@dougongjs/core 0.4.0 → 0.5.0

package/dist/index.js

@@ -1,42 +1,42 @@
-function at(r, t) {
+function Ot(r, t) {
   if (typeof t != "string" || !t.trim())
     throw new TypeError(`${r} id must be a non-empty string`);
   if (t !== t.trim())
     throw new TypeError(`${r} id cannot start or end with whitespace`);
 }
-function V(r, t) {
-  return at("Contract", t), Object.freeze({ id: t, kind: r });
+function Q(r, t) {
+  return Ot("Contract", t), Object.freeze({ id: t, kind: r });
 }
-function v(r, t) {
+function E(r, t) {
   if (!r || typeof r != "object") return !1;
   const e = r;
   return typeof e.id == "string" && e.id.length > 0 && e.id === e.id.trim() && (e.kind === "service" || e.kind === "extensionPoint" || e.kind === "event") && (t === void 0 || e.kind === t);
 }
-function m(r, t) {
-  if (!v(r, t))
-    throw new TypeError(t ? `Expected ${ct(t)}` : "Invalid contract");
+function A(r, t) {
+  if (!E(r, t))
+    throw new TypeError(t ? `Expected ${At(t)}` : "Invalid contract");
 }
-function ct(r) {
+function At(r) {
   return r === "extensionPoint" ? "an ExtensionPoint" : r === "event" ? "an Event" : "a Service";
 }
-function fe(r) {
-  return V("service", r);
+function It(r) {
+  return Q("service", r);
 }
-function pe(r) {
-  return V("event", r);
+function Le(r) {
+  return Q("event", r);
 }
-function ge(r) {
-  return V("extensionPoint", r);
+function ze(r) {
+  return Q("extensionPoint", r);
 }
-function we(r) {
-  if (!v(r, "service"))
+function Re(r) {
+  if (!E(r, "service"))
     throw new TypeError("optional() expects a Service");
-  return Object.freeze({ kind: "optional", service: r });
+  return Object.freeze({ kind: "optional", service: It(r.id) });
 }
-function ht(r) {
+function jt(r) {
   if (!r || typeof r != "object") return !1;
   const t = r;
-  return t.kind === "optional" && v(t.service, "service");
+  return t.kind === "optional" && E(t.service, "service");
 }
 class u extends Error {
   name = "DougongError";
@@ -48,62 +48,89 @@ class u extends Error {
     super(e, i), this.code = t;
   }
 }
-class dt {
-  #t;
+class J extends Error {
+  name = "RecordedFailure";
+  code;
+  snapshot;
   constructor(t) {
-    if (!(t instanceof Error)) throw new TypeError("ErrorSummary expects an Error");
-    const e = F(t, "name", "Error"), i = F(t, "message", ""), s = t instanceof u ? lt(t) : void 0;
-    this.#t = Object.freeze(
-      s === void 0 ? {
-        category: t instanceof TypeError ? "typeError" : "error",
-        name: e,
-        message: i
-      } : {
-        category: "coded",
-        name: e,
-        message: i,
-        code: s
-      }
-    ), Object.freeze(this);
-  }
-  restore(t = (e, i) => new u(e, i)) {
-    const e = this.#t, i = e.category === "coded" ? t(e.code, e.message) : e.category === "typeError" ? new TypeError(e.message) : new Error(e.message);
-    if (!(i instanceof Error))
-      throw new TypeError("ErrorSummary coded error factory must return an Error");
-    return i.name = e.name, i;
+    if (!(t instanceof Error)) throw new TypeError("RecordedFailure expects an Error");
+    const e = t instanceof J ? t.snapshot : kt(t);
+    super(e.message), this.code = e.code, this.snapshot = e, e.stack !== void 0 && (this.stack = e.stack), Object.freeze(this);
   }
 }
-function F(r, t, e) {
-  try {
-    const i = r[t];
-    return typeof i == "string" ? i : e;
-  } catch {
-    return e;
-  }
+function kt(r) {
+  const t = /* @__PURE__ */ new Set();
+  let e = 32;
+  const i = (s, n) => {
+    if (n > 4 || e-- <= 0 || t.has(s))
+      return Object.freeze({
+        name: "TruncatedError",
+        message: "Error chain truncated",
+        truncated: !0
+      });
+    if (!(s instanceof Error)) {
+      const p = s === null || ["string", "number", "boolean", "undefined", "bigint", "symbol"].includes(typeof s) ? String(s).slice(0, 4096) : "Non-Error object omitted";
+      return Object.freeze({ name: "NonError", message: p });
+    }
+    t.add(s);
+    let o = !1;
+    const a = (p, w) => (p.length > w && (o = !0), p.slice(0, w)), h = (p, w) => {
+      const b = m(s, p);
+      return typeof b == "string" ? a(b, w) : void 0;
+    }, c = (p) => {
+      const w = m(s, p);
+      if (Array.isArray(w))
+        return w.length > 8 && (o = !0), Array.from(
+          { length: Math.min(w.length, 8) },
+          (b, j) => m(w, j)
+        );
+    }, d = h("name", 256) ?? "Error", l = h("message", 4096) ?? "", f = h("stack", 16384), g = h("code", 256), I = m(s, "cause"), et = c("errors"), it = h("manifestName", 256), st = c("denied")?.filter((p) => typeof p == "string").map((p) => a(p, 256)), rt = c("issues")?.map((p) => {
+      const w = m(p, "message"), b = m(p, "path"), j = Array.isArray(b) ? Array.from({ length: Math.min(b.length, 16) }, (Pe, St) => {
+        const k = m(b, St), S = k && typeof k == "object" ? m(k, "key") : k;
+        return typeof S == "number" ? S : typeof S == "string" || typeof S == "symbol" ? a(String(S), 256) : "[omitted]";
+      }) : void 0;
+      return Array.isArray(b) && b.length > 16 && (o = !0), Object.freeze({
+        message: typeof w == "string" ? a(w, 4096) : "",
+        ...j ? { path: Object.freeze(j) } : {}
+      });
+    });
+    return Object.freeze({
+      name: d,
+      message: l,
+      ...g === void 0 ? {} : { code: g },
+      ...f === void 0 ? {} : { stack: f },
+      ...I === void 0 ? {} : { cause: i(I, n + 1) },
+      ...et === void 0 ? {} : { errors: Object.freeze(et.map((p) => i(p, n + 1))) },
+      ...it === void 0 ? {} : { manifestName: it },
+      ...st === void 0 ? {} : { denied: Object.freeze(st) },
+      ...rt === void 0 ? {} : { issues: Object.freeze(rt) },
+      ...o ? { truncated: !0 } : {}
+    });
+  };
+  return i(r, 0);
 }
-function lt(r) {
+function m(r, t) {
   try {
-    const t = r.code;
-    return typeof t == "string" && t.trim() === t && t.length > 0 ? t : void 0;
+    return r && typeof r == "object" ? r[t] : void 0;
   } catch {
     return;
   }
 }
-class z extends u {
+class G extends u {
 }
-function $(r, t, e) {
-  return r instanceof z ? r.code === t ? r : new z(t, e, { cause: r.cause }) : r instanceof Error ? r : new z(t, e, { cause: r });
+function V(r, t, e) {
+  return r instanceof G ? r.code === t ? r : new G(t, e, { cause: r.cause }) : r instanceof Error ? r : new G(t, e, { cause: r });
 }
-function tt(r, t) {
+function wt(r, t) {
   if (!r || typeof r != "object" || typeof r.aborted != "boolean" || typeof r.addEventListener != "function" || typeof r.removeEventListener != "function" || typeof r.throwIfAborted != "function")
     throw new TypeError("Cancellation classifier expects an AbortSignal");
   return r.aborted ? Object.is(t, r.reason) ? !0 : t instanceof Error && t.name === "AbortError" : !1;
 }
-class ut extends u {
+class $t extends u {
   name = "ConfigValidationError";
   issues;
   constructor(t) {
-    const e = ft(t);
+    const e = Tt(t);
     super(
       "CONFIG_INVALID",
       `Invalid Plugin config:
@@ -112,7 +139,7 @@ ${e.map((i) => `  - ${i.message}`).join(`
     ), this.issues = e;
   }
 }
-function ft(r) {
+function Tt(r) {
   if (!Array.isArray(r))
     throw new TypeError("Config validation issues must be an array");
   return Object.freeze(
@@ -124,23 +151,23 @@ function ft(r) {
         throw new TypeError(`Config validation issue at index ${e} message must be a string`);
       return Object.freeze({
         message: i.message,
-        ...i.path === void 0 ? {} : { path: pt(i.path, e) }
+        ...i.path === void 0 ? {} : { path: Pt(i.path, e) }
       });
     })
   );
 }
-function pt(r, t) {
+function Pt(r, t) {
   if (!Array.isArray(r))
     throw new TypeError(`Config validation issue at index ${t} path must be an array`);
   return Object.freeze(
     Array.from(r, (e, i) => {
-      if (G(e)) return e;
+      if (nt(e)) return e;
       if (!e || typeof e != "object")
         throw new TypeError(
           `Config validation issue at index ${t} path segment ${i} must be a property key`
         );
       const s = e.key;
-      if (!G(s))
+      if (!nt(s))
         throw new TypeError(
           `Config validation issue at index ${t} path segment ${i} must contain a property key`
         );
@@ -148,10 +175,10 @@ function pt(r, t) {
     })
   );
 }
-function G(r) {
+function nt(r) {
   return typeof r == "string" || typeof r == "number" || typeof r == "symbol";
 }
-async function et(r, t, e) {
+async function Lt(r, t, e) {
   if (!r) return t;
   const i = await r["~standard"].validate(t);
   if (!i || typeof i != "object")
@@ -160,7 +187,7 @@ async function et(r, t, e) {
     );
   const s = Object.hasOwn(i, "issues") ? i.issues : void 0;
   if (s !== void 0)
-    throw Array.isArray(s) ? new ut(s) : new TypeError(
+    throw Array.isArray(s) ? new $t(s) : new TypeError(
       `Installation '${e}' config validator returned non-array issues`
     );
   if (!Object.hasOwn(i, "value"))
@@ -169,29 +196,29 @@ async function et(r, t, e) {
     );
   return i.value;
 }
-class gt {
+class zt {
   #t = /* @__PURE__ */ new Map();
   get kinds() {
     return this.#t;
   }
   assertCompatible(t) {
-    it(this.#t, t);
+    bt(this.#t, t);
   }
   remember(t) {
-    j(this.#t, t);
+    q(this.#t, t);
   }
-  draft(t) {
-    return new wt(this, t);
+  writer(t) {
+    return new Rt(this, t);
   }
   commit(t) {
     for (const [e, i] of t) this.assertCompatible({ id: e, kind: i });
     for (const [e, i] of t) this.#t.set(e, i);
   }
 }
-class wt {
+class Rt {
   #t;
   constructor(t, e) {
-    this.#t = { phase: "open", registry: t, pending: /* @__PURE__ */ new Map() };
+    this.#t = { phase: "staged", registry: t, pending: /* @__PURE__ */ new Map() };
     for (const [i, s] of e) this.remember({ id: i, kind: s });
   }
   remember(t) {
@@ -201,21 +228,21 @@ class wt {
       return;
     }
     if (e.phase === "discarded")
-      throw new Error("Contract registry draft has been discarded");
-    e.registry.assertCompatible(t), !e.registry.kinds.has(t.id) && j(e.pending, t);
+      throw new Error("Contract registry writer has been discarded");
+    e.registry.assertCompatible(t), !e.registry.kinds.has(t.id) && q(e.pending, t);
   }
   commit() {
     const t = this.#t;
-    t.phase === "open" && (t.registry.commit(t.pending), this.#t = { phase: "committed", registry: t.registry });
+    t.phase === "staged" && (t.registry.commit(t.pending), this.#t = { phase: "committed", registry: t.registry });
   }
   discard() {
-    this.#t.phase === "open" && (this.#t = { phase: "discarded" });
+    this.#t.phase === "staged" && (this.#t = { phase: "discarded" });
   }
 }
-function j(r, t) {
-  it(r, t), r.set(t.id, t.kind);
+function q(r, t) {
+  bt(r, t), r.set(t.id, t.kind);
 }
-function it(r, t) {
+function bt(r, t) {
   const e = r.get(t.id);
   if (e && e !== t.kind)
     throw new u(
@@ -223,9 +250,9 @@ function it(r, t) {
       `Contract '${t.id}' is used as both '${e}' and '${t.kind}'`
     );
 }
-class M {
-  constructor(t, e, i, s, n, o) {
-    this.order = t, this.layers = e, this.providers = i, this.dependents = s, this.contractKinds = n, this.#t = o;
+class X {
+  constructor(t, e, i, s, n, o, a) {
+    this.order = e, this.layers = i, this.providers = s, this.dependents = n, this.contractKinds = o, this.#t = t, this.#e = a;
   }
   order;
   layers;
@@ -233,13 +260,15 @@ class M {
   dependents;
   contractKinds;
   #t;
+  #e;
   static build(t, e) {
-    const i = [...t].sort((c, d) => c.index - d.index), s = new Map(e), n = vt(i, s), o = bt(i, n, s), { order: a, layers: h } = mt(
+    const i = [...t].sort((c, d) => c.index - d.index), s = new Map(e), n = Nt(i, s), o = xt(i, n, s), { order: a, layers: h } = Mt(
       i,
       o.dependents,
       o.indegree
     );
-    return new M(
+    return new X(
+      new Map(i.map((c) => [c, c.declaration])),
       Object.freeze(a),
       Object.freeze(h.map((c) => Object.freeze(c))),
       n,
@@ -248,17 +277,28 @@ class M {
       o.resolvedProviders
     );
   }
+  declarationFor(t) {
+    const e = this.#t.get(t);
+    if (!e) throw new Error(`Installation '${t.id}' is not in this plan`);
+    return e;
+  }
   providerFor(t, e) {
-    return this.#t.get(t)?.get(e);
+    return this.#e.get(t)?.get(e);
   }
   provider(t) {
     return this.providers.get(t);
   }
+  /**
+   * Transitive dependents in *both* plans. A Service being replaced has old
+   * consumers that must stop and new ones that must start, and only the union
+   * covers both — expanding in the current plan alone would leave an Instance
+   * running against a dependency that no longer exists.
+   */
   affectedByTransitionTo(t, e) {
     const i = /* @__PURE__ */ new Set();
-    return this.#e(e, i), t.#e(e, i), i;
+    return this.#i(e, i), t.#i(e, i), i;
   }
-  #e(t, e) {
+  #i(t, e) {
     const i = [...t], s = /* @__PURE__ */ new Set();
     for (let n = 0; n < i.length; n++) {
       const o = i[n];
@@ -269,11 +309,11 @@ class M {
     }
   }
 }
-function vt(r, t) {
+function Nt(r, t) {
   const e = /* @__PURE__ */ new Map();
   for (const i of r)
-    for (const s of Object.values(i.declaration.plugin.provides ?? {})) {
-      j(t, s);
+    for (const s of Object.values(i.declaration.plugin.provides)) {
+      q(t, s);
       const n = e.get(s.id);
       if (n)
         throw new u(
@@ -284,12 +324,12 @@ function vt(r, t) {
     }
   return e;
 }
-function bt(r, t, e) {
+function xt(r, t, e) {
   const i = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), n = new Map(r.map((o) => [o, 0]));
   for (const o of r)
-    for (const a of Object.values(o.declaration.plugin.requires ?? {})) {
+    for (const a of Object.values(o.declaration.plugin.requires)) {
       const h = a.kind === "optional" ? a.service : a;
-      if (j(e, h), h.kind === "extensionPoint") continue;
+      if (q(e, h), h.kind === "extensionPoint") continue;
       const c = t.get(h.id);
       if (!c) {
         if (a.kind === "optional") continue;
@@ -310,7 +350,7 @@ function bt(r, t, e) {
     }
   return { resolvedProviders: i, dependents: s, indegree: n };
 }
-function mt(r, t, e) {
+function Mt(r, t, e) {
   let i = r.filter((o) => e.get(o) === 0);
   const s = [], n = [];
   for (; i.length; ) {
@@ -324,7 +364,7 @@ function mt(r, t, e) {
       }
   }
   if (s.length !== r.length) {
-    const o = yt(r, t);
+    const o = Dt(r, t);
     throw new u(
       "SERVICE_CYCLE",
       `Installation dependency cycle: ${o.map((a) => a.id).join(" -> ")}`
@@ -332,7 +372,7 @@ function mt(r, t, e) {
   }
   return { order: s, layers: n };
 }
-function yt(r, t) {
+function Dt(r, t) {
   const e = /* @__PURE__ */ new Set(), i = /* @__PURE__ */ new Set(), s = [], n = (o) => {
     i.add(o), s.push(o);
     for (const a of t.get(o) ?? []) {
@@ -353,7 +393,7 @@ function yt(r, t) {
   }
   throw new Error("Dependency graph is cyclic but no cycle path was found");
 }
-class O {
+class z {
   #t;
   constructor(t = []) {
     if (!t || typeof t != "object" && typeof t != "function" || typeof t[Symbol.iterator] != "function")
@@ -385,31 +425,65 @@ class O {
     return this.entries();
   }
 }
-function Et(r) {
+function Vt(r) {
   if (typeof r != "function")
     throw new Error("Unsupported JavaScript runtime: Promise.withResolvers is required");
 }
-function st(r, t) {
+function mt(r, t) {
   return r ?? Symbol.for(t);
 }
-Et(Promise.withResolvers);
-const g = st(
+Vt(Promise.withResolvers);
+const v = mt(
   Symbol.dispose,
   "Symbol.dispose"
-), k = st(
+), F = mt(
   Symbol.asyncDispose,
   "Symbol.asyncDispose"
 );
-function P(r, t) {
-  if (Ct(r))
+function R(r, t) {
+  if (qt(r))
     throw Promise.resolve(r).catch(() => {
     }), new TypeError(t);
 }
-function Ct(r) {
+function qt(r) {
   return r === null || typeof r != "object" && typeof r != "function" ? !1 : typeof r.then == "function";
 }
-const y = /* @__PURE__ */ new WeakMap();
-class q {
+const N = /* @__PURE__ */ new WeakMap(), C = /* @__PURE__ */ new Set();
+let T = 0, U = !1;
+function Ft(r) {
+  T++;
+  const t = [];
+  try {
+    r();
+  } catch (e) {
+    t.push(e);
+  } finally {
+    if (T--, !T)
+      try {
+        vt();
+      } catch (e) {
+        t.push(e);
+      }
+  }
+  if (t.length === 1) throw t[0];
+  if (t.length > 1) throw new AggregateError(t, "Snapshot batch failed");
+}
+function vt() {
+  if (U) return;
+  U = !0;
+  const r = [];
+  try {
+    for (; C.size; ) {
+      const t = C.values().next().value;
+      C.delete(t), Gt(t, r);
+    }
+  } finally {
+    U = !1, C.clear();
+  }
+  if (r.length)
+    throw new AggregateError(r, "Snapshot error reporting failed");
+}
+class Z {
   #t = /* @__PURE__ */ new Set();
   #e;
   #i;
@@ -425,24 +499,9 @@ class q {
     subscribe: (t) => this.#a(t)
   });
   invalidate() {
-    const { report: t } = this.#o();
-    this.#s = !0;
-    const e = [];
-    for (const i of [...this.#t])
-      try {
-        Ot(i);
-      } catch (s) {
-        try {
-          P(
-            t(s),
-            "Snapshot error reporters must be synchronous"
-          );
-        } catch (n) {
-          e.push(s, n);
-        }
-      }
-    if (e.length)
-      throw new AggregateError(e, "Snapshot error reporting failed");
+    this.#o(), this.#s = !0;
+    for (const t of this.#t) C.add(t);
+    T || vt();
   }
   dispose() {
     const t = this.#e;
@@ -454,11 +513,11 @@ class q {
         this.#s = !1;
         const e = [...this.#t];
         this.#t.clear();
-        for (const i of e) It(i);
+        for (const i of e) yt(i);
       }
     }
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
   #n() {
@@ -467,11 +526,10 @@ class q {
   }
   #a(t) {
     if (typeof t != "function") throw new TypeError("Subscriber must be a function");
-    this.#o();
-    const e = new St(t, (i) => {
-      this.#t.delete(i);
+    const { report: e } = this.#o(), i = new Bt(t, e, (s) => {
+      this.#t.delete(s);
     });
-    return this.#t.add(e), e;
+    return this.#t.add(i), i;
   }
   #r(t) {
     this.#s && (this.#i = t(), this.#s = !1);
@@ -482,26 +540,38 @@ class q {
     return t;
   }
 }
-class St {
-  constructor(t, e) {
-    y.set(this, { listener: t, detach: e }), Object.freeze(this);
+class Bt {
+  constructor(t, e, i) {
+    N.set(this, { listener: t, report: e, detach: i }), Object.freeze(this);
   }
   dispose() {
-    const t = y.get(this);
-    t && (y.delete(this), t.detach(this));
+    const t = N.get(this);
+    t && (yt(this), t.detach(this));
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
 }
-function Ot(r) {
-  const t = y.get(r);
-  t && P(t.listener(), "Snapshot subscribers must be synchronous");
+function Gt(r, t) {
+  const e = N.get(r);
+  if (e)
+    try {
+      R(e.listener(), "Snapshot subscribers must be synchronous");
+    } catch (i) {
+      try {
+        R(
+          e.report(i),
+          "Snapshot error reporters must be synchronous"
+        );
+      } catch (s) {
+        t.push(i, s);
+      }
+    }
 }
-function It(r) {
-  y.delete(r);
+function yt(r) {
+  C.delete(r), N.delete(r);
 }
-class At {
+class Ut {
   #t;
   get;
   subscribe;
@@ -523,7 +593,7 @@ class At {
     return t;
   }
 }
-class Tt {
+class _t {
   #t;
   constructor(t) {
     this.#t = t, Object.freeze(this);
@@ -534,16 +604,16 @@ class Tt {
   dispose() {
     this.#t.dispose();
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
 }
-class $t {
+class Ht {
   #t;
   #e;
   handle;
   constructor(t, e, i, s) {
-    this.#e = e, this.#t = { phase: "staged", store: t, value: i, detachFromOwner: s }, this.handle = new Tt(this);
+    this.#e = e, this.#t = { phase: "staged", store: t, value: i, detachFromOwner: s }, this.handle = new _t(this);
   }
   publish() {
     const t = this.#t;
@@ -572,55 +642,62 @@ class $t {
       }
     }
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
 }
-class jt {
+class Kt {
   #t;
   #e;
   #i = /* @__PURE__ */ new Map();
   #s = /* @__PURE__ */ new Map();
   #n;
-  #a = new O();
+  #a = new z();
   #r = 0;
   #o = 0;
-  #d = !1;
-  #f = !1;
+  #h = !1;
+  #p = !1;
   constructor(t, e, i) {
-    this.#t = t, this.#e = i, this.#n = new q(() => this.#a, e);
+    this.#t = t, this.#e = i, this.#n = new Z(() => this.#a, e);
   }
   stage(t, e, i, s) {
-    zt(e);
-    const n = Rt(t, e);
+    Jt(e);
+    const n = Xt(t, e);
     if (this.#i.has(n))
       throw new TypeError(`Duplicate contribution '${n}'`);
-    const o = new $t(this, n, i, s);
+    const o = new Ht(this, n, i, s);
     return this.#i.set(n, o), o;
   }
   view(t) {
     this.#r++;
     const e = { binding: { store: this, own: t } };
     let i;
-    const s = new kt(e, () => {
+    const s = new Wt(e, () => {
       const n = i;
       i = void 0;
       try {
         n?.();
       } finally {
-        this.#r--, this.#h();
+        this.#r--, this.#c();
       }
     });
     try {
       i = t(s, "view");
     } catch (n) {
-      throw e.binding = void 0, this.#r--, this.#h(), n;
+      throw e.binding = void 0, this.#r--, this.#c(), n;
     }
-    return new At(e);
-  }
-  /** A stable view explicitly owned by the Host for graph-external consumers. */
+    return new Ut(e);
+  }
+  /**
+   * A stable view explicitly owned by the Host for graph-external consumers.
+   *
+   * Application code has no Lifetime to lease a view from, so this one is
+   * retained by the Host instead — which also pins the store open for as long as
+   * the Host lives. That is the trade: `host.contributions()` gives a handle that
+   * never goes stale, at the cost of a store that is no longer self-releasing.
+   */
   hostView() {
-    return this.#d = !0, this.#n.view;
+    return this.#h = !0, this.#n.view;
   }
   snapshot() {
     return this.#n.view.get();
@@ -631,13 +708,13 @@ class jt {
     const i = this.#n.view.subscribe(t);
     this.#o++;
     let s;
-    const n = new Pt(i, () => {
+    const n = new Yt(i, () => {
       const o = s;
       s = void 0;
       try {
         o?.();
       } finally {
-        this.#o--, this.#h();
+        this.#o--, this.#c();
       }
     });
     try {
@@ -648,39 +725,50 @@ class jt {
     return n;
   }
   insert(t, e, i) {
-    if (this.#l(t, e), this.#s.has(t))
+    if (this.#u(t, e), this.#s.has(t))
       throw new Error(`Contribution '${t}' is already published`);
     e.commitPublication(), this.#s.set(t, { contribution: e, value: i }), this.#t(this);
   }
   update(t, e, i) {
-    const s = this.#u(t, e);
+    const s = this.#f(t, e);
     s.value = i, this.#t(this);
   }
   removeContribution(t, e, i) {
-    this.#l(t, e), i === "published" && this.#u(t, e);
+    this.#u(t, e), i === "published" && this.#f(t, e);
     try {
       this.#i.delete(t), i === "published" && (this.#s.delete(t), this.#t(this));
     } finally {
-      this.#h();
+      this.#c();
     }
   }
+  /**
+   * Rebuilds the published snapshot, and does nothing when the result would be
+   * equal by identity per key. A change that adds and removes the same entry —
+   * an Instance restarting with an identical contribution — therefore notifies
+   * nobody, instead of waking every observer to hand them what they already had.
+   */
   publishSnapshot() {
     const t = [...this.#s].map(([i, s]) => [i, s.value]);
-    t.length === this.#a.size && t.every(([i, s]) => Object.is(this.#a.get(i), s)) || (this.#a = new O(t), this.#n.invalidate());
+    t.length === this.#a.size && t.every(
+      ([i, s]) => this.#a.has(i) && Object.is(this.#a.get(i), s)
+    ) || (this.#a = new z(t), this.#n.invalidate());
   }
-  #l(t, e) {
+  #u(t, e) {
     if (this.#i.get(t) !== e)
       throw new Error(`Contribution '${t}' is not the current claim`);
   }
-  #u(t, e) {
+  #f(t, e) {
     const i = this.#s.get(t);
     if (i?.contribution !== e)
       throw new Error(`Contribution '${t}' is not the published entry`);
     return i;
   }
-  #h() {
-    if (!(this.#f || this.#d || this.#i.size || this.#s.size || this.#o || this.#r)) {
-      this.#f = !0;
+  // The self-release check. Every counter has to be at zero and the Host must
+  // not be holding a view; `#released` makes it run once, since disposing the
+  // publisher can re-enter through a subscription's own teardown.
+  #c() {
+    if (!(this.#p || this.#h || this.#i.size || this.#s.size || this.#o || this.#r)) {
+      this.#p = !0;
       try {
         this.#n.dispose();
       } finally {
@@ -689,7 +777,7 @@ class jt {
     }
   }
 }
-class kt {
+class Wt {
   #t;
   constructor(t, e) {
     this.#t = { state: t, release: e }, Object.freeze(this);
@@ -698,11 +786,11 @@ class kt {
     const t = this.#t;
     t && (this.#t = void 0, t.state.binding = void 0, t.release());
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
 }
-class Pt {
+class Yt {
   #t;
   constructor(t, e) {
     this.#t = { subscription: t, release: e }, Object.freeze(this);
@@ -718,11 +806,11 @@ class Pt {
       }
     }
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
 }
-class Lt {
+class Qt {
   #t = /* @__PURE__ */ new Map();
   #e = /* @__PURE__ */ new Set();
   #i;
@@ -733,7 +821,7 @@ class Lt {
   get(t) {
     const e = this.#t.get(t.id);
     if (e) return e;
-    const i = new jt(
+    const i = new Kt(
       (s) => this.#n(s),
       this.#i,
       (s) => {
@@ -748,39 +836,44 @@ class Lt {
   beginBatch() {
     this.#s++;
   }
+  // Depth-counted, so nested Host operations collapse into the outermost batch
+  // and publication happens exactly once. Every store's snapshot is attempted
+  // even if one of them throws, then the failures are aggregated — a single bad
+  // subscriber must not leave the remaining stores unpublished.
   endBatch() {
     if (!this.#s) throw new Error("Contribution batch is not active");
     if (this.#s--, this.#s) return;
     const t = [...this.#e];
-    this.#e.clear();
-    const e = [];
-    for (const i of t)
-      try {
-        i.publishSnapshot();
-      } catch (s) {
-        e.push(s);
-      }
-    if (e.length === 1) throw e[0];
-    if (e.length > 1)
-      throw new AggregateError(e, "Contribution batch publication failed");
+    this.#e.clear(), Ft(() => {
+      const e = [];
+      for (const i of t)
+        try {
+          i.publishSnapshot();
+        } catch (s) {
+          e.push(s);
+        }
+      if (e.length === 1) throw e[0];
+      if (e.length > 1)
+        throw new AggregateError(e, "Contribution batch publication failed");
+    });
   }
   #n(t) {
     this.#e.add(t), !this.#s && (this.#e.delete(t), t.publishSnapshot());
   }
 }
-function zt(r) {
+function Jt(r) {
   if (typeof r != "string" || !r.trim())
     throw new TypeError("Contribution key must be a non-empty string");
   if (r !== r.trim())
     throw new TypeError("Contribution key cannot start or end with whitespace");
 }
-function Rt(r, t) {
-  return `${U(r)}/${U(t)}`;
+function Xt(r, t) {
+  return `${ot(r)}/${ot(t)}`;
 }
-function U(r) {
+function ot(r) {
   return r.replaceAll("%", "%25").replaceAll("/", "%2F");
 }
-class Nt {
+class Zt {
   #t;
   constructor(t) {
     this.#t = t, Object.freeze(this);
@@ -789,16 +882,16 @@ class Nt {
     const t = this.#t;
     this.#t = void 0, t?.dispose();
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
 }
-class xt {
+class te {
   #t;
   #e;
   handle;
   constructor(t, e, i, s) {
-    this.#e = e, this.#t = { phase: "staged", hub: t, slot: { listener: i }, release: s }, this.handle = new Nt(this);
+    this.#e = e, this.#t = { phase: "staged", hub: t, slot: { listener: i }, release: s }, this.handle = new Zt(this);
   }
   publish() {
     const t = this.#t;
@@ -807,7 +900,7 @@ class xt {
   dispose() {
     const t = this.#t;
     if (t.phase !== "removed") {
-      this.#t = { phase: "removed" };
+      this.#t = { phase: "removed" }, t.slot.listener = void 0;
       try {
         t.phase === "published" && t.hub.delete(this.#e, t.slot);
       } finally {
@@ -815,15 +908,15 @@ class xt {
       }
     }
   }
-  [g]() {
+  [v]() {
     this.dispose();
   }
 }
-class Dt {
+class ee {
   #t = /* @__PURE__ */ new Map();
   stage(t, e, i) {
     if (typeof e != "function") throw new TypeError("Event listener must be a function");
-    return new xt(this, t, e, i);
+    return new te(this, t, e, i);
   }
   add(t, e) {
     const i = this.#t.get(t) ?? /* @__PURE__ */ new Set();
@@ -833,25 +926,34 @@ class Dt {
     const i = this.#t.get(t);
     i && (i.delete(e), i.size || this.#t.delete(t));
   }
+  /**
+   * Every still-subscribed listener runs, then failures are aggregated. Three details, all
+   * deliberate:
+   *
+   * - the listener set is copied first; a new subscription does not join this
+   *   emission. A disposed slot is skipped if its callback has not started;
+   * - each call is wrapped in a resolved promise, so a listener that throws
+   *   synchronously is collected like one that rejects;
+   * - `allSettled`, so one broken listener cannot stop the others from being
+   *   told. The emitter still learns about it — every error comes back.
+   */
   async emit(t, e) {
-    const i = [...this.#t.get(t) ?? []].map(
-      (o) => o.listener
-    ), n = (await Promise.allSettled(
-      i.map((o) => Promise.resolve().then(() => o(e)))
+    const i = [...this.#t.get(t) ?? []], n = (await Promise.allSettled(
+      i.map((o) => Promise.resolve().then(() => o.listener?.(e)))
     )).filter((o) => o.status === "rejected").map((o) => o.reason);
     if (n.length)
       throw new AggregateError(n, `Event '${t}' listeners failed`);
   }
 }
-class Vt {
+class ie {
   #t;
   root;
   view;
   constructor(t, e) {
-    this.root = _(t), this.#t = new q(() => rt(this.root), e), this.view = this.#t.view;
+    this.root = at(t), this.#t = new Z(() => Et(this.root), e), this.view = this.#t.view;
   }
   createNode(t) {
-    return _(t);
+    return at(t);
   }
   attach(t, e) {
     if (t.children.has(e)) throw new Error("Lifetime diagnostic node is attached");
@@ -872,7 +974,7 @@ class Vt {
     this.root.phase !== "disposed" && (this.root.phase = "disposed", this.#t.invalidate(), this.#t.dispose());
   }
 }
-function _(r) {
+function at(r) {
   return {
     label: r,
     phase: "active",
@@ -887,8 +989,8 @@ function _(r) {
     children: /* @__PURE__ */ new Set()
   };
 }
-function rt(r) {
-  const t = Object.freeze([...r.children].map(rt));
+function Et(r) {
+  const t = Object.freeze([...r.children].map(Et));
   return Object.freeze({
     label: r.label,
     phase: r.phase,
@@ -896,7 +998,7 @@ function rt(r) {
     children: t
   });
 }
-function Mt(r) {
+function se(r) {
   if (!r || typeof r != "object" && typeof r != "function") return !1;
   try {
     const t = r;
@@ -907,8 +1009,8 @@ function Mt(r) {
     return !1;
   }
 }
-const x = Object.freeze(new DOMException("Resource disposed", "AbortError"));
-class w {
+const W = Object.freeze(new DOMException("Resource disposed", "AbortError"));
+class y {
   #t = /* @__PURE__ */ new Set();
   #e;
   constructor(t) {
@@ -928,6 +1030,12 @@ class w {
     const e = this.#e;
     return e && e.diagnostics.change(e.node, e.kind, -1), !0;
   };
+  /**
+   * Disposes in reverse creation order, collecting failures rather than
+   * throwing. Later resources may depend on earlier ones, and a resource that
+   * refuses to shut down cleanly must not strand its siblings. The caller
+   * aggregates the collected errors.
+   */
   async dispose(t) {
     try {
       for (const e of [...this.#t].reverse())
@@ -942,11 +1050,26 @@ class w {
       this.#e = void 0;
     }
   }
+  /** Capability withdrawal must finish without yielding to callbacks or tasks. */
+  disposeSynchronously(t) {
+    try {
+      for (const e of [...this.#t].reverse())
+        try {
+          e.dispose();
+        } catch (i) {
+          t.push(i);
+        } finally {
+          this.release(e);
+        }
+    } finally {
+      this.#e = void 0;
+    }
+  }
   [Symbol.iterator]() {
     return this.#t[Symbol.iterator]();
   }
 }
-class qt {
+class re {
   #t;
   constructor(t, e) {
     this.#t = { phase: "active", cleanup: t, detachFromParent: e }, Object.freeze(this);
@@ -966,11 +1089,11 @@ class qt {
     });
     return this.#t = { phase: "disposing", completion: e }, e;
   }
-  [k]() {
+  [F]() {
     return this.dispose();
   }
 }
-class Bt {
+class ne {
   #t;
   #e;
   #i;
@@ -983,7 +1106,7 @@ class Bt {
       () => this.#s(),
       (a) => {
         try {
-          tt(n.signal, a) || i(a);
+          wt(n.signal, a) || i(a);
         } finally {
           this.#s();
         }
@@ -1001,9 +1124,9 @@ class Bt {
       () => {
       }
     );
-    return this.#i = { phase: "disposing", completion: e }, t.controller.abort(x), this.#n(), e;
+    return this.#i = { phase: "disposing", completion: e }, t.controller.abort(W), this.#n(), e;
   }
-  [k]() {
+  [F]() {
     return this.dispose();
   }
   #s() {
@@ -1017,7 +1140,7 @@ class Bt {
     this.#t = void 0, t?.();
   }
 }
-class B {
+class tt {
   #t;
   #e;
   #i;
@@ -1026,45 +1149,45 @@ class B {
   #a;
   #r;
   #o;
-  #d;
-  #f;
-  #l;
+  #h;
+  #p;
   #u;
+  #f;
   handle;
-  #h;
+  #c;
   constructor(t, e, i = {}) {
-    this.#e = e, this.handle = new Ft(this);
+    this.#e = e, this.handle = new oe(this);
     const s = new AbortController();
-    this.#h = {
+    this.#c = {
       phase: "active",
       controller: s,
       declarations: i.declarations ?? "staged"
     };
     const n = i.parent;
-    this.#u = n?.detach, this.#f = n ? "child" : "root";
-    const o = n?.diagnostics ?? new Vt(e, (l) => t.report(l)), a = n?.diagnosticNode ?? o.root;
+    this.#f = n?.detach, this.#p = n ? "child" : "root";
+    const o = n?.diagnostics ?? new ie(e, (l) => t.report(l)), a = n?.diagnosticNode ?? o.root;
     this.#t = { port: t, diagnostics: o, diagnosticNode: a };
     const h = (l) => ({
       diagnostics: o,
       node: a,
       kind: l
     });
-    this.#i = new w(h("listeners")), this.#s = new w(h("contributions")), this.#n = new w(h("contributionViews")), this.#a = new w(h("subscriptions")), this.#r = new w(h("tasks")), this.#o = new w(), this.#d = new w(h("cleanups"));
+    this.#i = new y(h("listeners")), this.#s = new y(h("contributions")), this.#n = new y(h("contributionViews")), this.#a = new y(h("subscriptions")), this.#r = new y(h("tasks")), this.#o = new y(), this.#h = new y(h("cleanups"));
     const c = i.parentSignal;
     if (!c) return;
     const d = () => s.abort(c.reason);
-    c.addEventListener("abort", d, { once: !0 }), this.#l = () => c.removeEventListener("abort", d), c.aborted && d();
+    c.addEventListener("abort", d, { once: !0 }), this.#u = () => c.removeEventListener("abort", d), c.aborted && d();
   }
   get signal() {
-    const t = this.#h;
+    const t = this.#c;
     return t.phase === "disposed" ? t.signal : t.controller.signal;
   }
   get diagnostics() {
-    return this.#c().diagnostics.view;
+    return this.#g().diagnostics.view;
   }
   /** A facade whose only InstanceCoordinator edge disappears when this Lifetime terminates. */
   contextLogger(t) {
-    const e = (i) => (s, ...n) => this.#p().port.writeLog(i, s, t, n);
+    const e = (i) => (s, ...n) => this.#g().port.writeLog(i, s, t, n);
     return Object.freeze({
       debug: e("debug"),
       info: e("info"),
@@ -1073,16 +1196,25 @@ class B {
     });
   }
   cleanup(t) {
-    if (this.#c(), typeof t != "function") throw new TypeError("Cleanup must be a function");
-    const e = new qt(t, this.#d.release);
-    return this.#d.add(e), e;
-  }
+    if (this.#d(), typeof t != "function") throw new TypeError("Cleanup must be a function");
+    const e = new re(t, this.#h.release);
+    return this.#h.add(e), e;
+  }
+  /**
+   * A child scope. It inherits this Lifetime's signal, so cancellation flows
+   * down, and its declaration phase, so a child created during `setup()` also
+   * stages rather than publishing immediately.
+   *
+   * Disposing a child detaches it from both the resource set and the diagnostics
+   * tree. A Plugin can therefore use child lifetimes as a unit of work — one per
+   * open document, per connection — without the parent growing.
+   */
   lifetime(t) {
-    const { port: e, diagnostics: i, diagnosticNode: s } = this.#c();
-    Gt(t);
-    const n = i.createNode(t), o = new B(e, this.#e, {
+    const { port: e, diagnostics: i, diagnosticNode: s } = this.#d();
+    ae(t);
+    const n = i.createNode(t), o = new tt(e, this.#e, {
       parentSignal: this.signal,
-      declarations: this.#g(),
+      declarations: this.#w(),
       parent: {
         diagnostics: i,
         diagnosticNode: n,
@@ -1094,9 +1226,9 @@ class B {
     return this.#o.add(o), i.attach(s, n), o.handle;
   }
   spawn(t) {
-    const { port: e } = this.#c();
+    const { port: e } = this.#d();
     if (typeof t != "function") throw new TypeError("Background task must be a function");
-    const i = new Bt(
+    const i = new ne(
       this.signal,
       t,
       (s) => e.report(s),
@@ -1105,89 +1237,137 @@ class B {
     return this.#r.add(i), i;
   }
   on(t, e) {
-    const { port: i } = this.#c(), s = i.stageOn(
+    const { port: i } = this.#d(), s = i.stageOn(
       this.#e,
       t,
       e,
       this.#i.release
     );
-    return this.#i.add(s), this.#g() === "published" && s.publish(), s.handle;
+    return this.#i.add(s), this.#w() === "published" && s.publish(), s.handle;
   }
   async emit(t, ...e) {
-    const { port: i } = this.#c();
+    const { port: i } = this.#d();
     await i.emit(this.#e, t, e[0]);
   }
   contribute(t, e, i) {
-    const { port: s } = this.#c(), n = s.stageContribution(
+    const { port: s } = this.#d(), n = s.stageContribution(
       this.#e,
       t,
       e,
       i,
       this.#s.release
     );
-    return this.#s.add(n), this.#g() === "published" && n.publish(), n.handle;
+    return this.#s.add(n), this.#w() === "published" && n.publish(), n.handle;
   }
   /** Owns an internal live capability without exposing a second Context API. */
   ownLease(t, e) {
-    return this.#c(), (e === "view" ? this.#n : this.#a).own(t);
+    return this.#d(), (e === "view" ? this.#n : this.#a).own(t);
   }
   /** Releases a temporary startup cancellation edge after its layer commits. */
   detachStartupSignal() {
-    const t = this.#l;
-    this.#l = void 0, t?.();
-  }
-  /** Atomically makes all declarations staged during setup visible. */
+    const t = this.#u;
+    this.#u = void 0, t?.();
+  }
+  /**
+   * Atomically makes all declarations staged during setup visible.
+   *
+   * Children publish too, recursively, so a Lifetime created inside `setup()`
+   * becomes visible with its parent rather than being stranded staged. Called by
+   * the InstanceCoordinator once the whole activation layer has succeeded —
+   * which is what makes "no half-built Instance is observable" true.
+   */
   publish() {
-    const t = this.#h;
-    if (t.phase !== "active") throw E();
-    if (this.#c(), t.declarations !== "published") {
+    const t = this.#c;
+    if (t.phase !== "active") throw $();
+    if (this.#d(), t.declarations !== "published") {
       for (const e of this.#i) e.publish();
       for (const e of this.#s) e.publish();
       for (const e of this.#o) e.publish();
-      this.#h = { ...t, declarations: "published" };
+      this.#c = { ...t, declarations: "published" };
     }
   }
+  /**
+   * Disposal is idempotent and joinable: concurrent callers share one completion
+   * promise, so a Lifetime disposed by both its owner and a `using` block runs
+   * its teardown once.
+   *
+   * The three-stage order is the module header's; see it for why. Errors from
+   * every stage accumulate and are aggregated at the end, so one failing cleanup
+   * neither hides the others nor prevents them from running.
+   */
   dispose() {
-    const t = this.#h;
+    const t = this.#c;
     if (t.phase === "disposing") return t.completion;
     if (t.phase === "disposed") return Promise.resolve();
-    const e = this.#p(), i = Promise.resolve().then(async () => {
-      const s = [];
-      if (await this.#i.dispose(s), await this.#s.dispose(s), await this.#a.dispose(s), await this.#n.dispose(s), t.controller.abort(x), this.detachStartupSignal(), await this.#r.dispose(s), await this.#o.dispose(s), await this.#d.dispose(s), s.length === 1) throw s[0];
-      if (s.length > 1) throw new AggregateError(s, "Lifetime cleanup failed");
-    }).finally(() => {
-      this.#h = { phase: "disposed", signal: AbortSignal.abort(x) };
-      const s = this.#u;
-      this.#u = void 0;
-      try {
-        s?.(this), this.#f === "root" && e.diagnostics.finishRoot();
-      } finally {
-        this.#t = void 0;
-      }
-    });
-    return this.#h = { phase: "disposing", controller: t.controller, completion: i }, e.diagnostics.beginDisposing(e.diagnosticNode), i;
+    const e = [], i = this.#l(e);
+    for (const { lifetime: s, errors: n } of e)
+      s.#i.disposeSynchronously(n), s.#a.disposeSynchronously(n), s.#n.disposeSynchronously(n);
+    for (const { lifetime: s, errors: n } of e)
+      s.#s.disposeSynchronously(n);
+    for (const { lifetime: s, binding: n, controller: o } of e)
+      n.diagnostics.beginDisposing(n.diagnosticNode), o.abort(W), s.detachStartupSignal();
+    for (const s of e) s.finish();
+    return i;
   }
-  [k]() {
+  /** Stages joinable completions without running any externally observable work. */
+  #l(t) {
+    const e = this.#c;
+    if (e.phase === "disposing") return e.completion;
+    if (e.phase === "disposed") return Promise.resolve();
+    const i = this.#g(), s = Promise.withResolvers(), n = [];
+    this.#c = {
+      phase: "disposing",
+      controller: e.controller,
+      completion: s.promise
+    };
+    const o = Promise.allSettled(
+      [...this.#o].reverse().map((h) => h.#l(t))
+    ), a = () => {
+      (async () => {
+        try {
+          await this.#r.dispose(n);
+          for (const h of await o)
+            h.status === "rejected" && n.push(h.reason);
+          if (await this.#h.dispose(n), n.length === 1) throw n[0];
+          if (n.length > 1) throw new AggregateError(n, "Lifetime cleanup failed");
+        } finally {
+          this.#c = { phase: "disposed", signal: AbortSignal.abort(W) };
+          const h = this.#f;
+          this.#f = void 0;
+          try {
+            h?.(this), this.#p === "root" && i.diagnostics.finishRoot();
+          } finally {
+            this.#t = void 0;
+          }
+        }
+      })().then(s.resolve, s.reject);
+    };
+    return t.push({ lifetime: this, errors: n, binding: i, controller: e.controller, finish: a }), s.promise;
+  }
+  [F]() {
     return this.dispose();
   }
-  #c() {
+  // The gate on every operation that creates a resource. `signal.aborted` is
+  // checked as well as the phase, because a parent's disposal aborts this signal
+  // during startup cancellation as well as disposal. Both boundaries close work.
+  #d() {
     const t = this.#t;
-    if (this.#h.phase !== "active" || this.signal.aborted || !t)
-      throw E();
+    if (this.#c.phase !== "active" || this.signal.aborted || !t)
+      throw $();
     return t;
   }
-  #p() {
+  #g() {
     const t = this.#t;
-    if (!t) throw E();
+    if (!t) throw $();
     return t;
   }
-  #g() {
-    const t = this.#h;
-    if (t.phase !== "active") throw E();
+  #w() {
+    const t = this.#c;
+    if (t.phase !== "active") throw $();
     return t.declarations;
   }
 }
-class Ft {
+class oe {
   #t;
   constructor(t) {
     this.#t = t, Object.freeze(this);
@@ -1216,32 +1396,32 @@ class Ft {
   dispose() {
     return this.#t.dispose();
   }
-  [k]() {
+  [F]() {
     return this.dispose();
   }
 }
-function Gt(r) {
+function ae(r) {
   if (typeof r != "string" || !r.trim())
     throw new TypeError("Lifetime label must be a non-empty string");
   if (r !== r.trim())
     throw new TypeError("Lifetime label cannot start or end with whitespace");
 }
-function E() {
+function $() {
   return new u("LIFETIME_DISPOSED", "Lifetime is disposing or has been disposed");
 }
-class D extends AggregateError {
+class Y extends AggregateError {
 }
-class Ut {
+class ce {
   #t;
   #e;
   #i;
   #s;
   #n = /* @__PURE__ */ new Map();
-  #a = new Dt();
+  #a = new ee();
   #r;
   #o = [];
   constructor(t) {
-    this.#t = t.hostName, this.#e = t.logger, this.#i = t.isInstalled, this.#s = t.report, this.#r = new Lt(t.report);
+    this.#t = t.hostName, this.#e = t.logger, this.#i = t.isInstalled, this.#s = t.report, this.#r = new Qt(t.report);
   }
   readService(t, e) {
     const i = this.#n.get(t);
@@ -1268,7 +1448,7 @@ class Ut {
     return this.deactivate(new Set(this.#o));
   }
   async activate(t, e, i, s) {
-    const n = this.#c(s);
+    const n = this.#l(s);
     for (const o of t.layers) {
       const a = o.filter(
         (f) => e.has(f) && !f.instance
@@ -1277,35 +1457,39 @@ class Ut {
       const h = new AbortController(), c = await Promise.allSettled(
         a.map(async (f) => {
           try {
-            const p = i.has(f) ? i.get(f) : await et(
-              f.declaration.plugin.config,
-              f.declaration.config,
-              f.id
-            );
-            return await this.#d(
+            if (!i.has(f))
+              throw new Error(`Installation '${f.id}' has no prepared config`);
+            const g = i.get(f);
+            return await this.#h(
               t,
               f,
-              p,
+              g,
               h.signal,
               n
             );
-          } catch (p) {
-            throw h.abort(p), p;
+          } catch (g) {
+            throw h.abort(g), g;
           }
         })
-      ), d = _t(c, h.signal), l = c.filter(
+      ), d = he(c, h.signal), l = c.filter(
         (f) => f.status === "fulfilled"
       ).map((f) => f.value);
       if (d.length) {
-        const f = await this.#l(l), p = d.length === 1 ? d[0] : new AggregateError(d, "Installation startup layer failed");
-        throw f.length ? new D(
-          [p, ...f],
+        const f = await this.#u(l), g = d.length === 1 ? d[0] : new AggregateError(d, "Installation startup layer failed");
+        throw f.length ? new Y(
+          [g, ...f],
           "Installation startup layer failed and could not be cleanly disposed"
-        ) : p;
+        ) : g;
       }
-      this.#f(l);
+      this.#p(l);
     }
   }
+  /**
+   * Stops in reverse activation order, sequentially, and collects every failure
+   * instead of stopping at the first. A dependent must be gone before the
+   * Service it consumed, and one Instance that refuses to shut down cleanly must
+   * not leave the rest running — its error is returned, not thrown.
+   */
   async deactivate(t) {
     const e = [], i = this.#o.filter((s) => t.has(s)).reverse();
     this.#o = this.#o.filter(
@@ -1326,6 +1510,17 @@ class Ut {
     }
     return e;
   }
+  /**
+   * Runs one operation with contribution publication deferred to its end, so a
+   * change that withdraws and adds contributions is observed once rather than as
+   * an intermediate state.
+   *
+   * Publication happens even when the operation failed, because contributions
+   * withdrawn by Instances that did stop must not stay visible. If both the
+   * operation and the publication fail, both errors are reported — the
+   * publication failure must not hide the reason the change failed, and the
+   * operation failure must not hide a store left inconsistent.
+   */
   async withContributionBatch(t) {
     this.#r.beginBatch();
     let e;
@@ -1349,23 +1544,23 @@ class Ut {
     if (!i.ok) throw i.error;
     return e.value;
   }
-  async #d(t, e, i, s, n) {
+  async #h(t, e, i, s, n) {
     e.deactivate();
-    const o = e.declaration.plugin, a = new B(n, e.id, { parentSignal: s });
+    const o = t.declarationFor(e).plugin, a = new tt(n, e.id, { parentSignal: s });
     try {
-      const h = this.#u(t, e, o, a), c = Object.freeze({
+      const h = this.#f(t, e, o, a), c = Object.freeze({
         hostName: this.#t,
         pluginName: o.name,
         installationId: e.id,
         groupId: e.groupId
-      }), d = this.#h(a, c, h), l = await o.setup(d, i), f = /* @__PURE__ */ new Map();
-      for (const [p, ot] of Object.entries(o.provides ?? {})) {
-        if (typeof l != "object" || l === null || !Object.hasOwn(l, p))
+      }), d = this.#c(a, c, h), l = await o.setup(d, i), f = /* @__PURE__ */ new Map();
+      for (const [g, I] of Object.entries(o.provides)) {
+        if (typeof l != "object" || l === null || !Object.hasOwn(l, g))
           throw new u(
             "SERVICE_NOT_RETURNED",
-            `Installation '${e.id}' did not return provided Service '${p}'`
+            `Installation '${e.id}' did not return provided Service '${g}'`
           );
-        f.set(ot.id, l[p]);
+        f.set(I.id, l[g]);
       }
       return Object.freeze({
         installation: e,
@@ -1377,7 +1572,7 @@ class Ut {
       try {
         await a.dispose();
       } catch (d) {
-        throw new D(
+        throw new Y(
           [c, d],
           `Installation '${e.id}' failed to start and could not be cleanly disposed`
         );
@@ -1385,13 +1580,13 @@ class Ut {
       throw c;
     }
   }
-  #f(t) {
+  #p(t) {
     for (const { installation: e, instance: i, services: s } of t)
       this.#n.set(e, s), e.activate(i), this.#o.push(e);
     for (const { instance: e } of t)
       e.lifetime.publish(), e.lifetime.detachStartupSignal();
   }
-  async #l(t) {
+  async #u(t) {
     const e = [];
     for (const i of [...t].reverse())
       try {
@@ -1401,9 +1596,9 @@ class Ut {
       }
     return e;
   }
-  #u(t, e, i, s) {
+  #f(t, e, i, s) {
     const n = /* @__PURE__ */ Object.create(null);
-    for (const [o, a] of Object.entries(i.requires ?? {}))
+    for (const [o, a] of Object.entries(i.requires))
       if (a.kind === "optional") {
         const h = t.providerFor(e, a.service.id);
         if (!h) {
@@ -1426,10 +1621,10 @@ class Ut {
           );
         n[o] = c.get(a.id);
       } else
-        n[o] = this.#b(a, s);
+        n[o] = this.#m(a, s);
     return n;
   }
-  #h(t, e, i) {
+  #c(t, e, i) {
     return Object.freeze({
       ...i,
       get signal() {
@@ -1445,13 +1640,13 @@ class Ut {
       contribute: t.contribute.bind(t)
     });
   }
-  #c(t) {
+  #l(t) {
     return {
-      stageOn: (e, i, s, n) => this.#p(e, i, s, n, t),
+      stageOn: (e, i, s, n) => this.#d(e, i, s, n, t),
       emit: (e, i, s) => this.#g(e, i, s, t),
-      stageContribution: (e, i, s, n, o) => this.#v(e, i, s, n, o, t),
+      stageContribution: (e, i, s, n, o) => this.#w(e, i, s, n, o, t),
       writeLog: (e, i, s, n) => {
-        P(
+        R(
           this.#e[e](i, s, ...n),
           "Logger methods must be synchronous"
         );
@@ -1459,43 +1654,43 @@ class Ut {
       report: this.#s
     };
   }
-  #p(t, e, i, s, n) {
-    return this.#w(t), m(e, "event"), n.remember(e), this.#a.stage(e.id, i, s);
+  #d(t, e, i, s, n) {
+    return this.#b(t), A(e, "event"), n.remember(e), this.#a.stage(e.id, i, s);
   }
   #g(t, e, i, s) {
-    return this.#w(t), m(e, "event"), s.remember(e), this.#a.emit(e.id, i);
+    return this.#b(t), A(e, "event"), s.remember(e), this.#a.emit(e.id, i);
   }
-  #v(t, e, i, s, n, o) {
-    return this.#w(t), m(e, "extensionPoint"), o.remember(e), this.#r.get(e).stage(t, i, s, n);
+  #w(t, e, i, s, n, o) {
+    return this.#b(t), A(e, "extensionPoint"), o.remember(e), this.#r.get(e).stage(t, i, s, n);
   }
-  #b(t, e) {
+  #m(t, e) {
     return this.#r.get(t).view((i, s) => e.ownLease(i, s));
   }
-  #w(t) {
+  #b(t) {
     if (!this.#i(t))
       throw new Error(`Installation '${t}' is not installed`);
   }
 }
-function _t(r, t) {
+function he(r, t) {
   const e = [];
   let i = !1;
   for (const s of r)
-    s.status !== "fulfilled" && (Object.is(s.reason, t.reason) ? (i || e.push(s.reason), i = !0) : tt(t, s.reason) || e.push(s.reason));
+    s.status !== "fulfilled" && (Object.is(s.reason, t.reason) ? (i || e.push(s.reason), i = !0) : wt(t, s.reason) || e.push(s.reason));
   return e;
 }
-class Ht {
-  #t = new gt();
+class de {
+  #t = new zt();
   #e;
   #i;
   constructor(t) {
-    this.#e = new Ut(t);
+    this.#e = new ce(t);
   }
   get hasCommittedPlan() {
     return this.#i !== void 0;
   }
   get(t, e) {
-    const i = ht(t), s = i ? t.service : t;
-    if (m(s, "service"), this.#t.assertCompatible(s), e === "unavailable") throw H();
+    const i = jt(t), s = i ? t.service : t;
+    if (A(s, "service"), this.#t.assertCompatible(s), e === "unavailable") throw ct();
     const n = this.#o().provider(s.id);
     if (!n) {
       if (i) return;
@@ -1509,13 +1704,13 @@ class Ht {
     return o.value;
   }
   contributions(t) {
-    return m(t, "extensionPoint"), this.#t.remember(t), this.#e.contributions(t);
+    return A(t, "extensionPoint"), this.#t.remember(t), this.#e.contributions(t);
   }
   buildPlan(t) {
-    return M.build(t, this.#t.kinds);
+    return X.build(t, this.#t.kinds);
   }
   async start(t) {
-    const e = this.#t.draft(t.contractKinds);
+    const e = this.#t.writer(t.contractKinds);
     try {
       await this.#e.withContributionBatch(() => this.#s(t, e)), this.#i = t;
     } catch (i) {
@@ -1528,14 +1723,29 @@ class Ht {
     );
     return this.#i = void 0, t;
   }
+  /**
+   * The whole transaction, in the order the steps have to happen.
+   *
+   * Configs resolve and Contract identities draft *before* anything stops,
+   * because those are the failures that can still be taken back for free — a
+   * schema rejection at this point costs nothing. Once the affected Instances
+   * are down, every remaining failure has a price, and the only question left is
+   * whether the previous state can be restored.
+   *
+   * The whole body runs inside one contribution batch, so contributions
+   * withdrawn by stopping Instances and added by starting ones become visible in
+   * a single step. Without it, an ExtensionPoint observer would see the set
+   * briefly empty in the middle of a successful change.
+   */
   async transition(t, e, i) {
     return this.#e.withContributionBatch(async () => {
       const s = this.#o(), n = s.affectedByTransitionTo(t, e);
       let o, a;
       try {
         o = await this.#r(
+          t,
           t.order.filter((d) => n.has(d))
-        ), a = this.#t.draft(t.contractKinds);
+        ), a = this.#t.writer(t.contractKinds);
       } catch (d) {
         throw i(), d;
       }
@@ -1550,7 +1760,7 @@ class Ht {
         return await this.#e.activate(t, n, o, a), a.commit(), this.#e.commitActivationOrder(t.order), this.#i = t, Object.freeze({ kind: "committed", affected: n });
       } catch (d) {
         const l = await this.#e.deactivate(n);
-        return a.discard(), d instanceof D || l.length ? this.#n(
+        return a.discard(), d instanceof Y || l.length ? this.#n(
           i,
           [d, ...l],
           "Installation change failed and its partial activation could not be cleanly disposed"
@@ -1562,7 +1772,7 @@ class Ht {
     });
   }
   async #s(t, e) {
-    const i = new Set(t.order), s = await this.#r(t.order);
+    const i = new Set(t.order), s = await this.#r(t, t.order);
     this.#e.resetActivationState();
     try {
       await this.#e.activate(t, i, s, e), e.commit(), this.#e.commitActivationOrder(t.order);
@@ -1571,14 +1781,30 @@ class Ht {
       throw o.length ? new AggregateError([n, ...o], "Host startup failed") : n;
     }
   }
+  /**
+   * The last level: no consistent graph could be reached, so none is presented.
+   *
+   * Everything stops and `#plan` is cleared, which drops the Host to `idle` and
+   * closes reads. The AggregateError carries every cause — the original failure
+   * first, then whatever shutdown itself hit. Nothing is swallowed here; the
+   * point of failing closed is that the report is complete.
+   */
   async #n(t, e, i) {
     t();
     const s = await this.#e.deactivateAll();
     throw this.#i = void 0, new AggregateError([...e, ...s], i);
   }
+  /**
+   * Restores the previous plan using the configs captured before the change, not
+   * mutable records. Declaration versions belong to the plan; re-validating
+   * configs could fail for a second,
+   * unrelated reason while trying to recover from the first.
+   *
+   * A rollback that itself fails escalates to fail-closed by throwing.
+   */
   async #a(t, e, i, s, n) {
     t();
-    const o = this.#t.draft(e.contractKinds);
+    const o = this.#t.writer(e.contractKinds);
     try {
       await this.#e.activate(e, i, s, o), o.commit(), this.#e.commitActivationOrder(e.order), this.#i = e;
     } catch (h) {
@@ -1591,48 +1817,47 @@ class Ht {
     const a = n.length === 1 ? n[0] : new AggregateError(n, "Installation change failed");
     return Object.freeze({ kind: "rolled-back", affected: i, error: a });
   }
-  async #r(t) {
-    const e = /* @__PURE__ */ new Map();
-    for (const i of t)
+  async #r(t, e) {
+    const i = /* @__PURE__ */ new Map();
+    for (const s of e)
       try {
-        e.set(
-          i,
-          await et(
-            i.declaration.plugin.config,
-            i.declaration.config,
-            i.id
-          )
-        );
-      } catch (s) {
-        throw $(
+        const n = t.declarationFor(s);
+        i.set(
           s,
+          await Lt(n.plugin.config, n.config, s.id)
+        );
+      } catch (n) {
+        throw V(
+          n,
           "INSTALLATION_UNAVAILABLE",
-          `Installation '${i.id}' failed with a non-Error value`
+          `Installation '${s.id}' failed with a non-Error value`
         );
       }
-    return e;
+    return i;
   }
   #o() {
-    if (!this.#i) throw H();
+    if (!this.#i) throw ct();
     return this.#i;
   }
 }
-function H() {
+function ct() {
   return new u("SERVICE_UNAVAILABLE", "Host services are not active");
 }
-class Kt {
+class le {
   #t;
   #e;
-  #i;
-  #s = 0;
+  #i = 0;
   view;
   constructor(t, e, i) {
-    this.#t = t, this.#i = this.#n("idle", [], e), this.#e = new q(() => this.#i, i), this.view = this.#e.view;
+    this.#t = t, this.#e = new Z(() => {
+      const { status: s, installations: n, groups: o } = e();
+      return this.#s(s, n, o);
+    }, i), this.view = this.#e.view;
   }
-  publish(t, e, i) {
-    this.#s++, this.#i = this.#n(t, e, i), this.#e.invalidate();
+  publish() {
+    this.#i++, this.#e.invalidate();
   }
-  #n(t, e, i) {
+  #s(t, e, i) {
     const s = /* @__PURE__ */ new Map();
     for (const o of e) {
       const a = {
@@ -1641,10 +1866,10 @@ class Kt {
         groupId: o.groupId,
         status: o.status,
         requires: Object.freeze(
-          Object.values(o.declaration.plugin.requires ?? {}).map((c) => c.kind === "optional" ? c.service.id : c.id)
+          Object.values(o.declaration.plugin.requires).map((c) => c.kind === "optional" ? c.service.id : c.id)
         ),
         provides: Object.freeze(
-          Object.values(o.declaration.plugin.provides ?? {}).map((c) => c.id)
+          Object.values(o.declaration.plugin.provides).map((c) => c.id)
         ),
         ...o.instance ? { lifetime: o.instance.lifetime.diagnostics } : {}
       }, h = o.error;
@@ -1664,32 +1889,32 @@ class Kt {
     return Object.freeze({
       name: this.#t,
       status: t,
-      revision: this.#s,
-      installations: new O(s),
-      groups: new O(n)
+      revision: this.#i,
+      installations: new z(s),
+      groups: new z(n)
     });
   }
 }
-function L(r, t, e = {}) {
+function B(r, t, e = {}) {
   if (!r || typeof r != "object" || Array.isArray(r))
-    throw b(e, `${t} must be a plain record`);
+    throw O(e, `${t} must be a plain record`);
   const i = Object.getPrototypeOf(r);
   if (i !== Object.prototype && i !== null)
-    throw b(e, `${t} must be a plain record`);
+    throw O(e, `${t} must be a plain record`);
   for (const s of Reflect.ownKeys(r)) {
     const n = Reflect.getOwnPropertyDescriptor(r, s);
     if (typeof s != "string" || !n?.enumerable)
-      throw b(e, `${t} keys must be enumerable strings`);
+      throw O(e, `${t} keys must be enumerable strings`);
     if (!("value" in n))
-      throw b(e, `${t} field '${s}' must be a data property`);
+      throw O(e, `${t} field '${s}' must be a data property`);
     if (e.fields && !e.fields.has(s))
-      throw b(e, `${t}: unknown field '${s}'`);
+      throw O(e, `${t}: unknown field '${s}'`);
   }
 }
-function b(r, t) {
+function O(r, t) {
   return r.createError?.(t) ?? new TypeError(t);
 }
-const Wt = /* @__PURE__ */ new Set([
+const ue = /* @__PURE__ */ new Set([
   "signal",
   "meta",
   "log",
@@ -1699,12 +1924,12 @@ const Wt = /* @__PURE__ */ new Set([
   "on",
   "emit",
   "contribute"
-]), Yt = /* @__PURE__ */ new Set(["name", "config", "requires", "provides", "setup"]);
-function ve(r) {
-  return nt(r);
+]), fe = /* @__PURE__ */ new Set(["name", "config", "requires", "provides", "setup"]);
+function Ne(r) {
+  return Ct(r);
 }
-function nt(r) {
-  Qt(r);
+function Ct(r) {
+  pe(r);
   const t = Object.hasOwn(r, "name") ? r.name : void 0, e = Object.hasOwn(r, "config") ? r.config : void 0, i = Object.hasOwn(r, "requires") ? r.requires : void 0, s = Object.hasOwn(r, "provides") ? r.provides : void 0, n = Object.hasOwn(r, "setup") ? r.setup : void 0;
   if (typeof t != "string" || !t.trim())
     throw new TypeError("Plugin name must be a non-empty string");
@@ -1712,24 +1937,27 @@ function nt(r) {
     throw new TypeError("Plugin name cannot start or end with whitespace");
   if (typeof n != "function")
     throw new TypeError(`Plugin '${t}' must define setup()`);
-  if (e !== void 0 && !Jt(e))
+  if (e !== void 0 && !ge(e))
     throw new TypeError(`Plugin '${t}' config must implement Standard Schema V1`);
-  K(i, t, "requires"), K(s, t, "provides");
-  const o = i ? Object.freeze({ ...i }) : void 0, a = s ? Object.freeze({ ...s }) : void 0, h = /* @__PURE__ */ new Map();
-  for (const [c, d] of Object.entries(o ?? {})) {
+  ht(i, t, "requires"), ht(s, t, "provides");
+  const o = /* @__PURE__ */ Object.create(null), a = /* @__PURE__ */ Object.create(null), h = /* @__PURE__ */ new Map();
+  for (const [c, d] of Object.entries(i ?? {})) {
     if (!c.trim()) throw new TypeError("Plugin requirement alias cannot be empty");
     if (c !== c.trim())
       throw new TypeError("Plugin requirement alias cannot start or end with whitespace");
-    if (Wt.has(c))
+    if (ue.has(c))
       throw new TypeError(`Plugin requirement '${c}' conflicts with the context API`);
     if (!d || typeof d != "object")
       throw new TypeError(`Plugin requirement '${c}' is not a contract`);
     if (d.kind === "optional") {
-      if (!v(d.service, "service"))
+      if (!E(d.service, "service"))
         throw new TypeError(`Optional requirement '${c}' must wrap a Service`);
-    } else if (!v(d, "service") && !v(d, "extensionPoint"))
+    } else if (!E(d, "service") && !E(d, "extensionPoint"))
       throw new TypeError(`Plugin requirement '${c}' must be a Service or ExtensionPoint`);
-    W(
+    o[c] = d.kind === "optional" ? Object.freeze({
+      kind: "optional",
+      service: _(d.service)
+    }) : _(d), dt(
       t,
       h,
       "requirement",
@@ -1737,36 +1965,41 @@ function nt(r) {
       d.kind === "optional" ? d.service : d
     );
   }
-  for (const [c, d] of Object.entries(a ?? {})) {
+  for (const [c, d] of Object.entries(s ?? {})) {
     if (!c.trim()) throw new TypeError("Plugin provision alias cannot be empty");
     if (c !== c.trim())
       throw new TypeError("Plugin provision alias cannot start or end with whitespace");
-    if (!v(d, "service"))
+    if (c === "then")
+      throw new TypeError("Plugin provision alias 'then' conflicts with the Promise protocol");
+    if (!E(d, "service"))
       throw new TypeError(`Plugin provision '${c}' must be a Service`);
-    W(t, h, "provision", c, d);
+    a[c] = _(d), dt(t, h, "provision", c, a[c]);
   }
   return Object.freeze({
     name: t,
     ...e === void 0 ? {} : { config: e },
-    ...o ? { requires: o } : {},
-    ...a ? { provides: a } : {},
+    requires: Object.freeze(o),
+    provides: Object.freeze(a),
     setup: n
   });
 }
-function Qt(r) {
-  L(r, "Plugin declaration", { fields: Yt });
+function _(r) {
+  return Object.freeze({ id: r.id, kind: r.kind });
 }
-function Jt(r) {
+function pe(r) {
+  B(r, "Plugin declaration", { fields: fe });
+}
+function ge(r) {
   if (!r || typeof r != "object" && typeof r != "function") return !1;
   const t = r["~standard"];
   if (!t || typeof t != "object") return !1;
   const e = t;
   return e.version === 1 && typeof e.vendor == "string" && typeof e.validate == "function";
 }
-function K(r, t, e) {
-  r !== void 0 && L(r, `Plugin '${t}' ${e}`);
+function ht(r, t, e) {
+  r !== void 0 && B(r, `Plugin '${t}' ${e}`);
 }
-function W(r, t, e, i, s) {
+function dt(r, t, e, i, s) {
   const n = t.get(s.id);
   if (!n) {
     t.set(s.id, { alias: i, kind: s.kind, role: e });
@@ -1774,35 +2007,35 @@ function W(r, t, e, i, s) {
   }
   if (n.kind !== s.kind)
     throw new TypeError(
-      `Plugin '${r}' uses Contract '${s.id}' as both ${R(n.kind)} and ${R(s.kind)}`
+      `Plugin '${r}' uses Contract '${s.id}' as both ${H(n.kind)} and ${H(s.kind)}`
     );
-  const o = R(s.kind);
+  const o = H(s.kind);
   throw n.role !== e ? new TypeError(
     `Plugin '${r}' cannot both require and provide ${o} '${s.id}'`
   ) : new TypeError(
     `Plugin '${r}' ${e} aliases '${n.alias}' and '${i}' reference the same ${o} '${s.id}'`
   );
 }
-function R(r) {
+function H(r) {
   return r === "extensionPoint" ? "ExtensionPoint" : r === "event" ? "Event" : "Service";
 }
-function Y(r) {
-  return nt(r);
+function lt(r) {
+  return Ct(r);
 }
-const Xt = /* @__PURE__ */ new Set(["plugin", "config"]), I = /* @__PURE__ */ new WeakMap();
-function Zt(r, t) {
-  I.get(r)?.discard(t);
+const we = /* @__PURE__ */ new Set(["plugin", "config"]), x = /* @__PURE__ */ new WeakMap();
+function be(r, t) {
+  x.get(r)?.discard(t);
 }
-function te(r, t, e, i) {
-  const s = I.get(r);
+function me(r, t, e, i) {
+  const s = x.get(r);
   if (!s) throw new Error("ChangeSet draft control has been released");
   return s.install(t, e, i);
 }
-class ee {
+class ve {
   #t = /* @__PURE__ */ new Map();
   #e;
   constructor(t) {
-    this.#e = { phase: "open", port: t }, I.set(this, {
+    this.#e = { phase: "open", port: t }, x.set(this, {
       discard: (e) => this.#s(e),
       install: (e, i, s) => this.#i(e, i, s)
     }), Object.freeze(this);
@@ -1811,12 +2044,12 @@ class ee {
     return this.#i(t, e[0]);
   }
   #i(t, e, i) {
-    const s = this.#a(), n = Y(t), o = (i ?? s.create)(n, e);
+    const s = this.#a(), n = lt(t), o = (i ?? s.create)(n, e);
     return this.#n({ kind: "install", installation: o.record }), o.facade;
   }
   update(t, e) {
     const i = this.#a();
-    L(e, "Installation update", { fields: Xt });
+    B(e, "Installation update", { fields: we });
     const s = Object.hasOwn(e, "plugin"), n = Object.hasOwn(e, "config");
     if (!s && !n)
       throw new TypeError("Installation update must include 'plugin' or 'config'");
@@ -1825,7 +2058,7 @@ class ee {
     if (s) {
       const d = e.plugin;
       if (!d) throw new TypeError("Installation update 'plugin' must be a Plugin");
-      a = Y(d);
+      a = lt(d);
     }
     let h;
     a && n ? h = { kind: "plugin-and-config", plugin: a, config: e.config } : a ? h = { kind: "plugin", plugin: a } : h = { kind: "config", config: e.config };
@@ -1836,6 +2069,12 @@ class ee {
     const e = this.#a();
     this.#n({ kind: "remove", installation: e.resolve(t) });
   }
+  /**
+   * Commit is idempotent by returning the same promise, so two callers awaiting
+   * one draft get one transaction rather than two. `committing` exists to catch
+   * the reentrant case — an `attach` hook that calls `commit()` again — which
+   * would otherwise submit the operation list twice.
+   */
   commit() {
     const t = this.#e;
     if (t.phase === "submitted") return t.promise;
@@ -1870,6 +2109,10 @@ class ee {
     for (const s of i)
       s.kind === "install" && e.port.discard(s.installation, t);
   }
+  // One operation per Installation per ChangeSet. Allowing two would make the
+  // outcome depend on staging order — `update` then `remove` versus the reverse —
+  // and there is no reading of "both" that is obviously right. The caller has to
+  // say which one it meant.
   #n(t) {
     if (this.#t.has(t.installation))
       throw new TypeError(
@@ -1887,55 +2130,10 @@ class ee {
     return this.#e = { phase: "submitted", promise: t }, this.#o(), t;
   }
   #o() {
-    this.#t.clear(), I.delete(this);
+    this.#t.clear(), x.delete(this);
   }
 }
-class ie {
-  #t;
-  constructor(t, e, i) {
-    this.#t = { phase: "open", draft: t, discard: e, normalize: i };
-  }
-  get failure() {
-    return this.#t.phase === "failed" ? this.#t.error : void 0;
-  }
-  requireDraft() {
-    const t = this.#t;
-    if (t.phase === "failed") throw t.error;
-    if (t.phase === "sealed") throw N();
-    return t.draft;
-  }
-  assertOpen() {
-    this.requireDraft();
-  }
-  fail(t) {
-    const e = this.#t;
-    if (e.phase === "failed") return e.error;
-    if (e.phase === "sealed") throw N();
-    const i = e.normalize(t);
-    return this.#t = {
-      phase: "failed",
-      draft: e.draft,
-      discard: e.discard,
-      error: i
-    }, i;
-  }
-  seal() {
-    const t = this.#t;
-    if (t.phase === "failed") throw t.error;
-    if (t.phase === "sealed") throw N();
-    return this.#t = { phase: "sealed" }, t.draft;
-  }
-  discard(t) {
-    const e = this.#t;
-    if (e.phase === "sealed") return;
-    const i = e.phase === "failed" ? e.error : e.normalize(t);
-    this.#t = { phase: "sealed" }, e.discard(e.draft, i);
-  }
-}
-function N() {
-  return new Error("Group configuration has been sealed");
-}
-class A {
+class M {
   constructor(t, e, i) {
     this.id = t, this.name = e, this.#e = { phase: "attached", parent: i };
   }
@@ -1944,7 +2142,7 @@ class A {
   #t = /* @__PURE__ */ new Map();
   #e;
   static root(t) {
-    return new A("/", t, void 0);
+    return new M("/", t, void 0);
   }
   get attached() {
     return this.#e.phase !== "detached";
@@ -1957,21 +2155,24 @@ class A {
     return t.phase === "detached" ? void 0 : t.parent;
   }
   create(t) {
-    if (this.assertAttached(), se(t), this.#t.has(t))
+    if (this.assertAttached(), ye(t), this.#t.has(t))
       throw new TypeError(`Group '${this.#i(t)}' already exists`);
-    const e = new A(this.#i(t), t, this);
+    const e = new M(this.#i(t), t, this);
     return this.#t.set(t, e), e;
   }
   contains(t) {
-    if (t === this) return !0;
-    for (const e of this.#t.values())
-      if (e.contains(t)) return !0;
+    for (let e = t; e; e = e.parent)
+      if (e === this) return !0;
     return !1;
   }
   assertAttached() {
     if (this.#e.phase === "detached")
       throw new TypeError(`Group '${this.id}' has been removed`);
   }
+  // Depth-first, and children are detached before this node unlinks itself from
+  // its parent. A node that unlinked first would leave its subtree unreachable
+  // but still attached, so those groups would report themselves as live with no
+  // path back to the root.
   detach() {
     const t = this.#e;
     if (t.phase !== "detached") {
@@ -1991,14 +2192,59 @@ class A {
     return this.id === "/" ? `/${t}` : `${this.id}/${t}`;
   }
 }
-function se(r) {
+function ye(r) {
   if (typeof r != "string" || !r.trim())
     throw new TypeError("Group name must be a non-empty string");
   if (r !== r.trim())
     throw new TypeError("Group name cannot start or end with whitespace");
   if (r.includes("/")) throw new TypeError("Group name cannot contain '/'");
 }
-class Q {
+class Ee {
+  #t;
+  constructor(t, e, i) {
+    this.#t = { phase: "open", draft: t, discard: e, normalize: i };
+  }
+  get failure() {
+    return this.#t.phase === "failed" ? this.#t.error : void 0;
+  }
+  requireDraft() {
+    const t = this.#t;
+    if (t.phase === "failed") throw t.error;
+    if (t.phase === "sealed") throw K();
+    return t.draft;
+  }
+  assertOpen() {
+    this.requireDraft();
+  }
+  fail(t) {
+    const e = this.#t;
+    if (e.phase === "failed") return e.error;
+    if (e.phase === "sealed") throw K();
+    const i = e.normalize(t);
+    return this.#t = {
+      phase: "failed",
+      draft: e.draft,
+      discard: e.discard,
+      error: i
+    }, i;
+  }
+  seal() {
+    const t = this.#t;
+    if (t.phase === "failed") throw t.error;
+    if (t.phase === "sealed") throw K();
+    return this.#t = { phase: "sealed" }, t.draft;
+  }
+  discard(t) {
+    const e = this.#t;
+    if (e.phase === "sealed") return;
+    const i = e.phase === "failed" ? e.error : e.normalize(t);
+    this.#t = { phase: "sealed" }, e.discard(e.draft, i);
+  }
+}
+function K() {
+  return new Error("Group configuration has been sealed");
+}
+class ut {
   constructor(t, e, i) {
     this.node = t, this.#t = { phase: e }, this.#e = i;
   }
@@ -2018,6 +2264,19 @@ class Q {
     if (i.phase === "failed") throw i.error;
     await t();
   }
+  /**
+   * `preserveCommittedState` is the whole point of this class.
+   *
+   * A Group that has already committed something is established, and a later
+   * failed change does not un-establish it — the transaction rolled back, so the
+   * state the Group describes is still the one that was committed. Such a
+   * failure leaves the phase at `established` and does not rethrow, because the
+   * caller of the failed change already has the error.
+   *
+   * A Group whose *first* change fails never had a committed state, so it does
+   * become `failed` and the failure propagates: there is nothing to report but
+   * the failure.
+   */
   track(t) {
     this.node.assertAttached();
     const e = this.#t, i = e.phase === "established" || e.phase === "pending" && e.baseline === "established", s = {}, n = t.then(
@@ -2025,7 +2284,7 @@ class Q {
         this.#i(s) && (this.#t = { phase: "established" }, this.#e?.());
       },
       (o) => {
-        const a = $(
+        const a = V(
           o,
           "GROUP_UNAVAILABLE",
           `Group '${this.node.id}' operation failed with a non-Error value`
@@ -2049,15 +2308,15 @@ class Q {
     return e.phase === "pending" && e.attempt === t;
   }
 }
-function T(r) {
+function D(r) {
   return new u("GROUP_REMOVED", `Group '${r.id}' has been removed`);
 }
-const C = /* @__PURE__ */ new WeakMap();
-class re {
+const P = /* @__PURE__ */ new WeakMap();
+class Ce {
   #t;
   #e;
   constructor(t, e, i) {
-    this.#t = e, this.#e = i ? { phase: "configuring", coordinator: t, configuration: i } : { phase: "attached", coordinator: t }, C.set(this, {
+    this.#t = e, this.#e = i ? { phase: "configuring", coordinator: t, configuration: i } : { phase: "attached", coordinator: t }, P.set(this, {
       finishConfiguration: () => {
         const s = this.#e;
         s.phase === "configuring" && (this.#e = { phase: "attached", coordinator: s.coordinator });
@@ -2079,7 +2338,7 @@ class re {
   }
   ready() {
     const t = this.#e;
-    return t.phase === "revoked" ? Promise.reject(T(this.#t)) : t.coordinator.ready(this.#t);
+    return t.phase === "revoked" ? Promise.reject(D(this.#t)) : t.coordinator.ready(this.#t);
   }
   install(t, ...e) {
     const i = this.#e;
@@ -2112,19 +2371,19 @@ class re {
   }
   #i() {
     const t = this.#e;
-    if (t.phase === "revoked") throw T(this.#t);
+    if (t.phase === "revoked") throw D(this.#t);
     return t.coordinator;
   }
 }
-class ne {
+class Se {
   root;
   #t;
   #e = /* @__PURE__ */ new WeakMap();
   #i = /* @__PURE__ */ new WeakMap();
   constructor(t, e) {
-    this.root = A.root(t), this.#t = e, this.#i.set(
+    this.root = M.root(t), this.#t = e, this.#i.set(
       this.root,
-      new Q(this.root, "established", () => e.notifyChanged())
+      new ut(this.root, "established", () => e.notifyChanged())
     );
   }
   nodes() {
@@ -2132,23 +2391,29 @@ class ne {
   }
   install(t, e, ...i) {
     const s = this.change(t), n = s.install(e, ...i);
-    return J(s.commit()), n;
+    return ft(s.commit()), n;
   }
   stageConfigurationInstall(t, e, i, ...s) {
-    return this.#r(t), te(
+    return this.#r(t), me(
       e.requireDraft(),
       i,
       s[0],
       (n, o) => (this.#r(t), this.#t.createDraft(t, n, o))
     );
   }
+  /**
+   * `deferred` tracking exists for `create()`. A Group being configured must not
+   * mark itself pending on each nested install, because the whole configuration
+   * commits once; the coordinator attaches that single operation to every node in
+   * the finished subtree instead.
+   */
   change(t, e = "immediate") {
-    return this.#r(t), new ee({
+    return this.#r(t), new ve({
       create: (i, s) => (this.#r(t), this.#t.createDraft(t, i, s)),
       resolve: (i) => {
         this.#r(t);
         const s = this.#t.resolveInstallation(i);
-        if (!s.attached) throw s.unavailableError();
+        if (!s.hasAuthority) throw s.unavailableError();
         if (!t.contains(s.group))
           throw new TypeError(`Installation '${s.id}' is outside Group '${t.id}'`);
         return s;
@@ -2168,20 +2433,20 @@ class ne {
   create(t, e, i, s) {
     if (typeof i != "function") throw new TypeError("Group configure must be a function");
     const n = t.create(e);
-    this.#i.set(n, new Q(n, "new", () => this.#t.notifyChanged()));
-    const o = s === void 0, a = s ?? new ie(
+    this.#i.set(n, new ut(n, "new", () => this.#t.notifyChanged()));
+    const o = s === void 0, a = s ?? new Ee(
       this.change(n, "deferred"),
-      Zt,
-      (c) => $(
+      be,
+      (c) => V(
         c,
         "GROUP_UNAVAILABLE",
         `Group '${n.id}' configuration failed with a non-Error value`
       )
-    ), h = new re(this, n, a);
+    ), h = new Ce(this, n, a);
     this.#e.set(n, h);
     try {
       const c = i(h);
-      P(c, "Group configure must be synchronous");
+      R(c, "Group configure must be synchronous");
       const d = a.failure;
       if (d) throw d;
     } catch (c) {
@@ -2192,9 +2457,9 @@ class ne {
       const c = a.seal().commit();
       for (const d of n.walk()) {
         const l = this.#e.get(d);
-        l && C.get(l)?.finishConfiguration(), this.#a(d, c);
+        l && P.get(l)?.finishConfiguration(), this.#a(d, c);
       }
-      J(c);
+      ft(c);
     }
     return this.#t.notifyChanged(), h;
   }
@@ -2225,6 +2490,10 @@ class ne {
       (e) => t.contains(e.group)
     );
   }
+  // A Group has no status of its own — it reports what its contents say, with
+  // the worst news winning. The last line is the one that needs stating: an
+  // empty Group is `active`, because a subtree that owns nothing has nothing
+  // left to wait for.
   #n(t) {
     const e = this.#s(t);
     return e.some((i) => i.status === "failed") ? "failed" : e.some((i) => i.status === "stopping") ? "stopping" : e.length && e.every((i) => i.status === "active") ? "active" : e.length ? "pending" : "active";
@@ -2234,25 +2503,25 @@ class ne {
   }
   #r(t) {
     const e = this.#i.get(t);
-    if (!t.attached || !e) throw T(t);
+    if (!t.attached || !e) throw D(t);
     return e;
   }
   #o(t) {
     for (const e of t) {
       this.#i.get(e)?.release(), this.#i.delete(e);
       const i = this.#e.get(e);
-      i && (C.get(i)?.revoke(), C.delete(i)), this.#e.delete(e);
+      i && (P.get(i)?.revoke(), P.delete(i)), this.#e.delete(e);
     }
   }
 }
-function J(r) {
+function ft(r) {
   Promise.resolve(r).catch(() => {
   });
 }
-function X(r, t) {
+function pt(r, t) {
   return Object.freeze({ plugin: r, config: t });
 }
-class oe {
+class Oe {
   constructor(t, e, i, s) {
     this.id = t, this.index = e, this.groupId = i.id, this.#i = { declaration: s, group: i, notifyChanged: void 0 };
   }
@@ -2264,7 +2533,7 @@ class oe {
   groupId;
   #s = /* @__PURE__ */ new Set();
   attach(t) {
-    const e = this.#d();
+    const e = this.#h();
     if (e.notifyChanged) throw new Error(`Installation '${this.id}' is already attached`);
     e.notifyChanged = t;
   }
@@ -2272,7 +2541,7 @@ class oe {
     return this.#t.phase;
   }
   /** Whether the owning ChangeSet has granted this Installation Host authority. */
-  get attached() {
+  get hasAuthority() {
     return this.#i?.notifyChanged !== void 0;
   }
   get instance() {
@@ -2282,18 +2551,18 @@ class oe {
   get error() {
     const t = this.#t;
     if (t.phase === "failed")
-      return t.failure.retention === "live" ? t.failure.error : t.failure.summary.restore();
+      return t.error;
     if (t.phase === "removed")
       return new u("INSTALLATION_REMOVED", `Installation '${this.id}' has been removed`);
   }
   get group() {
-    return this.#d().group;
+    return this.#h().group;
   }
   get declaration() {
-    return this.#d().declaration;
+    return this.#h().declaration;
   }
   replaceDeclaration(t) {
-    this.#d().declaration = t;
+    this.#h().declaration = t;
   }
   ready() {
     const t = this.#e;
@@ -2305,18 +2574,34 @@ class oe {
       `Installation '${this.id}' has not been committed`
     );
   }
+  /**
+   * Binds `ready()` to the change currently in flight.
+   *
+   * The `attempt` token is the point: a second change can start before the
+   * first one's promise settles, and only the latest attempt is allowed to clear
+   * the barrier. Without it, a stale resolution would report readiness for an
+   * attempt that has already been superseded.
+   *
+   * A rejection is rethrown only when this Installation did not end up active.
+   * A change that failed elsewhere in the batch but left this one running is not
+   * this Installation's failure to report.
+   */
   trackReadiness(t) {
     const e = {}, i = t.then(
       () => {
         this.#e?.attempt === e && (this.#e = void 0);
       },
       (s) => {
-        if (this.#e?.attempt === e && (this.#e = void 0), this.#t.phase !== "active") throw s;
+        if (this.#e?.attempt === e && (this.#e = void 0), this.#t.phase !== "active") throw this.error ?? s;
       }
     );
     this.#e = { attempt: e, barrier: i }, i.catch(() => {
     });
   }
+  // A terminal state only answers `ready()` once its readiness has been settled.
+  // Before that the outcome is still being decided by the change in flight, so
+  // the caller joins the waiter set instead of being told a result that the
+  // transaction might still roll back.
   #n() {
     const t = this.#t;
     if ((t.phase === "active" || t.phase === "failed" || t.phase === "removed") && t.readiness === "settled") {
@@ -2357,11 +2642,17 @@ class oe {
   fail(t) {
     return this.#a(t);
   }
+  /**
+   * For an Installation that never made it into the graph. Unlike `fail()`, this
+   * is terminal: readiness settles immediately, the attachment is dropped, and
+   * the reason is kept as a RecordedFailure rather than the live Error. The handle the
+   * caller already holds stays usable and reports why it is dead.
+   */
   discard(t) {
-    const e = this.#o(t);
+    const e = new J(this.#o(t));
     this.#r({
       phase: "failed",
-      failure: { retention: "summary", summary: new dt(e) },
+      error: e,
       readiness: "settled"
     });
     for (const i of this.#s) i.reject(e);
@@ -2371,7 +2662,7 @@ class oe {
     const e = this.#o(t);
     return this.#r({
       phase: "failed",
-      failure: { retention: "live", error: e },
+      error: e,
       readiness: "unsettled"
     }), e;
   }
@@ -2382,24 +2673,24 @@ class oe {
     this.#t = t, this.#i?.notifyChanged?.();
   }
   #o(t) {
-    return $(
+    return V(
       t,
       "INSTALLATION_UNAVAILABLE",
       `Installation '${this.id}' failed with a non-Error value`
     );
   }
-  #d() {
+  #h() {
     const t = this.#i;
     if (!t) throw new Error(`Installation '${this.id}' is no longer installed`);
     return t;
   }
 }
-const S = /* @__PURE__ */ new WeakMap();
-class ae {
+const L = /* @__PURE__ */ new WeakMap();
+class Ae {
   #t;
   #e = { phase: "draft" };
   constructor(t) {
-    this.#t = t, S.set(this, {
+    this.#t = t, L.set(this, {
       attach: (e, i) => {
         if (this.#e.phase !== "draft")
           throw new Error(`Installation '${this.#t.id}' control is already sealed`);
@@ -2444,7 +2735,7 @@ class ae {
     );
   }
 }
-class ce {
+class Ie {
   #t = /* @__PURE__ */ new Map();
   #e = /* @__PURE__ */ new WeakMap();
   #i = /* @__PURE__ */ new WeakMap();
@@ -2464,12 +2755,12 @@ class ce {
   }
   create(t, e, i) {
     t.assertAttached();
-    const s = ++this.#n, n = new oe(
+    const s = ++this.#n, n = new Oe(
       `${e.name}:${s}`,
       s,
       t,
-      X(e, i)
-    ), o = new ae(n);
+      pt(e, i)
+    ), o = new Ae(n);
     return this.#e.set(o, n), this.#i.set(n, o), { record: n, facade: o };
   }
   resolve(t) {
@@ -2480,13 +2771,19 @@ class ce {
   attach(t) {
     const e = this.#i.get(t);
     if (!e) throw new Error(`Installation '${t.id}' has no public facade`);
-    const i = S.get(e);
+    const i = L.get(e);
     if (!i) throw new Error(`Installation '${t.id}' has no draft control`);
     t.attach(this.#s.notifyChanged), i.attach(
       (s) => this.#s.update(t, e, s),
       () => this.#s.remove(t, e)
     );
   }
+  /**
+   * Validates the whole batch, then applies the whole batch. The two loops are
+   * not a style choice: a rejected operation halfway through a single loop would
+   * leave the earlier ones already written, and this method has no way to undo
+   * them. Checking first means `apply` either changes everything or nothing.
+   */
   apply(t) {
     for (const e of t) {
       if (e.kind === "install") {
@@ -2507,7 +2804,7 @@ class ce {
         this.#t.set(e.installation.id, e.installation);
       else if (e.kind === "update") {
         const i = e.installation.declaration, s = e.declaration.kind === "config" ? i.plugin : e.declaration.plugin, n = e.declaration.kind === "plugin" ? i.config : e.declaration.config;
-        e.installation.replaceDeclaration(X(s, n));
+        e.installation.replaceDeclaration(pt(s, n));
       } else this.contains(e.installation) && this.#t.delete(e.installation.id);
   }
   settleChanges(t, e) {
@@ -2520,6 +2817,9 @@ class ce {
   discard(t, e) {
     t.discard(e), this.#a(t);
   }
+  // Captures declarations only, since that is all a rollback restores. Instances
+  // belong to the InstanceCoordinator and are rebuilt from the previous plan
+  // rather than snapshotted — a live Instance is not a value that can be copied.
   capture() {
     return [...this.#t.values()].map((t) => ({
       installation: t,
@@ -2533,10 +2833,10 @@ class ce {
   }
   #a(t) {
     const e = this.#i.get(t);
-    e && (S.get(e)?.revoke(), S.delete(e)), this.#i.delete(t);
+    e && (L.get(e)?.revoke(), L.delete(e)), this.#i.delete(t);
   }
 }
-class he {
+class je {
   #t = Promise.resolve();
   get settled() {
     return this.#t;
@@ -2553,8 +2853,8 @@ class he {
     ), e;
   }
 }
-const de = console, le = /* @__PURE__ */ new Set(["name", "logger", "onError"]);
-class ue {
+const ke = console, $e = /* @__PURE__ */ new Set(["name", "logger", "onError"]);
+class Te {
   name;
   diagnostics;
   #t;
@@ -2564,9 +2864,9 @@ class ue {
   #n;
   #a;
   #r = "idle";
-  #o = new he();
+  #o = new je();
   constructor(t = {}) {
-    L(t, "Host options", { fields: le });
+    B(t, "Host options", { fields: $e });
     const e = Object.hasOwn(t, "name") ? t.name : void 0, i = Object.hasOwn(t, "logger") ? t.logger : void 0, s = Object.hasOwn(t, "onError") ? t.onError : void 0, n = e ?? "host";
     if (typeof n != "string" || !n.trim())
       throw new TypeError("Host name must be a non-empty string");
@@ -2574,10 +2874,10 @@ class ue {
       throw new TypeError("Host name cannot start or end with whitespace");
     if (s !== void 0 && typeof s != "function")
       throw new TypeError("Host onError must be a function");
-    if (i !== void 0 && !Mt(i))
+    if (i !== void 0 && !se(i))
       throw new TypeError("Host logger must implement debug/info/warn/error");
-    this.name = n, this.#i = i ?? de, this.#n = s ?? ((o) => this.#i.error(o)), this.#t = new ce({
-      notifyChanged: () => this.#p(),
+    this.name = n, this.#i = i ?? ke, this.#n = s ?? ((o) => this.#i.error(o)), this.#t = new Ie({
+      notifyChanged: () => this.#d(),
       update: (o, a, h) => {
         const c = this.#s.change(o.group);
         return c.update(a, h), c.commit();
@@ -2586,25 +2886,29 @@ class ue {
         const h = this.#s.change(o.group);
         return h.remove(a), h.commit();
       }
-    }), this.#a = new Ht({
+    }), this.#a = new de({
       hostName: n,
       logger: this.#i,
       isInstalled: (o) => this.#t.has(o),
-      report: (o) => this.#h(o)
-    }), this.#s = new ne(n, {
+      report: (o) => this.#c(o)
+    }), this.#s = new Se(n, {
       installations: () => this.#t.values(),
       createDraft: (o, a, h) => this.#t.create(o, a, h),
       resolveInstallation: (o) => this.#t.resolve(o),
-      executeChanges: (o, a) => this.#d(o, a),
+      executeChanges: (o, a) => this.#h(o, a),
       attachInstallation: (o) => this.#t.attach(o),
       discardInstallation: (o, a) => this.#t.discard(o, a),
       runExclusive: (o) => this.#o.run(o),
-      removeInstallations: (o) => this.#f(o),
-      notifyChanged: () => this.#p()
-    }), this.#e = new Kt(
+      removeInstallations: (o) => this.#p(o),
+      notifyChanged: () => this.#d()
+    }), this.#e = new le(
       n,
-      this.#s.nodes(),
-      (o) => this.#h(o)
+      () => ({
+        status: this.#r,
+        installations: this.#t.values(),
+        groups: this.#s.nodes()
+      }),
+      (o) => this.#c(o)
     ), this.diagnostics = this.#e.view, Object.freeze(this);
   }
   get status() {
@@ -2629,12 +2933,12 @@ class ue {
   start() {
     return this.#o.run(async () => {
       if (this.#r !== "active") {
-        this.#c("starting");
+        this.#l("starting");
         try {
           const t = this.#a.buildPlan(this.#t.values());
-          await this.#a.start(t), this.#c("active"), this.#t.settleReadiness(t.order);
+          await this.#a.start(t), this.#l("active"), this.#t.settleReadiness(t.order);
         } catch (t) {
-          this.#c("idle");
+          this.#l("idle");
           for (const e of this.#t.values())
             e.status !== "active" && e.fail(t);
           throw this.#t.settleReadiness(this.#t.values()), t;
@@ -2645,19 +2949,19 @@ class ue {
   stop() {
     return this.#o.run(async () => {
       if (this.#r === "idle") return;
-      this.#c("stopping");
+      this.#l("stopping");
       const t = await this.#a.stop();
-      if (this.#c("idle"), t.length === 1) throw t[0];
+      if (this.#l("idle"), t.length === 1) throw t[0];
       if (t.length > 1) throw new AggregateError(t, "Host shutdown failed");
     });
   }
-  #d(t, e) {
+  #h(t, e) {
     const i = e.filter((s) => s.kind === "install").map((s) => s.installation);
     return this.#o.run(async () => {
       try {
-        if (!t.attached) throw T(t);
+        if (!t.attached) throw D(t);
         if (!e.length) return;
-        this.#r === "active" ? await this.#l(e) : (this.#t.apply(e), this.#t.settleChanges(e, !1)), this.#p();
+        this.#r === "active" ? await this.#u(e) : (this.#t.apply(e), this.#t.settleChanges(e, !1)), this.#d();
       } catch (s) {
         for (const n of i)
           this.#t.contains(n) || this.#t.discard(n, s);
@@ -2665,22 +2969,33 @@ class ue {
       }
     });
   }
-  async #f(t) {
-    t.length && this.#r === "active" ? await this.#l(t) : (this.#t.apply(t), this.#t.settleChanges(t, !1));
+  async #p(t) {
+    t.length && this.#r === "active" ? await this.#u(t) : (this.#t.apply(t), this.#t.settleChanges(t, !1));
   }
-  async #l(t) {
-    const e = await this.#u(t);
+  async #u(t) {
+    const e = await this.#f(t);
     if (this.#t.settleReadiness(e.affected), e.kind === "rolled-back") throw e.error;
     this.#t.settleChanges(t, !0);
   }
-  async #u(t) {
+  // Three failure levels, in the order they are attempted:
+  //
+  //   1. the new plan does not even build       restore declarations, stay active
+  //   2. the plan builds but activation fails   Engine rolls back to the previous
+  //                                             Instances and reports the cause
+  //   3. rollback itself cannot complete        fail closed: everything stops and
+  //                                             the Host reports `idle`
+  //
+  // Level 3 is the one worth stating out loud. A Host that cannot restore its
+  // previous state is not healthy, so it refuses to present itself as active —
+  // `hasCommittedPlan` is what distinguishes the two outcomes here.
+  async #f(t) {
     const e = this.#t.capture(), i = new Set(t.map((n) => n.installation));
-    this.#c("changing");
+    this.#l("changing");
     let s;
     try {
       this.#t.apply(t), s = this.#a.buildPlan(this.#t.values());
     } catch (n) {
-      throw this.#t.restore(e), this.#c("active"), n;
+      throw this.#t.restore(e), this.#l("active"), n;
     }
     try {
       const n = await this.#a.transition(
@@ -2688,33 +3003,33 @@ class ue {
         i,
         () => this.#t.restore(e)
       );
-      return this.#c("active"), n;
+      return this.#l("active"), n;
     } catch (n) {
-      throw this.#c(this.#a.hasCommittedPlan ? "active" : "idle"), n;
+      throw this.#l(this.#a.hasCommittedPlan ? "active" : "idle"), n;
     }
   }
-  #h(t) {
+  #c(t) {
     const e = this.#i;
     try {
       const i = this.#n(t);
       Promise.resolve(i).catch((s) => {
-        Z(e, t, s);
+        gt(e, t, s);
       });
     } catch (i) {
-      Z(e, t, i);
+      gt(e, t, i);
     }
   }
-  #c(t) {
-    this.#r = t, this.#p();
+  #l(t) {
+    this.#r = t, this.#d();
   }
-  #p() {
-    this.#e.publish(this.#r, this.#t.values(), this.#s.nodes());
+  #d() {
+    this.#e.publish();
   }
 }
-function be(r) {
-  return new ue(r);
+function xe(r) {
+  return new Te(r);
 }
-function Z(r, t, e) {
+function gt(r, t, e) {
   try {
     const i = r.error(
       new AggregateError([t, e], "Host error reporter failed")
@@ -2725,21 +3040,21 @@ function Z(r, t, e) {
   }
 }
 export {
-  ut as ConfigValidationError,
+  $t as ConfigValidationError,
   u as DougongError,
-  dt as ErrorSummary,
-  O as ReadonlyMapSnapshot,
-  he as SerialQueue,
-  q as SnapshotPublisher,
-  L as assertPlainRecord,
-  k as asyncDisposeSymbol,
-  be as createHost,
-  ve as definePlugin,
-  g as disposeSymbol,
-  pe as event,
-  ge as extensionPoint,
-  tt as isCancellationReason,
-  Mt as isLogger,
-  we as optional,
-  fe as service
+  z as ReadonlyMapSnapshot,
+  J as RecordedFailure,
+  je as SerialQueue,
+  Z as SnapshotPublisher,
+  B as assertPlainRecord,
+  F as asyncDisposeSymbol,
+  xe as createHost,
+  Ne as definePlugin,
+  v as disposeSymbol,
+  Le as event,
+  ze as extensionPoint,
+  wt as isCancellationReason,
+  se as isLogger,
+  Re as optional,
+  It as service
 };