t)?.get(e);
+    return this.#e.get(t)?.get(e);
   }
   provider(t) {
     return this.providers.get(t);
   }
+  /**
+   * Transitive dependents in *both* plans. A Service being replaced has old
+   * consumers that must stop and new ones that must start, and only the union
+   * covers both — expanding in the current plan alone would leave an Instance
+   * running against a dependency that no longer exists.
+   */
   affectedByTransitionTo(t, e) {
     const i = /* @__PURE__ */ new Set();
-    return this.#e(e, i), t.#e(e, i), i;
+    return this.#i(e, i), t.#i(e, i), i;
   }
-  #e(t, e) {
+  #i(t, e) {
     const i = [...t], s = /* @__PURE__ */ new Set();
     for (let n = 0; n < i.length; n++) {
       const o = i[n];
@@ -225,11 +309,11 @@ class M {
     }
   }
 }
-function ut(r, t) {
+function Nt(r, t) {
   const e = /* @__PURE__ */ new Map();
   for (const i of r)
-    for (const s of Object.values(i.declaration.plugin.provides ?? {})) {
-      T(t, s);
+    for (const s of Object.values(i.declaration.plugin.provides)) {
+      q(t, s);
       const n = e.get(s.id);
       if (n)
         throw new u(
@@ -240,12 +324,12 @@ function ut(r, t) {
     }
   return e;
 }
-function ft(r, t, e) {
+function xt(r, t, e) {
   const i = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), n = new Map(r.map((o) => [o, 0]));
   for (const o of r)
-    for (const a of Object.values(o.declaration.plugin.requires ?? {})) {
+    for (const a of Object.values(o.declaration.plugin.requires)) {
       const h = a.kind === "optional" ? a.service : a;
-      if (T(e, h), h.kind === "extensionPoint") continue;
+      if (q(e, h), h.kind === "extensionPoint") continue;
       const c = t.get(h.id);
       if (!c) {
         if (a.kind === "optional") continue;
@@ -266,7 +350,7 @@ function ft(r, t, e) {
     }
   return { resolvedProviders: i, dependents: s, indegree: n };
 }
-function pt(r, t, e) {
+function Mt(r, t, e) {
   let i = r.filter((o) => e.get(o) === 0);
   const s = [], n = [];
   for (; i.length; ) {
@@ -280,7 +364,7 @@ function pt(r, t, e) {
       }
   }
   if (s.length !== r.length) {
-    const o = gt(r, t);
+    const o = Dt(r, t);
     throw new u(
       "SERVICE_CYCLE",
       `Installation dependency cycle: ${o.map((a) => a.id).join(" -> ")}`
@@ -288,7 +372,7 @@ function pt(r, t, e) {
   }
   return { order: s, layers: n };
 }
-function gt(r, t) {
+function Dt(r, t) {
   const e = /* @__PURE__ */ new Set(), i = /* @__PURE__ */ new Set(), s = [], n = (o) => {
     i.add(o), s.push(o);
     for (const a of t.get(o) ?? []) {
@@ -309,7 +393,7 @@ function gt(r, t) {
   }
   throw new Error("Dependency graph is cyclic but no cycle path was found");
 }
-class S {
+class z {
   #t;
   constructor(t = []) {
     if (!t || typeof t != "object" && typeof t != "function" || typeof t[Symbol.iterator] != "function")
@@ -341,22 +425,65 @@ class S {
     return this.entries();
   }
 }
-function wt(r) {
+function Vt(r) {
   if (typeof r != "function")
     throw new Error("Unsupported JavaScript runtime: Promise.withResolvers is required");
 }
-function tt(r, t) {
+function mt(r, t) {
   return r ?? Symbol.for(t);
 }
-wt(Promise.withResolvers);
-const g = tt(
+Vt(Promise.withResolvers);
+const v = mt(
   Symbol.dispose,
   "Symbol.dispose"
-), j = tt(
+), F = mt(
   Symbol.asyncDispose,
   "Symbol.asyncDispose"
-), m = /* @__PURE__ */ new WeakMap();
-class q {
+);
+function R(r, t) {
+  if (qt(r))
+    throw Promise.resolve(r).catch(() => {
+    }), new TypeError(t);
+}
+function qt(r) {
+  return r === null || typeof r != "object" && typeof r != "function" ? !1 : typeof r.then == "function";
+}
+const N = /* @__PURE__ */ new WeakMap(), C = /* @__PURE__ */ new Set();
+let T = 0, U = !1;
+function Ft(r) {
+  T++;
+  const t = [];
+  try {
+    r();
+  } catch (e) {
+    t.push(e);
+  } finally {
+    if (T--, !T)
+      try {
+        vt();
+      } catch (e) {
+        t.push(e);
+      }
+  }
+  if (t.length === 1) throw t[0];
+  if (t.length > 1) throw new AggregateError(t, "Snapshot batch failed");
+}
+function vt() {
+  if (U) return;
+  U = !0;
+  const r = [];
+  try {
+    for (; C.size; ) {
+      const t = C.values().next().value;
+      C.delete(t), Gt(t, r);
+    }
+  } finally {
+    U = !1, C.clear();
+  }
+  if (r.length)
+    throw new AggregateError(r, "Snapshot error reporting failed");
+}
+class Z {
   #t = /* @__PURE__ */ new Set();
   #e;
   #i;
@@ -369,24 +496,12 @@ class q {
   }
   view = Object.freeze({
     get: () => this.#n(),
-    subscribe: (t) => this.#o(t)
+    subscribe: (t) => this.#a(t)
   });
   invalidate() {
-    const { report: t } = this.#a();
-    this.#s = !0;
-    const e = [];
-    for (const i of [...this.#t])
-      try {
-        bt(i);
-      } catch (s) {
-        try {
-          t(s);
-        } catch (n) {
-          e.push(s, n);
-        }
-      }
-    if (e.length)
-      throw new AggregateError(e, "Snapshot error reporting failed");
+    this.#o(), this.#s = !0;
+    for (const t of this.#t) C.add(t);
+    T || vt();
   }
   dispose() {
     const t = this.#e;
@@ -398,53 +513,65 @@ class q {
         this.#s = !1;
         const e = [...this.#t];
         this.#t.clear();
-        for (const i of e) mt(i);
+        for (const i of e) yt(i);
       }
     }
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
   #n() {
     const t = this.#e;
     return t.phase === "active" && this.#r(t.read), this.#i;
   }
-  #o(t) {
+  #a(t) {
     if (typeof t != "function") throw new TypeError("Subscriber must be a function");
-    this.#a();
-    const e = new vt(t, (i) => {
-      this.#t.delete(i);
+    const { report: e } = this.#o(), i = new Bt(t, e, (s) => {
+      this.#t.delete(s);
     });
-    return this.#t.add(e), e;
+    return this.#t.add(i), i;
   }
   #r(t) {
     this.#s && (this.#i = t(), this.#s = !1);
   }
-  #a() {
+  #o() {
     const t = this.#e;
     if (t.phase === "disposed") throw new TypeError("Snapshot publisher is disposed");
     return t;
   }
 }
-class vt {
-  constructor(t, e) {
-    m.set(this, { listener: t, detach: e }), Object.freeze(this);
+class Bt {
+  constructor(t, e, i) {
+    N.set(this, { listener: t, report: e, detach: i }), Object.freeze(this);
   }
   dispose() {
-    const t = m.get(this);
-    t && (m.delete(this), t.detach(this));
+    const t = N.get(this);
+    t && (yt(this), t.detach(this));
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
 }
-function bt(r) {
-  m.get(r)?.listener();
+function Gt(r, t) {
+  const e = N.get(r);
+  if (e)
+    try {
+      R(e.listener(), "Snapshot subscribers must be synchronous");
+    } catch (i) {
+      try {
+        R(
+          e.report(i),
+          "Snapshot error reporters must be synchronous"
+        );
+      } catch (s) {
+        t.push(i, s);
+      }
+    }
 }
-function mt(r) {
-  m.delete(r);
+function yt(r) {
+  C.delete(r), N.delete(r);
 }
-class yt {
+class Ut {
   #t;
   get;
   subscribe;
@@ -466,7 +593,7 @@ class yt {
     return t;
   }
 }
-class Et {
+class _t {
   #t;
   constructor(t) {
     this.#t = t, Object.freeze(this);
@@ -477,16 +604,16 @@ class Et {
   dispose() {
     this.#t.dispose();
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
 }
-class Ct {
+class Ht {
   #t;
   #e;
   handle;
   constructor(t, e, i, s) {
-    this.#e = e, this.#t = { phase: "staged", store: t, value: i, detachFromOwner: s }, this.handle = new Et(this);
+    this.#e = e, this.#t = { phase: "staged", store: t, value: i, detachFromOwner: s }, this.handle = new _t(this);
   }
   publish() {
     const t = this.#t;
@@ -515,55 +642,62 @@ class Ct {
       }
     }
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
 }
-class Ot {
+class Kt {
   #t;
   #e;
   #i = /* @__PURE__ */ new Map();
   #s = /* @__PURE__ */ new Map();
   #n;
-  #o = new S();
+  #a = new z();
   #r = 0;
-  #a = 0;
-  #d = !1;
-  #f = !1;
+  #o = 0;
+  #h = !1;
+  #p = !1;
   constructor(t, e, i) {
-    this.#t = t, this.#e = i, this.#n = new q(() => this.#o, e);
+    this.#t = t, this.#e = i, this.#n = new Z(() => this.#a, e);
   }
   stage(t, e, i, s) {
-    $t(e);
-    const n = Tt(t, e);
+    Jt(e);
+    const n = Xt(t, e);
     if (this.#i.has(n))
       throw new TypeError(`Duplicate contribution '${n}'`);
-    const o = new Ct(this, n, i, s);
+    const o = new Ht(this, n, i, s);
     return this.#i.set(n, o), o;
   }
   view(t) {
     this.#r++;
     const e = { binding: { store: this, own: t } };
     let i;
-    const s = new St(e, () => {
+    const s = new Wt(e, () => {
       const n = i;
       i = void 0;
       try {
         n?.();
       } finally {
-        this.#r--, this.#h();
+        this.#r--, this.#c();
       }
     });
     try {
       i = t(s, "view");
     } catch (n) {
-      throw e.binding = void 0, this.#r--, this.#h(), n;
+      throw e.binding = void 0, this.#r--, this.#c(), n;
     }
-    return new yt(e);
-  }
-  /** A stable view explicitly owned by the Host for graph-external consumers. */
+    return new Ut(e);
+  }
+  /**
+   * A stable view explicitly owned by the Host for graph-external consumers.
+   *
+   * Application code has no Lifetime to lease a view from, so this one is
+   * retained by the Host instead — which also pins the store open for as long as
+   * the Host lives. That is the trade: `host.contributions()` gives a handle that
+   * never goes stale, at the cost of a store that is no longer self-releasing.
+   */
   hostView() {
-    return this.#d = !0, this.#n.view;
+    return this.#h = !0, this.#n.view;
   }
   snapshot() {
     return this.#n.view.get();
@@ -572,15 +706,15 @@ class Ot {
     if (typeof t != "function")
       throw new TypeError("Contribution subscriber must be a function");
     const i = this.#n.view.subscribe(t);
-    this.#a++;
+    this.#o++;
     let s;
-    const n = new It(i, () => {
+    const n = new Yt(i, () => {
       const o = s;
       s = void 0;
       try {
         o?.();
       } finally {
-        this.#a--, this.#h();
+        this.#o--, this.#c();
       }
     });
     try {
@@ -591,39 +725,50 @@ class Ot {
     return n;
   }
   insert(t, e, i) {
-    if (this.#l(t, e), this.#s.has(t))
+    if (this.#u(t, e), this.#s.has(t))
       throw new Error(`Contribution '${t}' is already published`);
     e.commitPublication(), this.#s.set(t, { contribution: e, value: i }), this.#t(this);
   }
   update(t, e, i) {
-    const s = this.#u(t, e);
+    const s = this.#f(t, e);
     s.value = i, this.#t(this);
   }
   removeContribution(t, e, i) {
-    this.#l(t, e), i === "published" && this.#u(t, e);
+    this.#u(t, e), i === "published" && this.#f(t, e);
     try {
       this.#i.delete(t), i === "published" && (this.#s.delete(t), this.#t(this));
     } finally {
-      this.#h();
+      this.#c();
     }
   }
+  /**
+   * Rebuilds the published snapshot, and does nothing when the result would be
+   * equal by identity per key. A change that adds and removes the same entry —
+   * an Instance restarting with an identical contribution — therefore notifies
+   * nobody, instead of waking every observer to hand them what they already had.
+   */
   publishSnapshot() {
     const t = [...this.#s].map(([i, s]) => [i, s.value]);
-    t.length === this.#o.size && t.every(([i, s]) => Object.is(this.#o.get(i), s)) || (this.#o = new S(t), this.#n.invalidate());
+    t.length === this.#a.size && t.every(
+      ([i, s]) => this.#a.has(i) && Object.is(this.#a.get(i), s)
+    ) || (this.#a = new z(t), this.#n.invalidate());
   }
-  #l(t, e) {
+  #u(t, e) {
     if (this.#i.get(t) !== e)
       throw new Error(`Contribution '${t}' is not the current claim`);
   }
-  #u(t, e) {
+  #f(t, e) {
     const i = this.#s.get(t);
     if (i?.contribution !== e)
       throw new Error(`Contribution '${t}' is not the published entry`);
     return i;
   }
-  #h() {
-    if (!(this.#f || this.#d || this.#i.size || this.#s.size || this.#a || this.#r)) {
-      this.#f = !0;
+  // The self-release check. Every counter has to be at zero and the Host must
+  // not be holding a view; `#released` makes it run once, since disposing the
+  // publisher can re-enter through a subscription's own teardown.
+  #c() {
+    if (!(this.#p || this.#h || this.#i.size || this.#s.size || this.#o || this.#r)) {
+      this.#p = !0;
       try {
         this.#n.dispose();
       } finally {
@@ -632,7 +777,7 @@ class Ot {
     }
   }
 }
-class St {
+class Wt {
   #t;
   constructor(t, e) {
     this.#t = { state: t, release: e }, Object.freeze(this);
@@ -641,11 +786,11 @@ class St {
     const t = this.#t;
     t && (this.#t = void 0, t.state.binding = void 0, t.release());
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
 }
-class It {
+class Yt {
   #t;
   constructor(t, e) {
     this.#t = { subscription: t, release: e }, Object.freeze(this);
@@ -661,11 +806,11 @@ class It {
       }
     }
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
 }
-class At {
+class Qt {
   #t = /* @__PURE__ */ new Map();
   #e = /* @__PURE__ */ new Set();
   #i;
@@ -676,7 +821,7 @@ class At {
   get(t) {
     const e = this.#t.get(t.id);
     if (e) return e;
-    const i = new Ot(
+    const i = new Kt(
       (s) => this.#n(s),
       this.#i,
       (s) => {
@@ -691,39 +836,44 @@ class At {
   beginBatch() {
     this.#s++;
   }
+  // Depth-counted, so nested Host operations collapse into the outermost batch
+  // and publication happens exactly once. Every store's snapshot is attempted
+  // even if one of them throws, then the failures are aggregated — a single bad
+  // subscriber must not leave the remaining stores unpublished.
   endBatch() {
     if (!this.#s) throw new Error("Contribution batch is not active");
     if (this.#s--, this.#s) return;
     const t = [...this.#e];
-    this.#e.clear();
-    const e = [];
-    for (const i of t)
-      try {
-        i.publishSnapshot();
-      } catch (s) {
-        e.push(s);
-      }
-    if (e.length === 1) throw e[0];
-    if (e.length > 1)
-      throw new AggregateError(e, "Contribution batch publication failed");
+    this.#e.clear(), Ft(() => {
+      const e = [];
+      for (const i of t)
+        try {
+          i.publishSnapshot();
+        } catch (s) {
+          e.push(s);
+        }
+      if (e.length === 1) throw e[0];
+      if (e.length > 1)
+        throw new AggregateError(e, "Contribution batch publication failed");
+    });
   }
   #n(t) {
     this.#e.add(t), !this.#s && (this.#e.delete(t), t.publishSnapshot());
   }
 }
-function $t(r) {
+function Jt(r) {
   if (typeof r != "string" || !r.trim())
     throw new TypeError("Contribution key must be a non-empty string");
   if (r !== r.trim())
     throw new TypeError("Contribution key cannot start or end with whitespace");
 }
-function Tt(r, t) {
-  return `${B(r)}/${B(t)}`;
+function Xt(r, t) {
+  return `${ot(r)}/${ot(t)}`;
 }
-function B(r) {
+function ot(r) {
   return r.replaceAll("%", "%25").replaceAll("/", "%2F");
 }
-class jt {
+class Zt {
   #t;
   constructor(t) {
     this.#t = t, Object.freeze(this);
@@ -732,16 +882,16 @@ class jt {
     const t = this.#t;
     this.#t = void 0, t?.dispose();
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
 }
-class kt {
+class te {
   #t;
   #e;
   handle;
   constructor(t, e, i, s) {
-    this.#e = e, this.#t = { phase: "staged", hub: t, slot: { listener: i }, release: s }, this.handle = new jt(this);
+    this.#e = e, this.#t = { phase: "staged", hub: t, slot: { listener: i }, release: s }, this.handle = new Zt(this);
   }
   publish() {
     const t = this.#t;
@@ -750,7 +900,7 @@ class kt {
   dispose() {
     const t = this.#t;
     if (t.phase !== "removed") {
-      this.#t = { phase: "removed" };
+      this.#t = { phase: "removed" }, t.slot.listener = void 0;
       try {
         t.phase === "published" && t.hub.delete(this.#e, t.slot);
       } finally {
@@ -758,15 +908,15 @@ class kt {
       }
     }
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
 }
-class Pt {
+class ee {
   #t = /* @__PURE__ */ new Map();
   stage(t, e, i) {
     if (typeof e != "function") throw new TypeError("Event listener must be a function");
-    return new kt(this, t, e, i);
+    return new te(this, t, e, i);
   }
   add(t, e) {
     const i = this.#t.get(t) ?? /* @__PURE__ */ new Set();
@@ -776,25 +926,34 @@ class Pt {
     const i = this.#t.get(t);
     i && (i.delete(e), i.size || this.#t.delete(t));
   }
+  /**
+   * Every still-subscribed listener runs, then failures are aggregated. Three details, all
+   * deliberate:
+   *
+   * - the listener set is copied first; a new subscription does not join this
+   *   emission. A disposed slot is skipped if its callback has not started;
+   * - each call is wrapped in a resolved promise, so a listener that throws
+   *   synchronously is collected like one that rejects;
+   * - `allSettled`, so one broken listener cannot stop the others from being
+   *   told. The emitter still learns about it — every error comes back.
+   */
   async emit(t, e) {
-    const i = [...this.#t.get(t) ?? []].map(
-      (o) => o.listener
-    ), n = (await Promise.allSettled(
-      i.map((o) => Promise.resolve().then(() => o(e)))
+    const i = [...this.#t.get(t) ?? []], n = (await Promise.allSettled(
+      i.map((o) => Promise.resolve().then(() => o.listener?.(e)))
     )).filter((o) => o.status === "rejected").map((o) => o.reason);
     if (n.length)
       throw new AggregateError(n, `Event '${t}' listeners failed`);
   }
 }
-class Lt {
+class ie {
   #t;
   root;
   view;
   constructor(t, e) {
-    this.root = F(t), this.#t = new q(() => et(this.root), e), this.view = this.#t.view;
+    this.root = at(t), this.#t = new Z(() => Et(this.root), e), this.view = this.#t.view;
   }
   createNode(t) {
-    return F(t);
+    return at(t);
   }
   attach(t, e) {
     if (t.children.has(e)) throw new Error("Lifetime diagnostic node is attached");
@@ -815,7 +974,7 @@ class Lt {
     this.root.phase !== "disposed" && (this.root.phase = "disposed", this.#t.invalidate(), this.#t.dispose());
   }
 }
-function F(r) {
+function at(r) {
   return {
     label: r,
     phase: "active",
@@ -830,8 +989,8 @@ function F(r) {
     children: /* @__PURE__ */ new Set()
   };
 }
-function et(r) {
-  const t = Object.freeze([...r.children].map(et));
+function Et(r) {
+  const t = Object.freeze([...r.children].map(Et));
   return Object.freeze({
     label: r.label,
     phase: r.phase,
@@ -839,15 +998,19 @@ function et(r) {
     children: t
   });
 }
-function zt(r) {
-  if (!r || typeof r != "object") return !1;
-  const t = r;
-  return [t.debug, t.info, t.warn, t.error].every(
-    (e) => typeof e == "function"
-  );
+function se(r) {
+  if (!r || typeof r != "object" && typeof r != "function") return !1;
+  try {
+    const t = r;
+    return [t.debug, t.info, t.warn, t.error].every(
+      (e) => typeof e == "function"
+    );
+  } catch {
+    return !1;
+  }
 }
-const R = Object.freeze(new DOMException("Resource disposed", "AbortError"));
-class w {
+const W = Object.freeze(new DOMException("Resource disposed", "AbortError"));
+class y {
   #t = /* @__PURE__ */ new Set();
   #e;
   constructor(t) {
@@ -867,6 +1030,12 @@ class w {
     const e = this.#e;
     return e && e.diagnostics.change(e.node, e.kind, -1), !0;
   };
+  /**
+   * Disposes in reverse creation order, collecting failures rather than
+   * throwing. Later resources may depend on earlier ones, and a resource that
+   * refuses to shut down cleanly must not strand its siblings. The caller
+   * aggregates the collected errors.
+   */
   async dispose(t) {
     try {
       for (const e of [...this.#t].reverse())
@@ -881,11 +1050,26 @@ class w {
       this.#e = void 0;
     }
   }
+  /** Capability withdrawal must finish without yielding to callbacks or tasks. */
+  disposeSynchronously(t) {
+    try {
+      for (const e of [...this.#t].reverse())
+        try {
+          e.dispose();
+        } catch (i) {
+          t.push(i);
+        } finally {
+          this.release(e);
+        }
+    } finally {
+      this.#e = void 0;
+    }
+  }
   [Symbol.iterator]() {
     return this.#t[Symbol.iterator]();
   }
 }
-class Rt {
+class re {
   #t;
   constructor(t, e) {
     this.#t = { phase: "active", cleanup: t, detachFromParent: e }, Object.freeze(this);
@@ -905,11 +1089,11 @@ class Rt {
     });
     return this.#t = { phase: "disposing", completion: e }, e;
   }
-  [j]() {
+  [F]() {
     return this.dispose();
   }
 }
-class Nt {
+class ne {
   #t;
   #e;
   #i;
@@ -922,7 +1106,7 @@ class Nt {
       () => this.#s(),
       (a) => {
         try {
-          J(n.signal, a) || i(a);
+          wt(n.signal, a) || i(a);
         } finally {
           this.#s();
         }
@@ -940,9 +1124,9 @@ class Nt {
       () => {
       }
     );
-    return this.#i = { phase: "disposing", completion: e }, t.controller.abort(R), this.#n(), e;
+    return this.#i = { phase: "disposing", completion: e }, t.controller.abort(W), this.#n(), e;
   }
-  [j]() {
+  [F]() {
     return this.dispose();
   }
   #s() {
@@ -956,54 +1140,54 @@ class Nt {
     this.#t = void 0, t?.();
   }
 }
-class D {
+class tt {
   #t;
   #e;
   #i;
   #s;
   #n;
-  #o;
-  #r;
   #a;
-  #d;
-  #f;
-  #l;
+  #r;
+  #o;
+  #h;
+  #p;
   #u;
+  #f;
   handle;
-  #h;
+  #c;
   constructor(t, e, i = {}) {
-    this.#e = e, this.handle = new xt(this);
+    this.#e = e, this.handle = new oe(this);
     const s = new AbortController();
-    this.#h = {
+    this.#c = {
       phase: "active",
       controller: s,
       declarations: i.declarations ?? "staged"
     };
     const n = i.parent;
-    this.#u = n?.detach, this.#f = n ? "child" : "root";
-    const o = n?.diagnostics ?? new Lt(e, (l) => t.report(l)), a = n?.diagnosticNode ?? o.root;
+    this.#f = n?.detach, this.#p = n ? "child" : "root";
+    const o = n?.diagnostics ?? new ie(e, (l) => t.report(l)), a = n?.diagnosticNode ?? o.root;
     this.#t = { port: t, diagnostics: o, diagnosticNode: a };
     const h = (l) => ({
       diagnostics: o,
       node: a,
       kind: l
     });
-    this.#i = new w(h("listeners")), this.#s = new w(h("contributions")), this.#n = new w(h("contributionViews")), this.#o = new w(h("subscriptions")), this.#r = new w(h("tasks")), this.#a = new w(), this.#d = new w(h("cleanups"));
+    this.#i = new y(h("listeners")), this.#s = new y(h("contributions")), this.#n = new y(h("contributionViews")), this.#a = new y(h("subscriptions")), this.#r = new y(h("tasks")), this.#o = new y(), this.#h = new y(h("cleanups"));
     const c = i.parentSignal;
     if (!c) return;
     const d = () => s.abort(c.reason);
-    c.addEventListener("abort", d, { once: !0 }), this.#l = () => c.removeEventListener("abort", d), c.aborted && d();
+    c.addEventListener("abort", d, { once: !0 }), this.#u = () => c.removeEventListener("abort", d), c.aborted && d();
   }
   get signal() {
-    const t = this.#h;
+    const t = this.#c;
     return t.phase === "disposed" ? t.signal : t.controller.signal;
   }
   get diagnostics() {
-    return this.#c().diagnostics.view;
+    return this.#g().diagnostics.view;
   }
-  /** A facade whose only Runtime edge disappears when this Lifetime terminates. */
+  /** A facade whose only InstanceCoordinator edge disappears when this Lifetime terminates. */
   contextLogger(t) {
-    const e = (i) => (s, ...n) => this.#p().port.writeLog(i, s, t, n);
+    const e = (i) => (s, ...n) => this.#g().port.writeLog(i, s, t, n);
     return Object.freeze({
       debug: e("debug"),
       info: e("info"),
@@ -1012,30 +1196,39 @@ class D {
     });
   }
   cleanup(t) {
-    if (this.#c(), typeof t != "function") throw new TypeError("Cleanup must be a function");
-    const e = new Rt(t, this.#d.release);
-    return this.#d.add(e), e;
-  }
+    if (this.#d(), typeof t != "function") throw new TypeError("Cleanup must be a function");
+    const e = new re(t, this.#h.release);
+    return this.#h.add(e), e;
+  }
+  /**
+   * A child scope. It inherits this Lifetime's signal, so cancellation flows
+   * down, and its declaration phase, so a child created during `setup()` also
+   * stages rather than publishing immediately.
+   *
+   * Disposing a child detaches it from both the resource set and the diagnostics
+   * tree. A Plugin can therefore use child lifetimes as a unit of work — one per
+   * open document, per connection — without the parent growing.
+   */
   lifetime(t) {
-    const { port: e, diagnostics: i, diagnosticNode: s } = this.#c();
-    Vt(t);
-    const n = i.createNode(t), o = new D(e, this.#e, {
+    const { port: e, diagnostics: i, diagnosticNode: s } = this.#d();
+    ae(t);
+    const n = i.createNode(t), o = new tt(e, this.#e, {
       parentSignal: this.signal,
-      declarations: this.#g(),
+      declarations: this.#w(),
       parent: {
         diagnostics: i,
         diagnosticNode: n,
         detach: (a) => {
-          this.#a.release(a) && i.detach(s, n);
+          this.#o.release(a) && i.detach(s, n);
         }
       }
     });
-    return this.#a.add(o), i.attach(s, n), o.handle;
+    return this.#o.add(o), i.attach(s, n), o.handle;
   }
   spawn(t) {
-    const { port: e } = this.#c();
+    const { port: e } = this.#d();
     if (typeof t != "function") throw new TypeError("Background task must be a function");
-    const i = new Nt(
+    const i = new ne(
       this.signal,
       t,
       (s) => e.report(s),
@@ -1044,84 +1237,137 @@ class D {
     return this.#r.add(i), i;
   }
   on(t, e) {
-    const { port: i } = this.#c(), s = i.stageOn(this.#e, t, e, this.#i.release);
-    return this.#i.add(s), this.#g() === "published" && s.publish(), s.handle;
+    const { port: i } = this.#d(), s = i.stageOn(
+      this.#e,
+      t,
+      e,
+      this.#i.release
+    );
+    return this.#i.add(s), this.#w() === "published" && s.publish(), s.handle;
   }
   async emit(t, ...e) {
-    const { port: i } = this.#c();
+    const { port: i } = this.#d();
     await i.emit(this.#e, t, e[0]);
   }
   contribute(t, e, i) {
-    const { port: s } = this.#c(), n = s.stageContribution(
+    const { port: s } = this.#d(), n = s.stageContribution(
       this.#e,
       t,
       e,
       i,
       this.#s.release
     );
-    return this.#s.add(n), this.#g() === "published" && n.publish(), n.handle;
+    return this.#s.add(n), this.#w() === "published" && n.publish(), n.handle;
   }
   /** Owns an internal live capability without exposing a second Context API. */
   ownLease(t, e) {
-    return this.#c(), (e === "view" ? this.#n : this.#o).own(t);
+    return this.#d(), (e === "view" ? this.#n : this.#a).own(t);
   }
   /** Releases a temporary startup cancellation edge after its layer commits. */
   detachStartupSignal() {
-    const t = this.#l;
-    this.#l = void 0, t?.();
-  }
-  /** Atomically makes all declarations staged during setup visible. */
+    const t = this.#u;
+    this.#u = void 0, t?.();
+  }
+  /**
+   * Atomically makes all declarations staged during setup visible.
+   *
+   * Children publish too, recursively, so a Lifetime created inside `setup()`
+   * becomes visible with its parent rather than being stranded staged. Called by
+   * the InstanceCoordinator once the whole activation layer has succeeded —
+   * which is what makes "no half-built Instance is observable" true.
+   */
   publish() {
-    const t = this.#h;
-    if (t.phase !== "active") throw y();
-    if (this.#c(), t.declarations !== "published") {
+    const t = this.#c;
+    if (t.phase !== "active") throw $();
+    if (this.#d(), t.declarations !== "published") {
       for (const e of this.#i) e.publish();
       for (const e of this.#s) e.publish();
-      for (const e of this.#a) e.publish();
-      this.#h = { ...t, declarations: "published" };
+      for (const e of this.#o) e.publish();
+      this.#c = { ...t, declarations: "published" };
     }
   }
+  /**
+   * Disposal is idempotent and joinable: concurrent callers share one completion
+   * promise, so a Lifetime disposed by both its owner and a `using` block runs
+   * its teardown once.
+   *
+   * The three-stage order is the module header's; see it for why. Errors from
+   * every stage accumulate and are aggregated at the end, so one failing cleanup
+   * neither hides the others nor prevents them from running.
+   */
   dispose() {
-    const t = this.#h;
+    const t = this.#c;
     if (t.phase === "disposing") return t.completion;
     if (t.phase === "disposed") return Promise.resolve();
-    const e = this.#p(), i = Promise.resolve().then(async () => {
-      const s = [];
-      if (await this.#i.dispose(s), await this.#s.dispose(s), await this.#o.dispose(s), await this.#n.dispose(s), t.controller.abort(R), this.detachStartupSignal(), await this.#r.dispose(s), await this.#a.dispose(s), await this.#d.dispose(s), s.length === 1) throw s[0];
-      if (s.length > 1) throw new AggregateError(s, "Lifetime cleanup failed");
-    }).finally(() => {
-      this.#h = { phase: "disposed", signal: AbortSignal.abort(R) };
-      const s = this.#u;
-      this.#u = void 0;
-      try {
-        s?.(this), this.#f === "root" && e.diagnostics.finishRoot();
-      } finally {
-        this.#t = void 0;
-      }
-    });
-    return this.#h = { phase: "disposing", controller: t.controller, completion: i }, e.diagnostics.beginDisposing(e.diagnosticNode), i;
+    const e = [], i = this.#l(e);
+    for (const { lifetime: s, errors: n } of e)
+      s.#i.disposeSynchronously(n), s.#a.disposeSynchronously(n), s.#n.disposeSynchronously(n);
+    for (const { lifetime: s, errors: n } of e)
+      s.#s.disposeSynchronously(n);
+    for (const { lifetime: s, binding: n, controller: o } of e)
+      n.diagnostics.beginDisposing(n.diagnosticNode), o.abort(W), s.detachStartupSignal();
+    for (const s of e) s.finish();
+    return i;
   }
-  [j]() {
+  /** Stages joinable completions without running any externally observable work. */
+  #l(t) {
+    const e = this.#c;
+    if (e.phase === "disposing") return e.completion;
+    if (e.phase === "disposed") return Promise.resolve();
+    const i = this.#g(), s = Promise.withResolvers(), n = [];
+    this.#c = {
+      phase: "disposing",
+      controller: e.controller,
+      completion: s.promise
+    };
+    const o = Promise.allSettled(
+      [...this.#o].reverse().map((h) => h.#l(t))
+    ), a = () => {
+      (async () => {
+        try {
+          await this.#r.dispose(n);
+          for (const h of await o)
+            h.status === "rejected" && n.push(h.reason);
+          if (await this.#h.dispose(n), n.length === 1) throw n[0];
+          if (n.length > 1) throw new AggregateError(n, "Lifetime cleanup failed");
+        } finally {
+          this.#c = { phase: "disposed", signal: AbortSignal.abort(W) };
+          const h = this.#f;
+          this.#f = void 0;
+          try {
+            h?.(this), this.#p === "root" && i.diagnostics.finishRoot();
+          } finally {
+            this.#t = void 0;
+          }
+        }
+      })().then(s.resolve, s.reject);
+    };
+    return t.push({ lifetime: this, errors: n, binding: i, controller: e.controller, finish: a }), s.promise;
+  }
+  [F]() {
     return this.dispose();
   }
-  #c() {
+  // The gate on every operation that creates a resource. `signal.aborted` is
+  // checked as well as the phase, because a parent's disposal aborts this signal
+  // during startup cancellation as well as disposal. Both boundaries close work.
+  #d() {
     const t = this.#t;
-    if (this.#h.phase !== "active" || this.signal.aborted || !t)
-      throw y();
+    if (this.#c.phase !== "active" || this.signal.aborted || !t)
+      throw $();
     return t;
   }
-  #p() {
+  #g() {
     const t = this.#t;
-    if (!t) throw y();
+    if (!t) throw $();
     return t;
   }
-  #g() {
-    const t = this.#h;
-    if (t.phase !== "active") throw y();
+  #w() {
+    const t = this.#c;
+    if (t.phase !== "active") throw $();
     return t.declarations;
   }
 }
-class xt {
+class oe {
   #t;
   constructor(t) {
     this.#t = t, Object.freeze(this);
@@ -1150,32 +1396,32 @@ class xt {
   dispose() {
     return this.#t.dispose();
   }
-  [j]() {
+  [F]() {
     return this.dispose();
   }
 }
-function Vt(r) {
+function ae(r) {
   if (typeof r != "string" || !r.trim())
     throw new TypeError("Lifetime label must be a non-empty string");
   if (r !== r.trim())
     throw new TypeError("Lifetime label cannot start or end with whitespace");
 }
-function y() {
+function $() {
   return new u("LIFETIME_DISPOSED", "Lifetime is disposing or has been disposed");
 }
-class N extends AggregateError {
+class Y extends AggregateError {
 }
-class Mt {
+class ce {
   #t;
   #e;
   #i;
   #s;
   #n = /* @__PURE__ */ new Map();
-  #o = new Pt();
+  #a = new ee();
   #r;
-  #a = [];
+  #o = [];
   constructor(t) {
-    this.#t = t.hostName, this.#e = t.logger, this.#i = t.isInstalled, this.#s = t.report, this.#r = new At(t.report);
+    this.#t = t.hostName, this.#e = t.logger, this.#i = t.isInstalled, this.#s = t.report, this.#r = new Qt(t.report);
   }
   readService(t, e) {
     const i = this.#n.get(t);
@@ -1193,16 +1439,16 @@ class Mt {
     return e;
   }
   resetActivationState() {
-    this.#n.clear(), this.#a = [];
+    this.#n.clear(), this.#o = [];
   }
   commitActivationOrder(t) {
-    this.#a = t.slice();
+    this.#o = t.slice();
   }
   deactivateAll() {
-    return this.deactivate(new Set(this.#a));
+    return this.deactivate(new Set(this.#o));
   }
   async activate(t, e, i, s) {
-    const n = this.#c(s);
+    const n = this.#l(s);
     for (const o of t.layers) {
       const a = o.filter(
         (f) => e.has(f) && !f.instance
@@ -1211,38 +1457,42 @@ class Mt {
       const h = new AbortController(), c = await Promise.allSettled(
         a.map(async (f) => {
           try {
-            const p = i.has(f) ? i.get(f) : await X(
-              f.declaration.plugin.config,
-              f.declaration.config,
-              f.id
-            );
-            return await this.#d(
+            if (!i.has(f))
+              throw new Error(`Installation '${f.id}' has no prepared config`);
+            const g = i.get(f);
+            return await this.#h(
               t,
               f,
-              p,
+              g,
               h.signal,
               n
             );
-          } catch (p) {
-            throw h.abort(p), p;
+          } catch (g) {
+            throw h.abort(g), g;
           }
         })
-      ), d = qt(c, h.signal), l = c.filter(
+      ), d = he(c, h.signal), l = c.filter(
         (f) => f.status === "fulfilled"
       ).map((f) => f.value);
       if (d.length) {
-        const f = await this.#l(l), p = d.length === 1 ? d[0] : new AggregateError(d, "Installation startup layer failed");
-        throw f.length ? new N(
-          [p, ...f],
+        const f = await this.#u(l), g = d.length === 1 ? d[0] : new AggregateError(d, "Installation startup layer failed");
+        throw f.length ? new Y(
+          [g, ...f],
           "Installation startup layer failed and could not be cleanly disposed"
-        ) : p;
+        ) : g;
       }
-      this.#f(l);
+      this.#p(l);
     }
   }
+  /**
+   * Stops in reverse activation order, sequentially, and collects every failure
+   * instead of stopping at the first. A dependent must be gone before the
+   * Service it consumed, and one Instance that refuses to shut down cleanly must
+   * not leave the rest running — its error is returned, not thrown.
+   */
   async deactivate(t) {
-    const e = [], i = this.#a.filter((s) => t.has(s)).reverse();
-    this.#a = this.#a.filter(
+    const e = [], i = this.#o.filter((s) => t.has(s)).reverse();
+    this.#o = this.#o.filter(
       (s) => !t.has(s)
     );
     for (const s of i) {
@@ -1260,6 +1510,17 @@ class Mt {
     }
     return e;
   }
+  /**
+   * Runs one operation with contribution publication deferred to its end, so a
+   * change that withdraws and adds contributions is observed once rather than as
+   * an intermediate state.
+   *
+   * Publication happens even when the operation failed, because contributions
+   * withdrawn by Instances that did stop must not stay visible. If both the
+   * operation and the publication fail, both errors are reported — the
+   * publication failure must not hide the reason the change failed, and the
+   * operation failure must not hide a store left inconsistent.
+   */
   async withContributionBatch(t) {
     this.#r.beginBatch();
     let e;
@@ -1283,23 +1544,23 @@ class Mt {
     if (!i.ok) throw i.error;
     return e.value;
   }
-  async #d(t, e, i, s, n) {
+  async #h(t, e, i, s, n) {
     e.deactivate();
-    const o = e.declaration.plugin, a = new D(n, e.id, { parentSignal: s });
+    const o = t.declarationFor(e).plugin, a = new tt(n, e.id, { parentSignal: s });
     try {
-      const h = this.#u(t, e, o, a), c = Object.freeze({
+      const h = this.#f(t, e, o, a), c = Object.freeze({
         hostName: this.#t,
         pluginName: o.name,
         installationId: e.id,
         groupId: e.groupId
-      }), d = this.#h(a, c, h), l = await o.setup(d, i), f = /* @__PURE__ */ new Map();
-      for (const [p, st] of Object.entries(o.provides ?? {})) {
-        if (typeof l != "object" || l === null || !Object.hasOwn(l, p))
+      }), d = this.#c(a, c, h), l = await o.setup(d, i), f = /* @__PURE__ */ new Map();
+      for (const [g, I] of Object.entries(o.provides)) {
+        if (typeof l != "object" || l === null || !Object.hasOwn(l, g))
           throw new u(
             "SERVICE_NOT_RETURNED",
-            `Installation '${e.id}' did not return provided Service '${p}'`
+            `Installation '${e.id}' did not return provided Service '${g}'`
           );
-        f.set(st.id, l[p]);
+        f.set(I.id, l[g]);
       }
       return Object.freeze({
         installation: e,
@@ -1311,7 +1572,7 @@ class Mt {
       try {
         await a.dispose();
       } catch (d) {
-        throw new N(
+        throw new Y(
           [c, d],
           `Installation '${e.id}' failed to start and could not be cleanly disposed`
         );
@@ -1319,13 +1580,13 @@ class Mt {
       throw c;
     }
   }
-  #f(t) {
+  #p(t) {
     for (const { installation: e, instance: i, services: s } of t)
-      this.#n.set(e, s), e.activate(i), this.#a.push(e);
+      this.#n.set(e, s), e.activate(i), this.#o.push(e);
     for (const { instance: e } of t)
       e.lifetime.publish(), e.lifetime.detachStartupSignal();
   }
-  async #l(t) {
+  async #u(t) {
     const e = [];
     for (const i of [...t].reverse())
       try {
@@ -1335,9 +1596,9 @@ class Mt {
       }
     return e;
   }
-  #u(t, e, i, s) {
+  #f(t, e, i, s) {
     const n = /* @__PURE__ */ Object.create(null);
-    for (const [o, a] of Object.entries(i.requires ?? {}))
+    for (const [o, a] of Object.entries(i.requires))
       if (a.kind === "optional") {
         const h = t.providerFor(e, a.service.id);
         if (!h) {
@@ -1360,10 +1621,10 @@ class Mt {
           );
         n[o] = c.get(a.id);
       } else
-        n[o] = this.#b(a, s);
+        n[o] = this.#m(a, s);
     return n;
   }
-  #h(t, e, i) {
+  #c(t, e, i) {
     return Object.freeze({
       ...i,
       get signal() {
@@ -1379,53 +1640,58 @@ class Mt {
       contribute: t.contribute.bind(t)
     });
   }
-  #c(t) {
+  #l(t) {
     return {
-      stageOn: (e, i, s, n) => this.#p(e, i, s, n, t),
+      stageOn: (e, i, s, n) => this.#d(e, i, s, n, t),
       emit: (e, i, s) => this.#g(e, i, s, t),
-      stageContribution: (e, i, s, n, o) => this.#v(e, i, s, n, o, t),
-      writeLog: (e, i, s, n) => this.#e[e](i, s, ...n),
+      stageContribution: (e, i, s, n, o) => this.#w(e, i, s, n, o, t),
+      writeLog: (e, i, s, n) => {
+        R(
+          this.#e[e](i, s, ...n),
+          "Logger methods must be synchronous"
+        );
+      },
       report: this.#s
     };
   }
-  #p(t, e, i, s, n) {
-    return this.#w(t), b(e, "event"), n.remember(e), this.#o.stage(e.id, i, s);
+  #d(t, e, i, s, n) {
+    return this.#b(t), A(e, "event"), n.remember(e), this.#a.stage(e.id, i, s);
   }
   #g(t, e, i, s) {
-    return this.#w(t), b(e, "event"), s.remember(e), this.#o.emit(e.id, i);
+    return this.#b(t), A(e, "event"), s.remember(e), this.#a.emit(e.id, i);
   }
-  #v(t, e, i, s, n, o) {
-    return this.#w(t), b(e, "extensionPoint"), o.remember(e), this.#r.get(e).stage(t, i, s, n);
+  #w(t, e, i, s, n, o) {
+    return this.#b(t), A(e, "extensionPoint"), o.remember(e), this.#r.get(e).stage(t, i, s, n);
   }
-  #b(t, e) {
+  #m(t, e) {
     return this.#r.get(t).view((i, s) => e.ownLease(i, s));
   }
-  #w(t) {
+  #b(t) {
     if (!this.#i(t))
       throw new Error(`Installation '${t}' is not installed`);
   }
 }
-function qt(r, t) {
+function he(r, t) {
   const e = [];
   let i = !1;
   for (const s of r)
-    s.status !== "fulfilled" && (Object.is(s.reason, t.reason) ? (i || e.push(s.reason), i = !0) : J(t, s.reason) || e.push(s.reason));
+    s.status !== "fulfilled" && (Object.is(s.reason, t.reason) ? (i || e.push(s.reason), i = !0) : wt(t, s.reason) || e.push(s.reason));
   return e;
 }
-class Dt {
-  #t = new dt();
+class de {
+  #t = new zt();
   #e;
   #i;
   constructor(t) {
-    this.#e = new Mt(t);
+    this.#e = new ce(t);
   }
   get hasCommittedPlan() {
     return this.#i !== void 0;
   }
   get(t, e) {
-    const i = ot(t), s = i ? t.service : t;
-    if (b(s, "service"), this.#t.assertCompatible(s), e === "unavailable") throw U();
-    const n = this.#a().provider(s.id);
+    const i = jt(t), s = i ? t.service : t;
+    if (A(s, "service"), this.#t.assertCompatible(s), e === "unavailable") throw ct();
+    const n = this.#o().provider(s.id);
     if (!n) {
       if (i) return;
       throw new u("SERVICE_UNAVAILABLE", `Service '${s.id}' is not active`);
@@ -1438,13 +1704,13 @@ class Dt {
     return o.value;
   }
   contributions(t) {
-    return b(t, "extensionPoint"), this.#t.remember(t), this.#e.contributions(t);
+    return A(t, "extensionPoint"), this.#t.remember(t), this.#e.contributions(t);
   }
   buildPlan(t) {
-    return M.build(t, this.#t.kinds);
+    return X.build(t, this.#t.kinds);
   }
   async start(t) {
-    const e = this.#t.draft(t.contractKinds);
+    const e = this.#t.writer(t.contractKinds);
     try {
       await this.#e.withContributionBatch(() => this.#s(t, e)), this.#i = t;
     } catch (i) {
@@ -1452,17 +1718,34 @@ class Dt {
     }
   }
   async stop() {
-    const t = await this.#e.withContributionBatch(() => this.#e.deactivateAll());
+    const t = await this.#e.withContributionBatch(
+      () => this.#e.deactivateAll()
+    );
     return this.#i = void 0, t;
   }
+  /**
+   * The whole transaction, in the order the steps have to happen.
+   *
+   * Configs resolve and Contract identities draft *before* anything stops,
+   * because those are the failures that can still be taken back for free — a
+   * schema rejection at this point costs nothing. Once the affected Instances
+   * are down, every remaining failure has a price, and the only question left is
+   * whether the previous state can be restored.
+   *
+   * The whole body runs inside one contribution batch, so contributions
+   * withdrawn by stopping Instances and added by starting ones become visible in
+   * a single step. Without it, an ExtensionPoint observer would see the set
+   * briefly empty in the middle of a successful change.
+   */
   async transition(t, e, i) {
     return this.#e.withContributionBatch(async () => {
-      const s = this.#a(), n = s.affectedByTransitionTo(t, e);
+      const s = this.#o(), n = s.affectedByTransitionTo(t, e);
       let o, a;
       try {
         o = await this.#r(
+          t,
           t.order.filter((d) => n.has(d))
-        ), a = this.#t.draft(t.contractKinds);
+        ), a = this.#t.writer(t.contractKinds);
       } catch (d) {
         throw i(), d;
       }
@@ -1477,11 +1760,11 @@ class Dt {
         return await this.#e.activate(t, n, o, a), a.commit(), this.#e.commitActivationOrder(t.order), this.#i = t, Object.freeze({ kind: "committed", affected: n });
       } catch (d) {
         const l = await this.#e.deactivate(n);
-        return a.discard(), d instanceof N || l.length ? this.#n(
+        return a.discard(), d instanceof Y || l.length ? this.#n(
           i,
           [d, ...l],
           "Installation change failed and its partial activation could not be cleanly disposed"
-        ) : this.#o(i, s, n, h, [
+        ) : this.#a(i, s, n, h, [
           d,
           ...l
         ]);
@@ -1489,7 +1772,7 @@ class Dt {
     });
   }
   async #s(t, e) {
-    const i = new Set(t.order), s = await this.#r(t.order);
+    const i = new Set(t.order), s = await this.#r(t, t.order);
     this.#e.resetActivationState();
     try {
       await this.#e.activate(t, i, s, e), e.commit(), this.#e.commitActivationOrder(t.order);
@@ -1498,14 +1781,30 @@ class Dt {
       throw o.length ? new AggregateError([n, ...o], "Host startup failed") : n;
     }
   }
+  /**
+   * The last level: no consistent graph could be reached, so none is presented.
+   *
+   * Everything stops and `#plan` is cleared, which drops the Host to `idle` and
+   * closes reads. The AggregateError carries every cause — the original failure
+   * first, then whatever shutdown itself hit. Nothing is swallowed here; the
+   * point of failing closed is that the report is complete.
+   */
   async #n(t, e, i) {
     t();
     const s = await this.#e.deactivateAll();
     throw this.#i = void 0, new AggregateError([...e, ...s], i);
   }
-  async #o(t, e, i, s, n) {
+  /**
+   * Restores the previous plan using the configs captured before the change, not
+   * mutable records. Declaration versions belong to the plan; re-validating
+   * configs could fail for a second,
+   * unrelated reason while trying to recover from the first.
+   *
+   * A rollback that itself fails escalates to fail-closed by throwing.
+   */
+  async #a(t, e, i, s, n) {
     t();
-    const o = this.#t.draft(e.contractKinds);
+    const o = this.#t.writer(e.contractKinds);
     try {
       await this.#e.activate(e, i, s, o), o.commit(), this.#e.commitActivationOrder(e.order), this.#i = e;
     } catch (h) {
@@ -1518,48 +1817,47 @@ class Dt {
     const a = n.length === 1 ? n[0] : new AggregateError(n, "Installation change failed");
     return Object.freeze({ kind: "rolled-back", affected: i, error: a });
   }
-  async #r(t) {
-    const e = /* @__PURE__ */ new Map();
-    for (const i of t)
+  async #r(t, e) {
+    const i = /* @__PURE__ */ new Map();
+    for (const s of e)
       try {
-        e.set(
-          i,
-          await X(
-            i.declaration.plugin.config,
-            i.declaration.config,
-            i.id
-          )
-        );
-      } catch (s) {
-        throw $(
+        const n = t.declarationFor(s);
+        i.set(
           s,
+          await Lt(n.plugin.config, n.config, s.id)
+        );
+      } catch (n) {
+        throw V(
+          n,
           "INSTALLATION_UNAVAILABLE",
-          `Installation '${i.id}' failed with a non-Error value`
+          `Installation '${s.id}' failed with a non-Error value`
         );
       }
-    return e;
+    return i;
   }
-  #a() {
-    if (!this.#i) throw U();
+  #o() {
+    if (!this.#i) throw ct();
     return this.#i;
   }
 }
-function U() {
+function ct() {
   return new u("SERVICE_UNAVAILABLE", "Host services are not active");
 }
-class Gt {
+class le {
   #t;
   #e;
-  #i;
-  #s = 0;
+  #i = 0;
   view;
   constructor(t, e, i) {
-    this.#t = t, this.#i = this.#n("idle", [], e), this.#e = new q(() => this.#i, i), this.view = this.#e.view;
+    this.#t = t, this.#e = new Z(() => {
+      const { status: s, installations: n, groups: o } = e();
+      return this.#s(s, n, o);
+    }, i), this.view = this.#e.view;
   }
-  publish(t, e, i) {
-    this.#s++, this.#i = this.#n(t, e, i), this.#e.invalidate();
+  publish() {
+    this.#i++, this.#e.invalidate();
   }
-  #n(t, e, i) {
+  #s(t, e, i) {
     const s = /* @__PURE__ */ new Map();
     for (const o of e) {
       const a = {
@@ -1568,10 +1866,10 @@ class Gt {
         groupId: o.groupId,
         status: o.status,
         requires: Object.freeze(
-          Object.values(o.declaration.plugin.requires ?? {}).map((c) => c.kind === "optional" ? c.service.id : c.id)
+          Object.values(o.declaration.plugin.requires).map((c) => c.kind === "optional" ? c.service.id : c.id)
         ),
         provides: Object.freeze(
-          Object.values(o.declaration.plugin.provides ?? {}).map((c) => c.id)
+          Object.values(o.declaration.plugin.provides).map((c) => c.id)
         ),
         ...o.instance ? { lifetime: o.instance.lifetime.diagnostics } : {}
       }, h = o.error;
@@ -1591,29 +1889,32 @@ class Gt {
     return Object.freeze({
       name: this.#t,
       status: t,
-      revision: this.#s,
-      installations: new S(s),
-      groups: new S(n)
+      revision: this.#i,
+      installations: new z(s),
+      groups: new z(n)
     });
   }
 }
-function k(r, t, e = {}) {
+function B(r, t, e = {}) {
   if (!r || typeof r != "object" || Array.isArray(r))
-    throw E(e, `${t} must be a plain record`);
+    throw O(e, `${t} must be a plain record`);
   const i = Object.getPrototypeOf(r);
   if (i !== Object.prototype && i !== null)
-    throw E(e, `${t} must be a plain record`);
+    throw O(e, `${t} must be a plain record`);
   for (const s of Reflect.ownKeys(r)) {
-    if (typeof s != "string" || !Object.prototype.propertyIsEnumerable.call(r, s))
-      throw E(e, `${t} keys must be enumerable strings`);
+    const n = Reflect.getOwnPropertyDescriptor(r, s);
+    if (typeof s != "string" || !n?.enumerable)
+      throw O(e, `${t} keys must be enumerable strings`);
+    if (!("value" in n))
+      throw O(e, `${t} field '${s}' must be a data property`);
     if (e.fields && !e.fields.has(s))
-      throw E(e, `${t}: unknown field '${s}'`);
+      throw O(e, `${t}: unknown field '${s}'`);
   }
 }
-function E(r, t) {
+function O(r, t) {
   return r.createError?.(t) ?? new TypeError(t);
 }
-const Bt = /* @__PURE__ */ new Set([
+const ue = /* @__PURE__ */ new Set([
   "signal",
   "meta",
   "log",
@@ -1623,12 +1924,12 @@ const Bt = /* @__PURE__ */ new Set([
   "on",
   "emit",
   "contribute"
-]), Ft = /* @__PURE__ */ new Set(["name", "config", "requires", "provides", "setup"]);
-function pe(r) {
-  return it(r);
+]), fe = /* @__PURE__ */ new Set(["name", "config", "requires", "provides", "setup"]);
+function Ne(r) {
+  return Ct(r);
 }
-function it(r) {
-  Ut(r);
+function Ct(r) {
+  pe(r);
   const t = Object.hasOwn(r, "name") ? r.name : void 0, e = Object.hasOwn(r, "config") ? r.config : void 0, i = Object.hasOwn(r, "requires") ? r.requires : void 0, s = Object.hasOwn(r, "provides") ? r.provides : void 0, n = Object.hasOwn(r, "setup") ? r.setup : void 0;
   if (typeof t != "string" || !t.trim())
     throw new TypeError("Plugin name must be a non-empty string");
@@ -1636,24 +1937,27 @@ function it(r) {
     throw new TypeError("Plugin name cannot start or end with whitespace");
   if (typeof n != "function")
     throw new TypeError(`Plugin '${t}' must define setup()`);
-  if (e !== void 0 && !_t(e))
+  if (e !== void 0 && !ge(e))
     throw new TypeError(`Plugin '${t}' config must implement Standard Schema V1`);
-  _(i, t, "requires"), _(s, t, "provides");
-  const o = i ? Object.freeze({ ...i }) : void 0, a = s ? Object.freeze({ ...s }) : void 0, h = /* @__PURE__ */ new Map();
-  for (const [c, d] of Object.entries(o ?? {})) {
+  ht(i, t, "requires"), ht(s, t, "provides");
+  const o = /* @__PURE__ */ Object.create(null), a = /* @__PURE__ */ Object.create(null), h = /* @__PURE__ */ new Map();
+  for (const [c, d] of Object.entries(i ?? {})) {
     if (!c.trim()) throw new TypeError("Plugin requirement alias cannot be empty");
     if (c !== c.trim())
       throw new TypeError("Plugin requirement alias cannot start or end with whitespace");
-    if (Bt.has(c))
+    if (ue.has(c))
       throw new TypeError(`Plugin requirement '${c}' conflicts with the context API`);
     if (!d || typeof d != "object")
       throw new TypeError(`Plugin requirement '${c}' is not a contract`);
     if (d.kind === "optional") {
-      if (!v(d.service, "service"))
+      if (!E(d.service, "service"))
         throw new TypeError(`Optional requirement '${c}' must wrap a Service`);
-    } else if (!v(d, "service") && !v(d, "extensionPoint"))
+    } else if (!E(d, "service") && !E(d, "extensionPoint"))
       throw new TypeError(`Plugin requirement '${c}' must be a Service or ExtensionPoint`);
-    H(
+    o[c] = d.kind === "optional" ? Object.freeze({
+      kind: "optional",
+      service: _(d.service)
+    }) : _(d), dt(
       t,
       h,
       "requirement",
@@ -1661,36 +1965,41 @@ function it(r) {
       d.kind === "optional" ? d.service : d
     );
   }
-  for (const [c, d] of Object.entries(a ?? {})) {
+  for (const [c, d] of Object.entries(s ?? {})) {
     if (!c.trim()) throw new TypeError("Plugin provision alias cannot be empty");
     if (c !== c.trim())
       throw new TypeError("Plugin provision alias cannot start or end with whitespace");
-    if (!v(d, "service"))
+    if (c === "then")
+      throw new TypeError("Plugin provision alias 'then' conflicts with the Promise protocol");
+    if (!E(d, "service"))
       throw new TypeError(`Plugin provision '${c}' must be a Service`);
-    H(t, h, "provision", c, d);
+    a[c] = _(d), dt(t, h, "provision", c, a[c]);
   }
   return Object.freeze({
     name: t,
     ...e === void 0 ? {} : { config: e },
-    ...o ? { requires: o } : {},
-    ...a ? { provides: a } : {},
+    requires: Object.freeze(o),
+    provides: Object.freeze(a),
     setup: n
   });
 }
-function Ut(r) {
-  k(r, "Plugin declaration", { fields: Ft });
+function _(r) {
+  return Object.freeze({ id: r.id, kind: r.kind });
+}
+function pe(r) {
+  B(r, "Plugin declaration", { fields: fe });
 }
-function _t(r) {
+function ge(r) {
   if (!r || typeof r != "object" && typeof r != "function") return !1;
   const t = r["~standard"];
   if (!t || typeof t != "object") return !1;
   const e = t;
   return e.version === 1 && typeof e.vendor == "string" && typeof e.validate == "function";
 }
-function _(r, t, e) {
-  r !== void 0 && k(r, `Plugin '${t}' ${e}`);
+function ht(r, t, e) {
+  r !== void 0 && B(r, `Plugin '${t}' ${e}`);
 }
-function H(r, t, e, i, s) {
+function dt(r, t, e, i, s) {
   const n = t.get(s.id);
   if (!n) {
     t.set(s.id, { alias: i, kind: s.kind, role: e });
@@ -1698,38 +2007,49 @@ function H(r, t, e, i, s) {
   }
   if (n.kind !== s.kind)
     throw new TypeError(
-      `Plugin '${r}' uses Contract '${s.id}' as both ${L(n.kind)} and ${L(s.kind)}`
+      `Plugin '${r}' uses Contract '${s.id}' as both ${H(n.kind)} and ${H(s.kind)}`
     );
-  const o = L(s.kind);
+  const o = H(s.kind);
   throw n.role !== e ? new TypeError(
     `Plugin '${r}' cannot both require and provide ${o} '${s.id}'`
   ) : new TypeError(
     `Plugin '${r}' ${e} aliases '${n.alias}' and '${i}' reference the same ${o} '${s.id}'`
   );
 }
-function L(r) {
+function H(r) {
   return r === "extensionPoint" ? "ExtensionPoint" : r === "event" ? "Event" : "Service";
 }
-function K(r) {
-  return it(r);
+function lt(r) {
+  return Ct(r);
 }
-const Ht = /* @__PURE__ */ new Set(["plugin", "config"]), x = /* @__PURE__ */ new WeakMap();
-function Kt(r, t) {
-  x.get(r)?.(t);
+const we = /* @__PURE__ */ new Set(["plugin", "config"]), x = /* @__PURE__ */ new WeakMap();
+function be(r, t) {
+  x.get(r)?.discard(t);
 }
-class Wt {
+function me(r, t, e, i) {
+  const s = x.get(r);
+  if (!s) throw new Error("ChangeSet draft control has been released");
+  return s.install(t, e, i);
+}
+class ve {
   #t = /* @__PURE__ */ new Map();
   #e;
   constructor(t) {
-    this.#e = { phase: "open", port: t }, x.set(this, (e) => this.#i(e)), Object.freeze(this);
+    this.#e = { phase: "open", port: t }, x.set(this, {
+      discard: (e) => this.#s(e),
+      install: (e, i, s) => this.#i(e, i, s)
+    }), Object.freeze(this);
   }
   install(t, ...e) {
-    const i = this.#n(), s = K(t), n = i.create(s, e[0]);
-    return this.#s({ kind: "install", installation: n.record }), n.publicInstallation;
+    return this.#i(t, e[0]);
+  }
+  #i(t, e, i) {
+    const s = this.#a(), n = lt(t), o = (i ?? s.create)(n, e);
+    return this.#n({ kind: "install", installation: o.record }), o.facade;
   }
   update(t, e) {
-    const i = this.#n();
-    k(e, "Installation update", { fields: Ht });
+    const i = this.#a();
+    B(e, "Installation update", { fields: we });
     const s = Object.hasOwn(e, "plugin"), n = Object.hasOwn(e, "config");
     if (!s && !n)
       throw new TypeError("Installation update must include 'plugin' or 'config'");
@@ -1738,17 +2058,23 @@ class Wt {
     if (s) {
       const d = e.plugin;
       if (!d) throw new TypeError("Installation update 'plugin' must be a Plugin");
-      a = K(d);
+      a = lt(d);
     }
     let h;
     a && n ? h = { kind: "plugin-and-config", plugin: a, config: e.config } : a ? h = { kind: "plugin", plugin: a } : h = { kind: "config", config: e.config };
     const c = { kind: "update", installation: o, declaration: h };
-    this.#s(c);
+    this.#n(c);
   }
   remove(t) {
-    const e = this.#n();
-    this.#s({ kind: "remove", installation: e.resolve(t) });
-  }
+    const e = this.#a();
+    this.#n({ kind: "remove", installation: e.resolve(t) });
+  }
+  /**
+   * Commit is idempotent by returning the same promise, so two callers awaiting
+   * one draft get one transaction rather than two. `committing` exists to catch
+   * the reentrant case — an `attach` hook that calls `commit()` again — which
+   * would otherwise submit the operation list twice.
+   */
   commit() {
     const t = this.#e;
     if (t.phase === "submitted") return t.promise;
@@ -1764,7 +2090,7 @@ class Wt {
     } catch (n) {
       for (const o of e)
         o.kind === "install" && i.discard(o.installation, n);
-      return this.#o(Promise.reject(n));
+      return this.#r(Promise.reject(n));
     }
     let s;
     try {
@@ -1772,83 +2098,42 @@ class Wt {
     } catch (n) {
       s = Promise.reject(n);
     }
-    return this.#o(s);
+    return this.#r(s);
   }
-  #i(t) {
+  #s(t) {
     const e = this.#e;
     if (e.phase !== "open") return;
     this.#e = { phase: "discarded" };
     const i = [...this.#t.values()];
-    this.#r();
+    this.#o();
     for (const s of i)
       s.kind === "install" && e.port.discard(s.installation, t);
   }
-  #s(t) {
+  // One operation per Installation per ChangeSet. Allowing two would make the
+  // outcome depend on staging order — `update` then `remove` versus the reverse —
+  // and there is no reading of "both" that is obviously right. The caller has to
+  // say which one it meant.
+  #n(t) {
     if (this.#t.has(t.installation))
       throw new TypeError(
         `Installation '${t.installation.id}' can only appear once in the same ChangeSet`
       );
     this.#t.set(t.installation, Object.freeze(t));
   }
-  #n() {
+  #a() {
     const t = this.#e;
     if (t.phase !== "open")
       throw new TypeError(`Cannot modify a ${t.phase} ChangeSet`);
     return t.port;
   }
-  #o(t) {
-    return this.#e = { phase: "submitted", promise: t }, this.#r(), t;
+  #r(t) {
+    return this.#e = { phase: "submitted", promise: t }, this.#o(), t;
   }
-  #r() {
+  #o() {
     this.#t.clear(), x.delete(this);
   }
 }
-class Yt {
-  #t;
-  constructor(t, e, i) {
-    this.#t = { phase: "open", draft: t, discard: e, normalize: i };
-  }
-  get failure() {
-    return this.#t.phase === "failed" ? this.#t.error : void 0;
-  }
-  requireDraft() {
-    const t = this.#t;
-    if (t.phase === "failed") throw t.error;
-    if (t.phase === "sealed") throw z();
-    return t.draft;
-  }
-  assertOpen() {
-    this.requireDraft();
-  }
-  fail(t) {
-    const e = this.#t;
-    if (e.phase === "failed") return e.error;
-    if (e.phase === "sealed") throw z();
-    const i = e.normalize(t);
-    return this.#t = {
-      phase: "failed",
-      draft: e.draft,
-      discard: e.discard,
-      error: i
-    }, i;
-  }
-  seal() {
-    const t = this.#t;
-    if (t.phase === "failed") throw t.error;
-    if (t.phase === "sealed") throw z();
-    return this.#t = { phase: "sealed" }, t.draft;
-  }
-  discard(t) {
-    const e = this.#t;
-    if (e.phase === "sealed") return;
-    const i = e.phase === "failed" ? e.error : e.normalize(t);
-    this.#t = { phase: "sealed" }, e.discard(e.draft, i);
-  }
-}
-function z() {
-  return new Error("Group configuration has been sealed");
-}
-class I {
+class M {
   constructor(t, e, i) {
     this.id = t, this.name = e, this.#e = { phase: "attached", parent: i };
   }
@@ -1857,7 +2142,7 @@ class I {
   #t = /* @__PURE__ */ new Map();
   #e;
   static root(t) {
-    return new I("/", t, void 0);
+    return new M("/", t, void 0);
   }
   get attached() {
     return this.#e.phase !== "detached";
@@ -1870,21 +2155,24 @@ class I {
     return t.phase === "detached" ? void 0 : t.parent;
   }
   create(t) {
-    if (this.assertAttached(), Qt(t), this.#t.has(t))
+    if (this.assertAttached(), ye(t), this.#t.has(t))
       throw new TypeError(`Group '${this.#i(t)}' already exists`);
-    const e = new I(this.#i(t), t, this);
+    const e = new M(this.#i(t), t, this);
     return this.#t.set(t, e), e;
   }
   contains(t) {
-    if (t === this) return !0;
-    for (const e of this.#t.values())
-      if (e.contains(t)) return !0;
+    for (let e = t; e; e = e.parent)
+      if (e === this) return !0;
     return !1;
   }
   assertAttached() {
     if (this.#e.phase === "detached")
       throw new TypeError(`Group '${this.id}' has been removed`);
   }
+  // Depth-first, and children are detached before this node unlinks itself from
+  // its parent. A node that unlinked first would leave its subtree unreachable
+  // but still attached, so those groups would report themselves as live with no
+  // path back to the root.
   detach() {
     const t = this.#e;
     if (t.phase !== "detached") {
@@ -1904,14 +2192,59 @@ class I {
     return this.id === "/" ? `/${t}` : `${this.id}/${t}`;
   }
 }
-function Qt(r) {
+function ye(r) {
   if (typeof r != "string" || !r.trim())
     throw new TypeError("Group name must be a non-empty string");
   if (r !== r.trim())
     throw new TypeError("Group name cannot start or end with whitespace");
   if (r.includes("/")) throw new TypeError("Group name cannot contain '/'");
 }
-class W {
+class Ee {
+  #t;
+  constructor(t, e, i) {
+    this.#t = { phase: "open", draft: t, discard: e, normalize: i };
+  }
+  get failure() {
+    return this.#t.phase === "failed" ? this.#t.error : void 0;
+  }
+  requireDraft() {
+    const t = this.#t;
+    if (t.phase === "failed") throw t.error;
+    if (t.phase === "sealed") throw K();
+    return t.draft;
+  }
+  assertOpen() {
+    this.requireDraft();
+  }
+  fail(t) {
+    const e = this.#t;
+    if (e.phase === "failed") return e.error;
+    if (e.phase === "sealed") throw K();
+    const i = e.normalize(t);
+    return this.#t = {
+      phase: "failed",
+      draft: e.draft,
+      discard: e.discard,
+      error: i
+    }, i;
+  }
+  seal() {
+    const t = this.#t;
+    if (t.phase === "failed") throw t.error;
+    if (t.phase === "sealed") throw K();
+    return this.#t = { phase: "sealed" }, t.draft;
+  }
+  discard(t) {
+    const e = this.#t;
+    if (e.phase === "sealed") return;
+    const i = e.phase === "failed" ? e.error : e.normalize(t);
+    this.#t = { phase: "sealed" }, e.discard(e.draft, i);
+  }
+}
+function K() {
+  return new Error("Group configuration has been sealed");
+}
+class ut {
   constructor(t, e, i) {
     this.node = t, this.#t = { phase: e }, this.#e = i;
   }
@@ -1931,6 +2264,19 @@ class W {
     if (i.phase === "failed") throw i.error;
     await t();
   }
+  /**
+   * `preserveCommittedState` is the whole point of this class.
+   *
+   * A Group that has already committed something is established, and a later
+   * failed change does not un-establish it — the transaction rolled back, so the
+   * state the Group describes is still the one that was committed. Such a
+   * failure leaves the phase at `established` and does not rethrow, because the
+   * caller of the failed change already has the error.
+   *
+   * A Group whose *first* change fails never had a committed state, so it does
+   * become `failed` and the failure propagates: there is nothing to report but
+   * the failure.
+   */
   track(t) {
     this.node.assertAttached();
     const e = this.#t, i = e.phase === "established" || e.phase === "pending" && e.baseline === "established", s = {}, n = t.then(
@@ -1938,7 +2284,7 @@ class W {
         this.#i(s) && (this.#t = { phase: "established" }, this.#e?.());
       },
       (o) => {
-        const a = $(
+        const a = V(
           o,
           "GROUP_UNAVAILABLE",
           `Group '${this.node.id}' operation failed with a non-Error value`
@@ -1962,15 +2308,15 @@ class W {
     return e.phase === "pending" && e.attempt === t;
   }
 }
-function A(r) {
+function D(r) {
   return new u("GROUP_REMOVED", `Group '${r.id}' has been removed`);
 }
-const C = /* @__PURE__ */ new WeakMap();
-class Jt {
+const P = /* @__PURE__ */ new WeakMap();
+class Ce {
   #t;
   #e;
   constructor(t, e, i) {
-    this.#t = e, this.#e = i ? { phase: "configuring", coordinator: t, configuration: i } : { phase: "attached", coordinator: t }, C.set(this, {
+    this.#t = e, this.#e = i ? { phase: "configuring", coordinator: t, configuration: i } : { phase: "attached", coordinator: t }, P.set(this, {
       finishConfiguration: () => {
         const s = this.#e;
         s.phase === "configuring" && (this.#e = { phase: "attached", coordinator: s.coordinator });
@@ -1992,11 +2338,16 @@ class Jt {
   }
   ready() {
     const t = this.#e;
-    return t.phase === "revoked" ? Promise.reject(A(this.#t)) : t.coordinator.ready(this.#t);
+    return t.phase === "revoked" ? Promise.reject(D(this.#t)) : t.coordinator.ready(this.#t);
   }
   install(t, ...e) {
     const i = this.#e;
-    return i.phase === "configuring" ? i.configuration.requireDraft().install(t, ...e) : this.#i().install(this.#t, t, ...e);
+    return i.phase === "configuring" ? i.coordinator.stageConfigurationInstall(
+      this.#t,
+      i.configuration,
+      t,
+      ...e
+    ) : this.#i().install(this.#t, t, ...e);
   }
   change() {
     if (this.#e.phase === "configuring")
@@ -2020,19 +2371,19 @@ class Jt {
   }
   #i() {
     const t = this.#e;
-    if (t.phase === "revoked") throw A(this.#t);
+    if (t.phase === "revoked") throw D(this.#t);
     return t.coordinator;
   }
 }
-class Xt {
+class Se {
   root;
   #t;
   #e = /* @__PURE__ */ new WeakMap();
   #i = /* @__PURE__ */ new WeakMap();
   constructor(t, e) {
-    this.root = I.root(t), this.#t = e, this.#i.set(
+    this.root = M.root(t), this.#t = e, this.#i.set(
       this.root,
-      new W(this.root, "established", () => e.notifyChanged())
+      new ut(this.root, "established", () => e.notifyChanged())
     );
   }
   nodes() {
@@ -2040,15 +2391,29 @@ class Xt {
   }
   install(t, e, ...i) {
     const s = this.change(t), n = s.install(e, ...i);
-    return Y(s.commit()), n;
+    return ft(s.commit()), n;
   }
+  stageConfigurationInstall(t, e, i, ...s) {
+    return this.#r(t), me(
+      e.requireDraft(),
+      i,
+      s[0],
+      (n, o) => (this.#r(t), this.#t.createDraft(t, n, o))
+    );
+  }
+  /**
+   * `deferred` tracking exists for `create()`. A Group being configured must not
+   * mark itself pending on each nested install, because the whole configuration
+   * commits once; the coordinator attaches that single operation to every node in
+   * the finished subtree instead.
+   */
   change(t, e = "immediate") {
-    return this.#r(t), new Wt({
+    return this.#r(t), new ve({
       create: (i, s) => (this.#r(t), this.#t.createDraft(t, i, s)),
       resolve: (i) => {
         this.#r(t);
         const s = this.#t.resolveInstallation(i);
-        if (!s.attached) throw s.unavailableError();
+        if (!s.hasAuthority) throw s.unavailableError();
         if (!t.contains(s.group))
           throw new TypeError(`Installation '${s.id}' is outside Group '${t.id}'`);
         return s;
@@ -2057,7 +2422,7 @@ class Xt {
         this.#r(t);
         const s = this.#t.executeChanges(t, i);
         for (const n of i) n.installation.trackReadiness(s);
-        return i.length && e === "immediate" && this.#o(t, s), s;
+        return i.length && e === "immediate" && this.#a(t, s), s;
       },
       attach: (i) => {
         this.#r(t), this.#t.attachInstallation(i);
@@ -2068,33 +2433,33 @@ class Xt {
   create(t, e, i, s) {
     if (typeof i != "function") throw new TypeError("Group configure must be a function");
     const n = t.create(e);
-    this.#i.set(n, new W(n, "new", () => this.#t.notifyChanged()));
-    const o = s === void 0, a = s ?? new Yt(
+    this.#i.set(n, new ut(n, "new", () => this.#t.notifyChanged()));
+    const o = s === void 0, a = s ?? new Ee(
       this.change(n, "deferred"),
-      Kt,
-      (c) => $(
+      be,
+      (c) => V(
         c,
         "GROUP_UNAVAILABLE",
         `Group '${n.id}' configuration failed with a non-Error value`
       )
-    ), h = new Jt(this, n, a);
+    ), h = new Ce(this, n, a);
     this.#e.set(n, h);
     try {
       const c = i(h);
-      te(c) && Zt(c);
+      R(c, "Group configure must be synchronous");
       const d = a.failure;
       if (d) throw d;
     } catch (c) {
       const d = a.fail(c), l = n.walk();
-      throw n.detach(), this.#a(l), o && a.discard(d), this.#t.notifyChanged(), d;
+      throw n.detach(), this.#o(l), o && a.discard(d), this.#t.notifyChanged(), d;
     }
     if (o) {
       const c = a.seal().commit();
       for (const d of n.walk()) {
         const l = this.#e.get(d);
-        l && C.get(l)?.finishConfiguration(), this.#o(d, c);
+        l && P.get(l)?.finishConfiguration(), this.#a(d, c);
       }
-      Y(c);
+      ft(c);
     }
     return this.#t.notifyChanged(), h;
   }
@@ -2110,56 +2475,53 @@ class Xt {
     if (t === this.root) throw new TypeError("The root Group cannot be removed");
     return t.attached ? this.#t.runExclusive(async () => {
       if (!t.attached) {
-        this.#a([t]);
+        this.#o([t]);
         return;
       }
       const e = t.walk(), i = this.#s(t).map((s) => ({
         kind: "remove",
         installation: s
       }));
-      await this.#t.removeInstallations(i), t.detach(), this.#a(e), this.#t.notifyChanged();
-    }) : (this.#a([t]), Promise.resolve());
+      await this.#t.removeInstallations(i), t.detach(), this.#o(e), this.#t.notifyChanged();
+    }) : (this.#o([t]), Promise.resolve());
   }
   #s(t) {
     return [...this.#t.installations()].filter(
       (e) => t.contains(e.group)
     );
   }
+  // A Group has no status of its own — it reports what its contents say, with
+  // the worst news winning. The last line is the one that needs stating: an
+  // empty Group is `active`, because a subtree that owns nothing has nothing
+  // left to wait for.
   #n(t) {
     const e = this.#s(t);
     return e.some((i) => i.status === "failed") ? "failed" : e.some((i) => i.status === "stopping") ? "stopping" : e.length && e.every((i) => i.status === "active") ? "active" : e.length ? "pending" : "active";
   }
-  #o(t, e) {
+  #a(t, e) {
     this.#r(t).track(e);
   }
   #r(t) {
     const e = this.#i.get(t);
-    if (!t.attached || !e) throw A(t);
+    if (!t.attached || !e) throw D(t);
     return e;
   }
-  #a(t) {
+  #o(t) {
     for (const e of t) {
       this.#i.get(e)?.release(), this.#i.delete(e);
       const i = this.#e.get(e);
-      i && (C.get(i)?.revoke(), C.delete(i)), this.#e.delete(e);
+      i && (P.get(i)?.revoke(), P.delete(i)), this.#e.delete(e);
     }
   }
 }
-function Y(r) {
+function ft(r) {
   Promise.resolve(r).catch(() => {
   });
 }
-function Zt(r) {
-  throw Promise.resolve(r).catch(() => {
-  }), new TypeError("Group configure must be synchronous");
-}
-function te(r) {
-  return r === null || typeof r != "object" && typeof r != "function" ? !1 : typeof r.then == "function";
-}
-function Q(r, t) {
+function pt(r, t) {
   return Object.freeze({ plugin: r, config: t });
 }
-class ee {
+class Oe {
   constructor(t, e, i, s) {
     this.id = t, this.index = e, this.groupId = i.id, this.#i = { declaration: s, group: i, notifyChanged: void 0 };
   }
@@ -2171,7 +2533,7 @@ class ee {
   groupId;
   #s = /* @__PURE__ */ new Set();
   attach(t) {
-    const e = this.#d();
+    const e = this.#h();
     if (e.notifyChanged) throw new Error(`Installation '${this.id}' is already attached`);
     e.notifyChanged = t;
   }
@@ -2179,7 +2541,7 @@ class ee {
     return this.#t.phase;
   }
   /** Whether the owning ChangeSet has granted this Installation Host authority. */
-  get attached() {
+  get hasAuthority() {
     return this.#i?.notifyChanged !== void 0;
   }
   get instance() {
@@ -2189,18 +2551,18 @@ class ee {
   get error() {
     const t = this.#t;
     if (t.phase === "failed")
-      return t.failure.retention === "live" ? t.failure.error : se(t.failure.summary);
+      return t.error;
     if (t.phase === "removed")
       return new u("INSTALLATION_REMOVED", `Installation '${this.id}' has been removed`);
   }
   get group() {
-    return this.#d().group;
+    return this.#h().group;
   }
   get declaration() {
-    return this.#d().declaration;
+    return this.#h().declaration;
   }
   replaceDeclaration(t) {
-    this.#d().declaration = t;
+    this.#h().declaration = t;
   }
   ready() {
     const t = this.#e;
@@ -2212,18 +2574,34 @@ class ee {
       `Installation '${this.id}' has not been committed`
     );
   }
+  /**
+   * Binds `ready()` to the change currently in flight.
+   *
+   * The `attempt` token is the point: a second change can start before the
+   * first one's promise settles, and only the latest attempt is allowed to clear
+   * the barrier. Without it, a stale resolution would report readiness for an
+   * attempt that has already been superseded.
+   *
+   * A rejection is rethrown only when this Installation did not end up active.
+   * A change that failed elsewhere in the batch but left this one running is not
+   * this Installation's failure to report.
+   */
   trackReadiness(t) {
     const e = {}, i = t.then(
       () => {
         this.#e?.attempt === e && (this.#e = void 0);
       },
       (s) => {
-        if (this.#e?.attempt === e && (this.#e = void 0), this.#t.phase !== "active") throw s;
+        if (this.#e?.attempt === e && (this.#e = void 0), this.#t.phase !== "active") throw this.error ?? s;
       }
     );
     this.#e = { attempt: e, barrier: i }, i.catch(() => {
     });
   }
+  // A terminal state only answers `ready()` once its readiness has been settled.
+  // Before that the outcome is still being decided by the change in flight, so
+  // the caller joins the waiter set instead of being told a result that the
+  // transaction might still roll back.
   #n() {
     const t = this.#t;
     if ((t.phase === "active" || t.phase === "failed" || t.phase === "removed") && t.readiness === "settled") {
@@ -2262,23 +2640,29 @@ class ee {
     this.#r({ phase: "pending" });
   }
   fail(t) {
-    return this.#o(t);
-  }
+    return this.#a(t);
+  }
+  /**
+   * For an Installation that never made it into the graph. Unlike `fail()`, this
+   * is terminal: readiness settles immediately, the attachment is dropped, and
+   * the reason is kept as a RecordedFailure rather than the live Error. The handle the
+   * caller already holds stays usable and reports why it is dead.
+   */
   discard(t) {
-    const e = this.#a(t);
+    const e = new J(this.#o(t));
     this.#r({
       phase: "failed",
-      failure: { retention: "summary", summary: ie(e) },
+      error: e,
       readiness: "settled"
     });
     for (const i of this.#s) i.reject(e);
     this.#s.clear(), this.#e = void 0, this.#i = void 0;
   }
-  #o(t) {
-    const e = this.#a(t);
+  #a(t) {
+    const e = this.#o(t);
     return this.#r({
       phase: "failed",
-      failure: { retention: "live", error: e },
+      error: e,
       readiness: "unsettled"
     }), e;
   }
@@ -2288,36 +2672,25 @@ class ee {
   #r(t) {
     this.#t = t, this.#i?.notifyChanged?.();
   }
-  #a(t) {
-    return $(
+  #o(t) {
+    return V(
       t,
       "INSTALLATION_UNAVAILABLE",
       `Installation '${this.id}' failed with a non-Error value`
     );
   }
-  #d() {
+  #h() {
     const t = this.#i;
     if (!t) throw new Error(`Installation '${this.id}' is no longer installed`);
     return t;
   }
 }
-function ie(r) {
-  return r instanceof u ? { category: "dougong", name: r.name, message: r.message, code: r.code } : {
-    category: r instanceof TypeError ? "typeError" : "error",
-    name: r.name,
-    message: r.message
-  };
-}
-function se(r) {
-  const t = r.category === "dougong" ? new u(r.code, r.message) : r.category === "typeError" ? new TypeError(r.message) : new Error(r.message);
-  return t.name = r.name, t;
-}
-const O = /* @__PURE__ */ new WeakMap();
-class re {
+const L = /* @__PURE__ */ new WeakMap();
+class Ae {
   #t;
   #e = { phase: "draft" };
   constructor(t) {
-    this.#t = t, O.set(this, {
+    this.#t = t, L.set(this, {
       attach: (e, i) => {
         if (this.#e.phase !== "draft")
           throw new Error(`Installation '${this.#t.id}' control is already sealed`);
@@ -2362,7 +2735,7 @@ class re {
     );
   }
 }
-class ne {
+class Ie {
   #t = /* @__PURE__ */ new Map();
   #e = /* @__PURE__ */ new WeakMap();
   #i = /* @__PURE__ */ new WeakMap();
@@ -2382,13 +2755,13 @@ class ne {
   }
   create(t, e, i) {
     t.assertAttached();
-    const s = ++this.#n, n = new ee(
+    const s = ++this.#n, n = new Oe(
       `${e.name}:${s}`,
       s,
       t,
-      Q(e, i)
-    ), o = new re(n);
-    return this.#e.set(o, n), this.#i.set(n, o), { record: n, publicInstallation: o };
+      pt(e, i)
+    ), o = new Ae(n);
+    return this.#e.set(o, n), this.#i.set(n, o), { record: n, facade: o };
   }
   resolve(t) {
     const e = this.#e.get(t);
@@ -2398,13 +2771,19 @@ class ne {
   attach(t) {
     const e = this.#i.get(t);
     if (!e) throw new Error(`Installation '${t.id}' has no public facade`);
-    const i = O.get(e);
+    const i = L.get(e);
     if (!i) throw new Error(`Installation '${t.id}' has no draft control`);
     t.attach(this.#s.notifyChanged), i.attach(
       (s) => this.#s.update(t, e, s),
       () => this.#s.remove(t, e)
     );
   }
+  /**
+   * Validates the whole batch, then applies the whole batch. The two loops are
+   * not a style choice: a rejected operation halfway through a single loop would
+   * leave the earlier ones already written, and this method has no way to undo
+   * them. Checking first means `apply` either changes everything or nothing.
+   */
   apply(t) {
     for (const e of t) {
       if (e.kind === "install") {
@@ -2425,37 +2804,39 @@ class ne {
         this.#t.set(e.installation.id, e.installation);
       else if (e.kind === "update") {
         const i = e.installation.declaration, s = e.declaration.kind === "config" ? i.plugin : e.declaration.plugin, n = e.declaration.kind === "plugin" ? i.config : e.declaration.config;
-        e.installation.replaceDeclaration(Q(s, n));
+        e.installation.replaceDeclaration(pt(s, n));
       } else this.contains(e.installation) && this.#t.delete(e.installation.id);
   }
   settleChanges(t, e) {
     for (const i of t)
-      i.kind === "remove" ? (i.installation.remove(), i.installation.settleReady(), this.#o(i.installation)) : e || i.installation.deactivate();
+      i.kind === "remove" ? (i.installation.remove(), i.installation.settleReady(), this.#a(i.installation)) : e || i.installation.deactivate();
   }
   settleReadiness(t) {
     for (const e of t) e.settleReady();
   }
   discard(t, e) {
-    t.discard(e), this.#o(t);
+    t.discard(e), this.#a(t);
   }
+  // Captures declarations only, since that is all a rollback restores. Instances
+  // belong to the InstanceCoordinator and are rebuilt from the previous plan
+  // rather than snapshotted — a live Instance is not a value that can be copied.
   capture() {
-    return [...this.#t].map(([t, e]) => ({
-      id: t,
-      installation: e,
-      declaration: e.declaration
+    return [...this.#t.values()].map((t) => ({
+      installation: t,
+      declaration: t.declaration
     }));
   }
   restore(t) {
     this.#t.clear();
     for (const e of t)
-      e.installation.replaceDeclaration(e.declaration), this.#t.set(e.id, e.installation);
+      e.installation.replaceDeclaration(e.declaration), this.#t.set(e.installation.id, e.installation);
   }
-  #o(t) {
+  #a(t) {
     const e = this.#i.get(t);
-    e && (O.get(e)?.revoke(), O.delete(e)), this.#i.delete(t);
+    e && (L.get(e)?.revoke(), L.delete(e)), this.#i.delete(t);
   }
 }
-class oe {
+class je {
   #t = Promise.resolve();
   get settled() {
     return this.#t;
@@ -2472,8 +2853,8 @@ class oe {
     ), e;
   }
 }
-const ae = console, ce = /* @__PURE__ */ new Set(["name", "logger", "onError"]);
-class he {
+const ke = console, $e = /* @__PURE__ */ new Set(["name", "logger", "onError"]);
+class Te {
   name;
   diagnostics;
   #t;
@@ -2481,11 +2862,11 @@ class he {
   #i;
   #s;
   #n;
-  #o;
+  #a;
   #r = "idle";
-  #a = new oe();
+  #o = new je();
   constructor(t = {}) {
-    k(t, "Host options", { fields: ce });
+    B(t, "Host options", { fields: $e });
     const e = Object.hasOwn(t, "name") ? t.name : void 0, i = Object.hasOwn(t, "logger") ? t.logger : void 0, s = Object.hasOwn(t, "onError") ? t.onError : void 0, n = e ?? "host";
     if (typeof n != "string" || !n.trim())
       throw new TypeError("Host name must be a non-empty string");
@@ -2493,10 +2874,10 @@ class he {
       throw new TypeError("Host name cannot start or end with whitespace");
     if (s !== void 0 && typeof s != "function")
       throw new TypeError("Host onError must be a function");
-    if (i !== void 0 && !zt(i))
+    if (i !== void 0 && !se(i))
       throw new TypeError("Host logger must implement debug/info/warn/error");
-    this.name = n, this.#i = i ?? ae, this.#n = s ?? ((o) => this.#i.error(o)), this.#t = new ne({
-      notifyChanged: () => this.#p(),
+    this.name = n, this.#i = i ?? ke, this.#n = s ?? ((o) => this.#i.error(o)), this.#t = new Ie({
+      notifyChanged: () => this.#d(),
       update: (o, a, h) => {
         const c = this.#s.change(o.group);
         return c.update(a, h), c.commit();
@@ -2505,25 +2886,29 @@ class he {
         const h = this.#s.change(o.group);
         return h.remove(a), h.commit();
       }
-    }), this.#o = new Dt({
+    }), this.#a = new de({
       hostName: n,
       logger: this.#i,
       isInstalled: (o) => this.#t.has(o),
-      report: (o) => this.#h(o)
-    }), this.#s = new Xt(n, {
+      report: (o) => this.#c(o)
+    }), this.#s = new Se(n, {
       installations: () => this.#t.values(),
       createDraft: (o, a, h) => this.#t.create(o, a, h),
       resolveInstallation: (o) => this.#t.resolve(o),
-      executeChanges: (o, a) => this.#d(o, a),
+      executeChanges: (o, a) => this.#h(o, a),
       attachInstallation: (o) => this.#t.attach(o),
       discardInstallation: (o, a) => this.#t.discard(o, a),
-      runExclusive: (o) => this.#a.run(o),
-      removeInstallations: (o) => this.#f(o),
-      notifyChanged: () => this.#p()
-    }), this.#e = new Gt(
+      runExclusive: (o) => this.#o.run(o),
+      removeInstallations: (o) => this.#p(o),
+      notifyChanged: () => this.#d()
+    }), this.#e = new le(
       n,
-      this.#s.nodes(),
-      (o) => this.#h(o)
+      () => ({
+        status: this.#r,
+        installations: this.#t.values(),
+        groups: this.#s.nodes()
+      }),
+      (o) => this.#c(o)
     ), this.diagnostics = this.#e.view, Object.freeze(this);
   }
   get status() {
@@ -2531,10 +2916,10 @@ class he {
   }
   get(t) {
     const e = this.#r === "active" ? "available" : "unavailable";
-    return this.#o.get(t, e);
+    return this.#a.get(t, e);
   }
   contributions(t) {
-    return this.#o.contributions(t);
+    return this.#a.contributions(t);
   }
   install(t, ...e) {
     return this.#s.install(this.#s.root, t, ...e);
@@ -2546,14 +2931,14 @@ class he {
     return this.#s.create(this.#s.root, t, e);
   }
   start() {
-    return this.#a.run(async () => {
+    return this.#o.run(async () => {
       if (this.#r !== "active") {
-        this.#c("starting");
+        this.#l("starting");
         try {
-          const t = this.#o.buildPlan(this.#t.values());
-          await this.#o.start(t), this.#c("active"), this.#t.settleReadiness(t.order);
+          const t = this.#a.buildPlan(this.#t.values());
+          await this.#a.start(t), this.#l("active"), this.#t.settleReadiness(t.order);
         } catch (t) {
-          this.#c("idle");
+          this.#l("idle");
           for (const e of this.#t.values())
             e.status !== "active" && e.fail(t);
           throw this.#t.settleReadiness(this.#t.values()), t;
@@ -2562,21 +2947,21 @@ class he {
     });
   }
   stop() {
-    return this.#a.run(async () => {
+    return this.#o.run(async () => {
       if (this.#r === "idle") return;
-      this.#c("stopping");
-      const t = await this.#o.stop();
-      if (this.#c("idle"), t.length === 1) throw t[0];
+      this.#l("stopping");
+      const t = await this.#a.stop();
+      if (this.#l("idle"), t.length === 1) throw t[0];
       if (t.length > 1) throw new AggregateError(t, "Host shutdown failed");
     });
   }
-  #d(t, e) {
+  #h(t, e) {
     const i = e.filter((s) => s.kind === "install").map((s) => s.installation);
-    return this.#a.run(async () => {
+    return this.#o.run(async () => {
       try {
-        if (!t.attached) throw A(t);
+        if (!t.attached) throw D(t);
         if (!e.length) return;
-        this.#r === "active" ? await this.#l(e) : (this.#t.apply(e), this.#t.settleChanges(e, !1)), this.#p();
+        this.#r === "active" ? await this.#u(e) : (this.#t.apply(e), this.#t.settleChanges(e, !1)), this.#d();
       } catch (s) {
         for (const n of i)
           this.#t.contains(n) || this.#t.discard(n, s);
@@ -2584,71 +2969,92 @@ class he {
       }
     });
   }
-  async #f(t) {
-    t.length && this.#r === "active" ? await this.#l(t) : (this.#t.apply(t), this.#t.settleChanges(t, !1));
+  async #p(t) {
+    t.length && this.#r === "active" ? await this.#u(t) : (this.#t.apply(t), this.#t.settleChanges(t, !1));
   }
-  async #l(t) {
-    const e = await this.#u(t);
+  async #u(t) {
+    const e = await this.#f(t);
     if (this.#t.settleReadiness(e.affected), e.kind === "rolled-back") throw e.error;
     this.#t.settleChanges(t, !0);
   }
-  async #u(t) {
+  // Three failure levels, in the order they are attempted:
+  //
+  //   1. the new plan does not even build       restore declarations, stay active
+  //   2. the plan builds but activation fails   Engine rolls back to the previous
+  //                                             Instances and reports the cause
+  //   3. rollback itself cannot complete        fail closed: everything stops and
+  //                                             the Host reports `idle`
+  //
+  // Level 3 is the one worth stating out loud. A Host that cannot restore its
+  // previous state is not healthy, so it refuses to present itself as active —
+  // `hasCommittedPlan` is what distinguishes the two outcomes here.
+  async #f(t) {
     const e = this.#t.capture(), i = new Set(t.map((n) => n.installation));
-    this.#c("changing");
+    this.#l("changing");
     let s;
     try {
-      this.#t.apply(t), s = this.#o.buildPlan(this.#t.values());
+      this.#t.apply(t), s = this.#a.buildPlan(this.#t.values());
     } catch (n) {
-      throw this.#t.restore(e), this.#c("active"), n;
+      throw this.#t.restore(e), this.#l("active"), n;
     }
     try {
-      const n = await this.#o.transition(
+      const n = await this.#a.transition(
         s,
         i,
         () => this.#t.restore(e)
       );
-      return this.#c("active"), n;
+      return this.#l("active"), n;
     } catch (n) {
-      throw this.#c(this.#o.hasCommittedPlan ? "active" : "idle"), n;
+      throw this.#l(this.#a.hasCommittedPlan ? "active" : "idle"), n;
     }
   }
-  #h(t) {
+  #c(t) {
+    const e = this.#i;
     try {
-      this.#n(t);
-    } catch (e) {
-      try {
-        this.#i.error(
-          new AggregateError([t, e], "Host error reporter failed")
-        );
-      } catch {
-      }
+      const i = this.#n(t);
+      Promise.resolve(i).catch((s) => {
+        gt(e, t, s);
+      });
+    } catch (i) {
+      gt(e, t, i);
     }
   }
-  #c(t) {
-    this.#r = t, this.#p();
+  #l(t) {
+    this.#r = t, this.#d();
   }
-  #p() {
-    this.#e.publish(this.#r, this.#t.values(), this.#s.nodes());
+  #d() {
+    this.#e.publish();
   }
 }
-function ge(r) {
-  return new he(r);
+function xe(r) {
+  return new Te(r);
+}
+function gt(r, t, e) {
+  try {
+    const i = r.error(
+      new AggregateError([t, e], "Host error reporter failed")
+    );
+    Promise.resolve(i).catch(() => {
+    });
+  } catch {
+  }
 }
 export {
-  at as ConfigValidationError,
+  $t as ConfigValidationError,
   u as DougongError,
-  S as ReadonlyMapSnapshot,
-  oe as SerialQueue,
-  q as SnapshotPublisher,
-  k as assertPlainRecord,
-  j as asyncDisposeSymbol,
-  ge as createHost,
-  pe as definePlugin,
-  g as disposeSymbol,
-  le as event,
-  ue as extensionPoint,
-  J as isCancellationReason,
-  zt as isLogger,
-  fe as optional,
-  de as service
+  z as ReadonlyMapSnapshot,
+  J as RecordedFailure,
+  je as SerialQueue,
+  Z as SnapshotPublisher,
+  B as assertPlainRecord,
+  F as asyncDisposeSymbol,
+  xe as createHost,
+  Ne as definePlugin,
+  v as disposeSymbol,
+  Le as event,
+  ze as extensionPoint,
+  wt as isCancellationReason,
+  se as isLogger,
+  Re as optional,
+  It as service
 };